1608444 - MOZ_CRASH(Blocking classifier error 805d0029 need to be handled by CancelByURLClassifier()) at /builds/worker/workspace/build/src/netwerk/protocol/http/nsHttpChannel.cpp:6189

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Bob Clary [:bc] (inactive)]

1. https://rezka.ag/series/comedy/32174-dyldy-2019.html
   Linux and Windows Nightly. This might be a recent regression. I've never seen it before but I can also reproduce it on Beta.

2. MOZ_CRASH(Blocking classifier error 805d0029 need to be handled by CancelByURLClassifier())

Hit MOZ_CRASH(Blocking classifier error 805d0029 need to be handled by CancelByURLClassifier()) at /builds/worker/workspace/build/src/netwerk/protocol/http/nsHttpChannel.cpp:6189
#01: non-virtual thunk to mozilla::net::nsHttpChannel::Cancel(nsresult) [netwerk/protocol/http/nsHttpChannel.cpp:0]
#02: mozilla::net::HttpChannelParent::RecvCancel(nsresult const&) [netwerk/protocol/http/HttpChannelParent.cpp:828]
#03: mozilla::net::PHttpChannelParent::OnMessageReceived(IPC::Message const&) [s3:gecko-generated-sources:dbef0cf6c7fa9df7fbdae939d77fa59f87915cb1d3b4106e9cbc6af8abcdc976ee779f39809bde8d174b5b2c3c24534e90c88255c77d8f92c47a90c260985129/ipc/ipdl/PHttpChannelParent.cpp::1142]
#04: mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) [s3:gecko-generated-sources:b190d5e799a7761d1e4f5523a5a13c8ae463787be61b9f7285298acf30781e9e729643398873b5f255d8da800b92f933df45b99fc41b5c161715be212dee8319/ipc/ipdl/PContentParent.cpp::6231]
#05: mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) [ipc/glue/MessageChannel.cpp:2213]
#06: mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) [ipc/glue/MessageChannel.cpp:2137]
#07: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) [ipc/glue/MessageChannel.cpp:0]
#08: mozilla::ipc::MessageChannel::MessageTask::Run() [ipc/glue/MessageChannel.cpp:2006]
#09: nsThread::ProcessNextEvent(bool, bool*) [xpcom/threads/nsThread.cpp:1248]
#10: NS_ProcessNextEvent(nsIThread*, bool) [xpcom/threads/nsThreadUtils.cpp:486]
#11: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [ipc/glue/MessagePump.cpp:0]
#12: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:315]
#13: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:291]
#14: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:139]
#15: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:273]
#16: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4594]
#17: XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) [toolkit/xre/nsAppRunner.cpp:4731]
#18: XRE_main(int, char**, mozilla::BootstrapConfig const&) [toolkit/xre/nsAppRunner.cpp:4812]
#19: _fini
#20: libc.so.6 + 0x271e3
#21: _fini

Comment 1

[Honza Bambas (:mayhemer)]

Bob, as I can't repro locally, can you provide a log according https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging
with the following modules:
MOZ_LOG=timestamp,sync,nsHttp:5,nsChannelClassifier:5

thanks.

baku. ehsan, this looks like someone from the child process is trying to cancel the channel with an error code related to classification we only allow to be used on the parent process and only through a special cancellation method (added in bug 1485182).

Has anything changed lately that could be using the 805d0029 = "NS_ERROR_FINGERPRINTING_URI" error from the child process?

Comment 2

[Bob Clary [:bc] (inactive)]

Attachment: zipped log with MOZ_LOG=timestamp,sync,nsHttp:5,nsChannelClassifier:5

Comment 3

[(no longer active)]

I think it's just the code that's buggy here.

• We start from nsHttpBaseChannel::CancelByURLClassifier().
• We enter HttpChannelChild::Cancel(). There, we may end up calling SendCancel().
• If we do that we get to nsHttpChannel::Cancel() in the parent process and then we end up crashing.

I think https://searchfox.org/mozilla-central/rev/9b4b41b95cbcda63f565bdc24411e15248f91d83/netwerk/protocol/http/nsHttpChannel.cpp#6185-6191 is a bogus check and needs to be removed.

Comment 4

[(no longer active)]

Attachment: Bug 1608444 - Make sure the debug-only check only runs the first time the channel is cancelled with a URL classifier blocking error code;

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dcca2e1d7f97
Make sure the debug-only check only runs the first time the channel is cancelled with a URL classifier blocking error code; r=mayhemer

Comment 6

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/dcca2e1d7f97

Comment 7

[Cristian Fogel [:cfogel]]

Removing QE+ flag.
In an attempt to reproduce was unable to get asan-debug builds that would be affected.
For what it's worth, verified with 75.0a1 Build ID 20200217160811 on Windows10/Ubuntu18 and did not encounter any crashes.