Closed Bug 1616005 Opened 5 years ago Closed 5 years ago

Crash in [@ mozilla::net::nsHttpConnection::OnWriteSegment]

Categories

(Core :: Networking: HTTP, defect, P1)

Product:
Core
Component:
Networking: HTTP
Platform:
Unspecified
Windows 10
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla76
Tracking Flags:
Tracking Status
firefox-esr68 --- unaffected
firefox74 --- disabled
firefox75 --- disabled
firefox76 --- fixed

People

(Reporter: gsvelto, Assigned: dragana)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, Whiteboard: [necko-triaged])

Crash Data

This bug is for crash report bp-fa15e465-9e00-45c9-9d3d-c33850200215.

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::nsHttpConnection::OnWriteSegment netwerk/protocol/http/nsHttpConnection.cpp:2192
1 xul.dll mozilla::net::Http3Session::ProcessInput netwerk/protocol/http/Http3Session.cpp:200
2 xul.dll mozilla::net::Http3Session::Process netwerk/protocol/http/Http3Session.cpp:354
3 xul.dll mozilla::net::nsHttpConnection::EnsureNPNCompleteHttp3 netwerk/protocol/http/nsHttpConnection.cpp:749
4 xul.dll mozilla::net::nsHttpConnection::OnSocketWritable netwerk/protocol/http/nsHttpConnection.cpp:2079
5 xul.dll mozilla::net::nsHttpConnection::OnOutputStreamReady netwerk/protocol/http/nsHttpConnection.cpp:2639
6 xul.dll mozilla::net::nsSocketOutputStream::OnSocketReady netwerk/base/nsSocketTransport2.cpp:517
7 xul.dll mozilla::net::nsSocketTransport::OnSocketReady netwerk/base/nsSocketTransport2.cpp:2319
8 xul.dll mozilla::net::nsSocketTransportService::Run netwerk/base/nsSocketTransportService2.cpp:1095
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1220

This looks like a NULL-pointer crash, this seems to have started in buildid 20200214100511.

Assignee: nobody → dd.mozilla
Priority: -- → P1
Whiteboard: [necko-triaged]

This is QUIC only issue and QUIC is turned off by default.

Blocks: QUIC

(In reply to Dragana Damjanovic [:dragana] from comment #1)

This is QUIC only issue and QUIC is turned off by default.

Is QUIC controlled by network.http.http3.enabled? I have it set to false (default) and my browser crashed just now with this signature.

Nightly 20200223093951 on Linux.

Can you share your crash report id?

status-firefox75: fix-optional → affected
tracking-firefox75: - → ---
Flags: needinfo?(gwarser)

Three in few minutes interval from 20 February:

I found this bug, and checked the status of network.http.http3.enabled - it was disabled, but I was not sure if it was disabled before the crash.

And from 23: https://crash-stats.mozilla.org/report/index/f0f90189-0416-4303-b3ec-783150200223

This time I'm sure it was disabled.

Flags: needinfo?(gwarser)

Dragana, can you take another look how this can affect profiles with http3 disabled?

Flags: needinfo?(dd.mozilla)

Did you have the pref enabled at some point in time?

Flags: needinfo?(dd.mozilla) → needinfo?(gwarser)

I see it on my list of prefs to observe, so it might have been touched before February 20. I'm sure it was disabled when I looked for it on February 20. I then accidentally toggled it few times (double click when selecting). I'm also sure It was disabled after that (including February 23).

Flags: needinfo?(gwarser)

(In reply to gwarser from comment #7)

I see it on my list of prefs to observe, so it might have been touched before February 20. I'm sure it was disabled when I looked for it on February 20. I then accidentally toggled it few times (double click when selecting). I'm also sure It was disabled after that (including February 23).

I will add another check for the pref to make sure that cached alt-svc are not used as well.

(In reply to Dragana Damjanovic [:dragana] from comment #8)

(In reply to gwarser from comment #7)
...to make sure that cached alt-svc are not used as well.

This cache can be cleared somehow? Does clearing everything from Ctrl+Shift+Del dialog except "Browsing & Download History" will help? Because I did this two days ago and still getting these crashes. Additionally today I see new but similar signature: "mozilla::net::HttpConnectionUDP::OnWriteSegment".

UDP:

Crash Signature: [@ mozilla::net::nsHttpConnection::OnWriteSegment] → [@ mozilla::net::nsHttpConnection::OnWriteSegment] [@ mozilla::net::HttpConnectionUDP::OnWriteSegment]

(In reply to gwarser from comment #9)

(In reply to Dragana Damjanovic [:dragana] from comment #8)

(In reply to gwarser from comment #7)
...to make sure that cached alt-svc are not used as well.

This cache can be cleared somehow? Does clearing everything from Ctrl+Shift+Del dialog except "Browsing & Download History" will help? Because I did this two days ago and still getting these crashes. Additionally today I see new but similar signature:

I think this cache is not deleted by that.

Bug 1619793 should fix the issue that http3 is used if it disabled (this can happen only if the pref has been enabled in the past).
The crash maybe be (most probably) fixed by bug 1619764.

(In reply to gwarser from comment #9)

(In reply to Dragana Damjanovic [:dragana] from comment #8)

(In reply to gwarser from comment #7)
...to make sure that cached alt-svc are not used as well.

This cache can be cleared somehow? Does clearing everything from Ctrl+Shift+Del dialog except "Browsing & Download History" will help? Because I did this two days ago and still getting these crashes. Additionally today I see new but similar signature: "mozilla::net::HttpConnectionUDP::OnWriteSegment".

UDP:

gwarser, can you try to make a http log for me:
https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging

I am not sure how this crash is possible at all.

Thanks!
(you can send the log to me directly, the log may contain e.g. cookies)

Flags: needinfo?(gwarser)

gwarser, can you try to make a http log for me

You mean up until it crashes?(can take some time) Or until something http3 specific is logged?

I'll just set it with rotate:100 (enough?) - will see.

Flags: needinfo?(gwarser)

(In reply to gwarser from comment #14)

gwarser, can you try to make a http log for me

You mean up until it crashes?(can take some time) Or until something http3 specific is logged?

Until crash

I'll just set it with rotate:100 (enough?) - will see.

I think it should be enough.

(In reply to Dragana Damjanovic [:dragana] from comment #15)

I sent you the log.

(In reply to gwarser from comment #16)

(In reply to Dragana Damjanovic [:dragana] from comment #15)

I sent you the log.

Thank you very much for the log. It is a race condition that I will fix soon.
If you update Nightly this will happen much less frequently, almost never. This race and another bug, that is already fixed, make this happen often in your Nightly.

This will be fixed by bug 1622861.

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
status-firefox74: --- → disabled
status-firefox76: --- → fixed
status-firefox-esr68: --- → unaffected
Target Milestone: --- → mozilla76
You need to log in before you can comment on or make changes to this bug.