1628262 - Crash in [@ mozilla::net::HttpChannelChild::~HttpChannelChild]

Status: RESOLVED DUPLICATE of bug 1627946

(Core :: Networking: HTTP, defect, P2)

Description

[Simon Giesecke [:sg] [he/him]]

This bug is for crash report bp-d83ea93b-1ecf-4343-a726-e2e780200408.

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::HttpChannelChild::~HttpChannelChild netwerk/protocol/http/HttpChannelChild.cpp:210
1 xul.dll mozilla::net::HttpChannelChild::~HttpChannelChild netwerk/protocol/http/HttpChannelChild.cpp:204
2 xul.dll mozilla::net::HttpChannelChild::Release netwerk/protocol/http/HttpChannelChild.cpp:276
3 xul.dll mozilla::detail::RunnableMethodImpl< xpcom/threads/nsThreadUtils.h:1220
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1220
5 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:481
6 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

A diagnostic assertion is hit here, for this report with the reason ~HttpChannelChild 0000015C40B84000, mOnStopRequestCalled=false, mStatus=0x804b0002, mActorDestroyReason=1, mRedirectChannelChild=0000000000000000.

This started with build id 20200407093520, so far a few reports from Windows and Mac, none from Linux.

Comment 1

[Paul Adenot (:padenot)]

I've had this while spamming command+shift+r on web.whatsapp.com, that was behaving weirdly (js error in their code: window.Exe is not defined), on latest Nightly on macOS.

https://crash-stats.mozilla.org/report/index/6760e975-0e47-41ee-b5c8-c689b0200409

Comment 2

[Intermittent Failures Robot]

1 failures in 4823 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Platform breakdown:

• macosx1014-64-shippable: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1628262&startday=2020-04-06&endday=2020-04-12&tree=all

Comment 3

[Pascal Chevrel:pascalc (PTO until Sept 2)]

The volume is significant on beta, Nhi could you help us get this bug triaged and assigned to somebody? Thanks

Comment 4

[Nhi Nguyen (:nhi)]

Junior, could you take a look? Thanks!

Comment 5

[Honza Bambas (:mayhemer)]

People, this is the diagnostic assertion I've added. It's early-beta only and has the same rate as the original bug we are trying to investigate. There is an updated version of the patch to provide more information in the original bug, waiting for review.

Michal, can you please look again at that review? I am sorry I reacted to that so long the first time, your request for update got lost in my emails. Thanks.

Comment 6

[Michal Novotny [:michal]]

I accepted that patch yesterday (sorry for the delay). Is there anything else I should do now?

Comment 7

[Honza Bambas (:mayhemer)]

(In reply to Michal Novotny [:michal] from comment #6)

I accepted that patch yesterday (sorry for the delay). Is there anything else I should do now?

Hmm.. I again missed that email... There is nothing else for you to do. Thanks!

Comment 8

[Junior [inactive]]

In bug 1596295, We caught a case that there is non-empty channel event queue when HttpChannelChild's destructor.
That might be related.

Comment 9

[Asif Youssuff]

I can reproduce this crash consistently on https://www.lg.com/us/mobile-phones/v40-thinq/specs

bp-aec3a5b3-5014-4943-bfef-3d32d0200529
bp-8f851f00-1822-4554-9425-8ce720200529
bp-37cbfc2f-60b4-4db5-90f1-bce730200529

Adding about:support in the next comment.

Disabling the "LocalCDN (fork from Decentraleyes)" extension works around the issue in my profile.

Comment 10

[Asif Youssuff]

Attachment: about:support for comment 9

Comment 11

[Honza Bambas (:mayhemer)]

(In reply to Asif Youssuff from comment #9)

I can reproduce this crash consistently on https://www.lg.com/us/mobile-phones/v40-thinq/specs

bp-aec3a5b3-5014-4943-bfef-3d32d0200529
bp-8f851f00-1822-4554-9425-8ce720200529
bp-37cbfc2f-60b4-4db5-90f1-bce730200529

Adding about:support in the next comment.

Disabling the "LocalCDN (fork from Decentraleyes)" extension works around the issue in my profile.

Thanks. The status code of the channel in your reports is different than the one I often see in public crash reports (NS_OK vs NS_ERROR_ABORT). According how many (many!) addons you have installed, I suspect this to be addon related. I can try to install some of them and try to reproduce, tho.

Comment 12

[Honza Bambas (:mayhemer)]

(In reply to Asif Youssuff from comment #9)

I can reproduce this crash consistently on https://www.lg.com/us/mobile-phones/v40-thinq/specs

bp-aec3a5b3-5014-4943-bfef-3d32d0200529
bp-8f851f00-1822-4554-9425-8ce720200529
bp-37cbfc2f-60b4-4db5-90f1-bce730200529

Adding about:support in the next comment.

Disabling the "LocalCDN (fork from Decentraleyes)" extension works around the issue in my profile.

I can reproduce with the extensions installed. But it's not possible to diagnose this (crashes with logging on - bug 1642318) and doesn't fail when attached to a debugger... back to square 1.