Closed Bug 1643515 Opened 2 years ago Closed 2 years ago

Crash in [@ mozilla::net::HttpTransactionParent::DoNotifyListener]

Categories

(Core :: Networking: HTTP, defect, P2)

Unspecified
Windows 10
defect

Tracking

()

RESOLVED FIXED
mozilla79
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- wontfix
firefox77 --- unaffected
firefox78 --- wontfix
firefox79 --- fixed

People

(Reporter: mccr8, Assigned: kershaw)

References

Details

(Keywords: crash, regression, Whiteboard: [necko-triaged])

Crash Data

Attachments

(1 file)

This bug is for crash report bp-31186883-65fd-4717-a35e-cd9880200527.

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::HttpTransactionParent::DoNotifyListener netwerk/protocol/http/HttpTransactionParent.cpp:632
1 xul.dll mozilla::net::ChannelEventQueue::FlushQueue netwerk/ipc/ChannelEventQueue.cpp:90
2 xul.dll mozilla::net::ChannelEventQueue::ResumeInternal::CompleteResumeRunnable::Run netwerk/ipc/ChannelEventQueue.cpp:148
3 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1211
4 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:501
5 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
6 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
7 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
8 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137
9 xul.dll nsAppShell::Run widget/windows/nsAppShell.cpp:430

The first build I see this in is 20200526213752. It looks like a null deref on this line: mChannel->OnStartRequest(this);.

The volume is not very high, but it seems pretty consistent starting with that build.

These are the change sets for that build: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=da2c7b0ac9a44e44000a6be1cea9d753c33784d4&tochange=e803948bb3cd52dae5566bfc517e3d04f06252e7

See Also: → 1644065

No crashes in this or bug 1644065 starting with 20200605214011. Possibly fixed by something in this range?
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fecffba489bd&tochange=dadc7312128e70919054924ab980f4344c504da2

Maybe bug 1641496?

Flags: needinfo?(kershaw)

(In reply to Ryan VanderMeulen [:RyanVM] from comment #1)

No crashes in this or bug 1644065 starting with 20200605214011. Possibly fixed by something in this range?
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fecffba489bd&tochange=dadc7312128e70919054924ab980f4344c504da2

Maybe bug 1641496?

We still have this crash, so this is not fixed by bug 1641496 apparently.

Assignee: nobody → kershaw
Severity: -- → S3
Flags: needinfo?(kershaw)
Priority: -- → P2
Whiteboard: [necko-triaged]

I think I've figured out the reason of this crash.
Apparently, the crash is a null deref on this line: mChannel->OnStartRequest(this);. in HttpTransactionParent::DoNotifyListener. However, mChannel is never set to null in HttpTransactionParent, so the only possibility is that the HttpTransactionParent is already dead.
The only place that could cause this crash is when HttpTransactionParent::Cancel is called in HttpTransactionParent::ActorDestroy. At this line , we queue an event to call HttpTransactionParent::DoNotifyListener and it is possible that the HttpTransactionParent is already released when this event is about to run.

Pushed by kjang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/504febbebd4c
Implement HttpTransactionParent::ActorDestroy properly, r=dragana
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla79

Hello :kershaw, is there anything that QA can do here? If so, could you provide any STR for this? Thanks!

Flags: needinfo?(kershaw)

(In reply to Catalin Sasca, QA [:csasca] from comment #7)

Hello :kershaw, is there anything that QA can do here? If so, could you provide any STR for this? Thanks!

Since I don't have STR and the socket process is not enabled yet, I think we don't have to spend time on verifying this bug.
Thanks.

Flags: needinfo?(kershaw)
You need to log in before you can comment on or make changes to this bug.