1643515 - Crash in [@ mozilla::net::HttpTransactionParent::DoNotifyListener]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P2)

Description

[Andrew McCreight [:mccr8]]

This bug is for crash report bp-31186883-65fd-4717-a35e-cd9880200527.

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::HttpTransactionParent::DoNotifyListener netwerk/protocol/http/HttpTransactionParent.cpp:632
1 xul.dll mozilla::net::ChannelEventQueue::FlushQueue netwerk/ipc/ChannelEventQueue.cpp:90
2 xul.dll mozilla::net::ChannelEventQueue::ResumeInternal::CompleteResumeRunnable::Run netwerk/ipc/ChannelEventQueue.cpp:148
3 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1211
4 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:501
5 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
6 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
7 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
8 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137
9 xul.dll nsAppShell::Run widget/windows/nsAppShell.cpp:430

The first build I see this in is 20200526213752. It looks like a null deref on this line: mChannel->OnStartRequest(this);.

The volume is not very high, but it seems pretty consistent starting with that build.

These are the change sets for that build: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=da2c7b0ac9a44e44000a6be1cea9d753c33784d4&tochange=e803948bb3cd52dae5566bfc517e3d04f06252e7

Comment 1

[Ryan VanderMeulen [:RyanVM]]

No crashes in this or bug 1644065 starting with 20200605214011. Possibly fixed by something in this range?
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fecffba489bd&tochange=dadc7312128e70919054924ab980f4344c504da2

Maybe bug 1641496?

Comment 2

[Kershaw Chang [:kershaw]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #1)

No crashes in this or bug 1644065 starting with 20200605214011. Possibly fixed by something in this range?
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fecffba489bd&tochange=dadc7312128e70919054924ab980f4344c504da2

Maybe bug 1641496?

We still have this crash, so this is not fixed by bug 1641496 apparently.

Comment 3

[Kershaw Chang [:kershaw]]

I think I've figured out the reason of this crash.
Apparently, the crash is a null deref on this line: mChannel->OnStartRequest(this);. in HttpTransactionParent::DoNotifyListener. However, mChannel is never set to null in HttpTransactionParent, so the only possibility is that the HttpTransactionParent is already dead.
The only place that could cause this crash is when HttpTransactionParent::Cancel is called in HttpTransactionParent::ActorDestroy. At this line , we queue an event to call HttpTransactionParent::DoNotifyListener and it is possible that the HttpTransactionParent is already released when this event is about to run.

Comment 4

[Kershaw Chang [:kershaw]]

Attachment: Bug 1643515 - Implement HttpTransactionParent::ActorDestroy properly, r=dragana

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/504febbebd4c
Implement HttpTransactionParent::ActorDestroy properly, r=dragana

Comment 6

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/504febbebd4c

Comment 7

[Catalin Sasca, Desktop Test Engineering [:csasca]]

Hello :kershaw, is there anything that QA can do here? If so, could you provide any STR for this? Thanks!

Comment 8

[Kershaw Chang [:kershaw]]

(In reply to Catalin Sasca, QA [:csasca] from comment #7)

Hello :kershaw, is there anything that QA can do here? If so, could you provide any STR for this? Thanks!

Since I don't have STR and the socket process is not enabled yet, I think we don't have to spend time on verifying this bug.
Thanks.