Closed Bug 1648132 Opened 4 years ago Closed 4 years ago

Crash in [@ mozilla::extensions::StreamFilterParent::Init]

Categories

(Core :: Networking: HTTP, defect, P1)

Unspecified
Windows 10
defect

Tracking

()

RESOLVED FIXED
mozilla79
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- unaffected
firefox77 --- unaffected
firefox78 --- unaffected
firefox79 + fixed

People

(Reporter: pascalc, Assigned: CuveeHsu)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

This bug is for crash report bp-0ccaad71-7d69-4eb2-88a4-f05530200624.

Top 10 frames of crashing thread:

0 xul.dll mozilla::extensions::StreamFilterParent::Init toolkit/components/extensions/webrequest/StreamFilterParent.cpp:163
1 xul.dll static mozilla::extensions::StreamFilterParent::Attach toolkit/components/extensions/webrequest/StreamFilterParent.cpp:146
2 xul.dll mozilla::net::HttpChannelChild::RecvAttachStreamFilter netwerk/protocol/http/HttpChannelChild.cpp:3863
3 xul.dll mozilla::net::PHttpChannelChild::OnMessageReceived ipc/ipdl/PHttpChannelChild.cpp:1013
4 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:8188
5 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2093
6 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1972
7 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:146
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1234
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:501

This is spiking in build 20200624093107
Changelog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d48aa0f0aa0bbe69f8eae663be2f5671c41af27c&tochange=e858eb7ffebab87cc1902efc7f7d17dd083ebc8e

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Component: General → Request Handling

Seems to crash consistently for me when opening YouTube's home page. Report: https://crash-stats.mozilla.org/report/index/0d974273-b5bd-4424-93f0-f3d480200624

Severity: -- → S1

This is race between RecvAttachStreamFilter and HttpChannelChild::DoOnStartRequest
Bug 1646592 might ease this, but it will take more care of the IPC binding.

I'll take a look and find out some quick fix.

Assignee: nobody → juhsu
Component: Request Handling → Networking: HTTP
Priority: -- → P1
Product: WebExtensions → Core
Regressed by: 1633935
See Also: → 1646592
Has Regression Range: --- → yes

This is showing up pretty high on the Nightly79 topcrash list.

HttpChannelChild::OnStartRequest should copy argument only since HttpChannelChild::RecvAttachStreamFilter, who sets new listener, could be after OnStartRequest.

Attachment #9159071 - Attachment description: Bug 1648132 - Do not allow to set new listener after we handles all the IPCs before SendOnStartReqeust, r=kershaw,mayhemer → Bug 1648132 - Do not allow setting new listener after we handle all the IPCs before SendOnStartReqeust, r=kershaw,mayhemer
Pushed by juhsu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/19ee22687f57
Do not allow setting new listener after we handle all the IPCs before SendOnStartReqeust, r=kershaw
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla79

Hi. I am the developer of an add-on called Twitter Link Deobfuscator which uses webRequest.StreamFilter.ondata to intercept and modify response data sent from the Twitter servers. One of the users told me that he experienced multiple tab crashes and we suspect that they're related to this bug.

He submitted 2 crash reports: c0537db9-aa83-4558-9013-707e50201026 and 6c6a3264-b361-45a3-8848-5d9f20201027. The first crash (c0537db9-aa83-4558-9013-707e50201026) happened on a tab with a Twitter page opened and the second (6c6a3264-b361-45a3-8848-5d9f20201027) happened on a Youtube page. In both cases, only the tabs crashed, not the browser.

I can see only public data from those crash reports. Can anyone tell me if they're caused by this bug or do I need to create another bug report?

Alin, please create a new bug. You can mention this bug in it.

(In reply to Shane Caraveo (:mixedpuppy) from comment #9)

Alin, please create a new bug. You can mention this bug in it.

OK, thanks.

You need to log in before you can comment on or make changes to this bug.