1657493 - Crash [@ mozilla::MozPromise<T>::Private::Resolve<T> ] reading/clicking on news article

Status: VERIFIED FIXED

(MailNews Core :: Networking: NNTP, defect, P1)

Description

[Bob Clary [:bc] (inactive)]

Hit this today with Dave Lawrence's happy bmo push day! message for 8/5/20 on Thunderbird Daily / Linux.

Just clicking on the message causes the crash.
news://news.mozilla.org:119/[e-mail]

This link for the same message in a different newsgroup did not crash
news://news.mozilla.org:119/[e-mail]

bp-a50b5e24-e65b-4cfa-91c7-46cc90200805
bp-6cfd9f88-3e4b-4b6b-8e3e-aab550200805
bp-4b75906d-fa4d-4f6f-8cff-247400200805

Frame 	Module 	Signature 	Source 	Trust
0 	libxul.so 	void mozilla::MozPromise<mozilla::net::DocumentLoadListener::OpenPromiseSucceededType, mozilla::net::DocumentLoadListener::OpenPromiseFailedType, true>::Private::Resolve<mozilla::net::DocumentLoadListener::OpenPromiseSucceededType>(mozilla::net::DocumentLoadListener::OpenPromiseSucceededType&&, char const*) 	xpcom/threads/MozPromise.h:1127 	context
1 	libxul.so 	mozilla::net::DocumentLoadListener::RedirectToRealChannel(unsigned int, unsigned int, mozilla::Maybe<unsigned long> const&, nsTArray<mozilla::ipc::Endpoint<mozilla::extensions::PStreamFilterParent> >&&) 	netwerk/ipc/DocumentLoadListener.cpp:1773 	cfi
2 	libxul.so 	mozilla::net::DocumentLoadListener::TriggerRedirectToRealChannel(mozilla::Maybe<unsigned long> const&) 	netwerk/ipc/DocumentLoadListener.cpp:1871 	cfi
3 	libxul.so 	mozilla::net::DocumentLoadListener::OnStartRequest(nsIRequest*) 	netwerk/ipc/DocumentLoadListener.cpp:2067 	cfi
4 	libxul.so 	mozilla::net::ParentChannelListener::OnStartRequest(nsIRequest*) 	netwerk/protocol/http/ParentChannelListener.cpp:98 	cfi
5 	libxul.so 	nsDocumentOpenInfo::OnStartRequest(nsIRequest*) 	uriloader/base/nsURILoader.cpp:166 	cfi
6 	libxul.so 	mozilla::net::ParentProcessDocumentOpenInfo::OnDocumentStartRequest(nsIRequest*) 	netwerk/ipc/DocumentLoadListener.cpp:274 	cfi
7 	libxul.so 	mozilla::net::nsStreamListenerTee::OnStartRequest(nsIRequest*) 	netwerk/base/nsStreamListenerTee.cpp:24 	cfi
8 	libxul.so 	nsMsgProtocol::OnStartRequest(nsIRequest*) 	comm/mailnews/base/util/nsMsgProtocol.cpp:319 	cfi
9 	libxul.so 	nsNNTPProtocol::LoadUrl(nsIURI*, nsISupports*) 	comm/mailnews/news/src/nsNNTPProtocol.cpp:1010 	cfi
10 	libxul.so 	nsMsgProtocol::AsyncOpen(nsIStreamListener*) 	comm/mailnews/base/util/nsMsgProtocol.cpp:557 	cfi

Comment 1

[Wayne Mery (:wsmwk)]

There also some Mac crashes bp-d95cb981-7231-4ad6-874f-80f9e0200805

Comment 2

[Axel Hecht [:Pike]]

I'm on 20200805101432, macos, and see the same thing. My about:crashes doesn't show them, though.

Comment 3

[Richard Marti (:Paenglab)]

It also crashes on Windows when trying to read a newsgroup message.
bp-ac10406e-f650-4ed1-a67f-8562a0200807

Comment 4

[Alfred Peters [:infofrommozilla]]

regressionwindow-wanted:
Last good:
Comm-Central:ae90541a3ecd / Mozilla-Central:9239fb1c6ee8
First bad:
Comm-Central:ae90541a3ecd / Mozilla-Central:720b1bbf1b6d

So regression by Bug 1654922

Comment 5

[Neha Kochar [:neha]]

Anny, can you check this as comment 4 suggests its a regression from the DC pref removal?

Comment 6

[Neha Kochar [:neha]]

Nevermind, saw that the Thunderbird person is also cc'd here.

Comment 7

[Alfred Peters [:infofrommozilla]]

I tried a former good build and fiddled a bit with the prefs.

If I set the pref browser.tabs.documentchannel.ppdc to true, this build also crashes:

bp-2a813687-16a1-439a-a9b4-803a60200815

So Bug 1654922 probably just reveals an older problem.

Comment 8

[WaltS48 [:walts48]]

Also crashes on Linux when trying to read a newsgroup message.

Comment 9

[Alfred Peters [:infofrommozilla]]

(In reply to Alfred Peters from comment #7)

I tried a former good build and fiddled a bit with the prefs.

If I set the pref browser.tabs.documentchannel.ppdc to true, this build also crashes:

(In reply to Pulsebot from Bug 1633198 comment #3)

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/353338823ec9
set browser.tabs.documentchannel.ppdc false (tests opening new windows broken without it). rs=bustage-fix

Yep, nothing new... :-(

Comment 11

[Wayne Mery (:wsmwk)]

needs additional immediate attention in bug 1633198 ?
easily reproduced

bp-b39efebb-9dd8-4f26-9ac9-d61fc0200826 on windows 81.0b1

Comment 12

[Magnus Melin [:mkmelin]]

Crashes at https://hg.mozilla.org/mozilla-central/file/tip/xpcom/threads/MozPromise.h#l1127 so something there is not what's expected.
Anyway, looks like I did find a bandaid fix

Comment 13

[Magnus Melin [:mkmelin]]

Attachment: bug1657493_news_crash_bandaid.patch

Bandaid fix. With this I can read news articles.
May be slower than usual though?

Anyway, it would be nice not to have this crash going to beta.

Comment 14

[Ben Campbell]

Comment on attachment 9172251 [details] [diff] [review]
bug1657493_news_crash_bandaid.patch

Review of attachment 9172251 [details] [diff] [review]:
-----------------------------------------------------------------

Seems like a fine stopgap until we dig into it deeper.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/6233cd297d44
don't crash when readin news. r=benc

Comment 16

[Magnus Melin [:mkmelin]]

Comment on attachment 9172251 [details] [diff] [review]
bug1657493_news_crash_bandaid.patch

[Approval Request Comment]
Crash fix. Should be able to verify it on trunk with today's nightly which is building as we speak.

Comment 17

[Richard Marti (:Paenglab)]

It does no more crash...but also doesn't show new news messages. It only shows already downloaded news. It stays on "Loading Message..." in the statusbar. Tested on different news servers.

Comment 18

[Alfred Peters [:infofrommozilla]]

(In reply to Richard Marti (:Paenglab) from comment #17)

It does no more crash...but also doesn't show new news messages. It only shows already downloaded news. It stays on "Loading Message..." in the statusbar. Tested on different news servers.

Same here.
TB shows only articles from the local datastore or possibly from the cache.

Comment 19

[Magnus Melin [:mkmelin]]

Yeah not working very well... but no crash.

Comment 20

[Wayne Mery (:wsmwk)]

We decided to not take it on this beta. We'll get it on the next round.

Comment 21

[Arthur K. (he/him)]

I hit this when I tested 81.0b2 and the signature is a bit different (@ RtlAcquireSRWLockExclusive | mozilla::detail::MutexImpl::MutexImpl | mozilla::MakeRefPtr<T>)

Crash info here: https://crash-stats.mozilla.org/report/index/98bf463d-0f65-445b-89a3-275ea0200831

Comment 22

[Wayne Mery (:wsmwk)]

Comment on attachment 9172251 [details] [diff] [review]
bug1657493_news_crash_bandaid.patch

[Triage Comment]
Approved for beta

Comment 23

[Rob Lemley [:rjl]]

Thunderbird 81.0b3:
https://hg.mozilla.org/releases/comm-beta/rev/e67cb6fa7d00

Comment 26

[Wayne Mery (:wsmwk)]

I can confirm, crash is gone in 81.0b3 candidate

Comment 27

[Wayne Mery (:wsmwk)]

possible dup bug 1630597

Comment 28

[Matthew]

(In reply to Wayne Mery (:wsmwk) from comment #26)

I can confirm, crash is gone in 81.0b3 candidate

Crash is gone but in 81.0b4 still can't read newsgroups messages (messages are not fetched) :-(

Comment 29

[Wayne Mery (:wsmwk)]

(In reply to Matthew from comment #28)

still can't read newsgroups messages (messages are not fetched) :-(

That will be fixed via bug 1661955 - available in beta 82 next week