1853231 - Crash in [@ mozilla::net::ConnectionHandle::DontReuse]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Donal Meehan [:dmeehan]]

Crash report: https://crash-stats.mozilla.org/report/index/d05495ab-1350-426e-ad1d-80b5e0230914

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::net::ConnectionHandle::DontReuse  dom/media/webrtc/libwebrtcglue/WebrtcGmpVideoCodec.h:331
1  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply<nsMemoryReporterManager, nsresult  const  xpcom/threads/nsThreadUtils.h:1164
1  xul.dll  std::invoke  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/type_traits:1524
1  xul.dll  std::_Apply_impl  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/tuple:974
1  xul.dll  std::apply  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/tuple:979
1  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply  xpcom/threads/nsThreadUtils.h:1162
1  xul.dll  mozilla::detail::RunnableMethodImpl<nsMemoryReporterManager*, nsresult   xpcom/threads/nsThreadUtils.h:1213
2  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1193
3  xul.dll  NS_ProcessNextEvent  xpcom/threads/nsThreadUtils.cpp:480
3  xul.dll  mozilla::net::nsSocketTransportService::Run  netwerk/base/nsSocketTransportService2.cpp:1191

Comment 1

[Donal Meehan [:dmeehan]]

::valentin not sure what introduced/caused this - could it be Bug 1820807? (just a guess based on component)

Comment 2

[Kershaw Chang [:kershaw]]

Looks like this is caused by Bug 1820807.
I think this crash is becasue the mConn is null and the only place to set mConn to null is ConnectionHandle::Reset.
Moreover, the only reason Reset being called is conn->Activate returns an error.

My theory about the failure of Activate is that the mTransaction is not done.
This is because we call RedirectToNewChannelForAuthRetry within nsHttpChannel::OnStartRequest and we always set the sticky connection flag to the auth channel. So, when the new transaction is dispatched to the same connection (the old transaction may be still there), we could hit this crash.
Compared to the old approach, we do AuthRetry in nsHttpChannel::OnStopRequest. At this point, the transaction should be already cleared.

Sunil, could you take a look?
Thanks.

Comment 3

[Cosmin Sabou [:CosminS]]

Regressor was backed out of mozilla-central.

Backout link: https://hg.mozilla.org/mozilla-central/rev/f4b0e304eceb