2048294 - Crash in [@ mozilla::net::nsHttpConnection::Activate]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P2)

Description

[Dianna Smith [:diannaS]]

Crash report: https://crash-stats.mozilla.org/report/index/95e0e55a-6d11-46b6-9913-33ef70260616

Reason:

EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames:

0  xul.dll  mozilla::net::nsHttpConnection::Activate(mozilla::net::nsAHttpTransaction*, u...  netwerk/protocol/http/nsHttpConnection.cpp:652
1  xul.dll  mozilla::net::nsHttpConnectionMgr::DispatchAbstractTransaction(mozilla::net::...  netwerk/protocol/http/nsHttpConnectionMgr.cpp:1882
2  xul.dll  mozilla::net::nsHttpConnectionMgr::DispatchTransaction(mozilla::net::Connecti...  netwerk/protocol/http/nsHttpConnectionMgr.cpp:1849
3  xul.dll  mozilla::net::nsHttpConnectionMgr::ProcessNewTransaction(mozilla::net::nsHttp...  netwerk/protocol/http/nsHttpConnectionMgr.cpp:1966
4  xul.dll  mozilla::net::nsHttpConnectionMgr::OnMsgNewTransaction(int, mozilla::net::ARe...  netwerk/protocol/http/nsHttpConnectionMgr.cpp:2321
5  xul.dll  RefPtr<mozilla::net::nsHttpConnectionMgr>::Proxy<void, int, mozilla::net::ARe...  mfbt/RefPtr.h:357
5  xul.dll  mozilla::net::ConnEvent::Run()  netwerk/protocol/http/nsHttpConnectionMgr.cpp:180
6  xul.dll  nsThread::ProcessNextEvent(bool, bool*)  xpcom/threads/nsThread.cpp:1173
6  xul.dll  NS_ProcessNextEvent(nsIThread*, bool)  xpcom/threads/nsThreadUtils.cpp:472
7  xul.dll  mozilla::net::nsSocketTransportService::Run()  netwerk/base/nsSocketTransportService2.cpp:1254

Comment 1

[Kershaw Chang [:kershaw]]

Attachment: Bug 2048294 - Don't re-queue a transaction if it's already dispatched to a connection, r=#necko

WebSocket transactions are sticky, so once they are dispatched, their Connection() is set and ProcessNewTransaction re-dispatches them onto that same connection. During a Happy Eyeballs race, a losing attempt could re-queue a transaction that the winner has already dispatched, causing it to be re-dispatched onto a connection that no longer has a transport and.

To avoid that, skip re-queuing or re-activating at the Happy Eyeballs handoff points (ProcessTCPConn, ProcessUDPConn, EnterSucceeded, and EnterDone) once the transaction already has a Connection().

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/82d3302274c8
https://hg.mozilla.org/integration/autoland/rev/ac07897db70f
Don't re-queue a transaction if it's already dispatched to a connection, r=necko-reviewers,valentin

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/ac07897db70f