2048392 - Crash in [@ mozilla::net::nsHttpTransaction::ParseLineSegment]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

First reported build ID for this instance of the crash signature is Firefox 154.0a1 20260615215140.

Bug 2031615, bug 2031615, bug 2023355 and bug 2027861 landed in that Nightly build.

Crash report: https://crash-stats.mozilla.org/report/index/86f9dd17-7c7e-4199-af71-1ae450260616

Reason:

EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames:

0  xul.dll  mozilla::net::nsHttpTransaction::ParseLineSegment(char*, unsigned int)  netwerk/protocol/http/nsHttpTransaction.cpp:2269
1  xul.dll  mozilla::net::nsHttpTransaction::ParseHead(char*, unsigned int, unsigned int*)  netwerk/protocol/http/nsHttpTransaction.cpp:2367
2  xul.dll  mozilla::net::nsHttpTransaction::ProcessData(char*, unsigned int, unsigned int*)  netwerk/protocol/http/nsHttpTransaction.cpp:2727
2  xul.dll  mozilla::net::nsHttpTransaction::WritePipeSegment(nsIOutputStream*, void*, ch...  netwerk/protocol/http/nsHttpTransaction.cpp:924
3  xul.dll  nsPipeOutputStream::WriteSegments(nsresult (*)(nsIOutputStream*, void*, char*...  xpcom/io/nsPipe3.cpp:1675
4  xul.dll  mozilla::net::nsHttpTransaction::WriteSegments(mozilla::net::nsAHttpSegmentWr...  netwerk/protocol/http/nsHttpTransaction.cpp:1035
5  xul.dll  mozilla::net::nsHttpConnection::OnSocketReadable()  netwerk/protocol/http/nsHttpConnection.cpp:1997
5  xul.dll  mozilla::net::nsHttpConnection::OnInputStreamReady(nsIAsyncInputStream*)  netwerk/protocol/http/nsHttpConnection.cpp:2345
6  xul.dll  mozilla::net::nsSocketInputStream::OnSocketReady(nsresult)  netwerk/base/nsSocketTransport2.cpp:300
7  xul.dll  mozilla::net::nsSocketTransport::OnSocketReady(PRFileDesc*, short)  netwerk/base/nsSocketTransport2.cpp:2198

Comment 1

[Tyson Smith [:tsmith]]

This issue was triggered by visiting https://namemc.com/. A Pernosco session is available here: https://pernos.co/debug/LVaGegXWOue10HoEMAKOhA/index.html

Comment 2

[Kershaw Chang [:kershaw]]

Attachment: Bug 2048392 - Don't close transaction that is already dispatched to a connection, r=#necko

A transaction can stay in the pending queue while its owning HappyEyeballsConnectionAttempt is still racing. If another HappyEyeballsConnectionAttempt wins an H2 connection first, that transaction may be dispatched onto the winning H2 session, but the original HappyEyeballsConnectionAttempt is never told and continues racing.

If the original HappyEyeballsConnectionAttempt later fails, it still calls Close() on the transaction, even though the transaction is already live on the winning H2 session. That teardown causes a crash in nsHttpTransaction::ParseLineSegment.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox154 (nightly). However, the bug still has low severity.

:ghess, could you please increase the severity for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/19c74cec3c33
https://hg.mozilla.org/integration/autoland/rev/306cd0f173fc
Don't close transaction that is already dispatched to a connection, r=necko-reviewers,valentin

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/306cd0f173fc