46267 - Crashes at [@nsFileTransport::Process]

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[Shiva Thirumazhusai]

Reported by Talkback System.

Stack Trace: 
nsFileTransport::Process
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsFileTransport.cpp
nsFileTransport::Run
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsFileTransport.cpp
nsThreadPoolRunnable::Run
[d:\builds\seamonkey\mozilla\xpcom\threads\nsThread.cpp
nsThread::Main  [d:\builds\seamonkey\mozilla\xpcom\threads\nsThread.cpp
_PR_NativeRunThread     [pruthr.c
MSVCRT.DLL + 0x248d (0x7800248d)
KERNEL32.DLL + 0x12ca8 (0x77e92ca8)

    nsFileTransport::Process 85ba8c88
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071609 CrashDate: 2000-07-16 UptimeMinutes: 195  Total: 215 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14283425

    nsFileTransport::Process 029656bf
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071621 CrashDate: 2000-07-17 UptimeMinutes: 46  Total: 46 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14307700

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071621 CrashDate: 2000-07-17 UptimeMinutes: 2  Total: 2 
        OS: Windows 98  4.10 build 67766446
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14325966

    nsFileTransport::Process 029656bf
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071709 CrashDate: 2000-07-17 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14340455

    nsFileTransport::Process 1d22c520
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071709 CrashDate: 2000-07-17 UptimeMinutes: 1  Total: 1 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14341165

    nsFileTransport::Process 25a0ba11
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071621 CrashDate: 2000-07-18 UptimeMinutes: 0  Total: 2 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14369913

    nsFileTransport::Process 1d22c520
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071621 CrashDate: 2000-07-18 UptimeMinutes: 45  Total: 47 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14372764

    nsFileTransport::Process 029656bf
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071721 CrashDate: 2000-07-18 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: I just double clicked on the Mozilla icon.
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14379036

    nsFileTransport::Process 1d22c520
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071621 CrashDate: 2000-07-18 UptimeMinutes: 6  Total: 242 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14399782

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071709 CrashDate: 2000-07-18 UptimeMinutes: 110  Total: 370 
        OS: Windows 98  4.10 build 67766222
        URL: 
        Comment: failed while the app was quiescent (left running
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14404712

    nsFileTransport::Process 85ba8c88
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071621 CrashDate: 2000-07-18 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14400015

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071721 CrashDate: 2000-07-18 UptimeMinutes: 47  Total: 79 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14407698

    nsFileTransport::Process 029656bf
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071721 CrashDate: 2000-07-18 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14413046

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071811 CrashDate: 2000-07-18 UptimeMinutes: 4  Total: 4 
        OS: Windows 98  4.10 build 67766222
        URL: don't remember
        Comment: I was opening up a page in the Debug menu of Mozilla 5.
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14428814

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071811 CrashDate: 2000-07-19 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14438695

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071721 CrashDate: 2000-07-19 UptimeMinutes: 1125  Total: 1125 
        OS: Windows 98  4.10 build 67766222
        URL: www.freshmeat.net
        Comment: Open link in new window (rt. click on link and select open link 
in
now window)
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14453539

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071811 CrashDate: 2000-07-19 UptimeMinutes: 9  Total: 9 
        OS: Windows 98  4.10 build 67766222
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14455715

    nsFileTransport::Process 85ba8c88
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071609 CrashDate: 2000-07-19 UptimeMinutes: 15  Total: 231 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14472566

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071811 CrashDate: 2000-07-19 UptimeMinutes: 0  Total: 1070 
        OS: Windows 98  4.10 build 67766222
        URL: 
        Comment: launching Netscape 6
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14484738

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071911 CrashDate: 2000-07-19 UptimeMinutes: 337  Total: 337 
        OS: Windows 98  4.10 build 67766446
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14497682

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071811 CrashDate: 2000-07-20 UptimeMinutes: 74  Total: 74 
        OS: Windows 98  4.10 build 67766446
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14499778

    nsFileTransport::Process 1d22c520
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071621 CrashDate: 2000-07-20 UptimeMinutes: 30  Total: 76 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14505573

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071921 CrashDate: 2000-07-20 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: Startup crash
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14509668

    nsFileTransport::Process 029656bf
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000072009 CrashDate: 2000-07-20 UptimeMinutes: 0  Total: 4 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14530169

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071921 CrashDate: 2000-07-20 UptimeMinutes: 0  Total: 1 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: startup crash
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14546597

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000072021 CrashDate: 2000-07-21 UptimeMinutes: 5  Total: 5 
        OS: Windows 98  4.10 build 67766446
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14560667

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000072109 CrashDate: 2000-07-21 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14586753

    nsFileTransport::Process 1d22c520
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000072109 CrashDate: 2000-07-22 UptimeMinutes: 0  Total: 145 
        OS: Windows NT  5.0 build 2195
        URL: slashdot.org
        Comment: crashes on startup
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14613892

    nsFileTransport::Process 5b97409e
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000072109 CrashDate: 2000-07-22 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
        URL: startup
        Comment: Mozilla functional
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14617505

    nsFileTransport::Process 029656bf
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/base/src/nsFileTrans
port.cpp
line 502
        Build: 2000071921 CrashDate: 2000-07-24 UptimeMinutes: 9  Total: 9 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: download finished!
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14692395

Comment 1

[Shiva Thirumazhusai]

Adding crash, and topcrash keywords.

Comment 2

[Gagan]

this don't look too good. nominating and assigning. 

Comment 3

[ruslan]

Looks like it's same as 45358 (though it doesn't crash on debug builds).

Comment 4

[leger]

please resolve as dup or give more info - vishy

Comment 5

[Shiva Thirumazhusai]

Anybody tried in Windows 5.0. Most of the crash submitted seems to have come 
from Windows NT 5.0.

Comment 6

[Peter Trudelle]

nsbeta2-.  Can't hold for what we can't reproduce.  Should still be a high
priority for nsbeta3, and if a demonstrably safe fix comes in the next few days,
we will consider taking it for nsbeta2.

Comment 7

[chris hofmann]

Added relnote2.  wondering what pct. of win2000 (NT 5.0) will be
able to run the monkey in nsbeta2?

Comment 8

[Warren Harris]

This is not a release notable kind of thing. We need to fix it for beta2. I'll 
take a look on Monday.

Comment 9

[Alec Flett]

microsoft is releasing service pack 1 on monday. it might be worth seeing if 
that improves the situation

Comment 10

[chris hofmann]

jerry baker wrote in e-mail

My success rate is about 12%. That is for every 8 starts of Mozilla, I
get 7 crashes and one successful run.

I got myself SP1 for Win2k in the *extremely* unlikely hope that it
might help this. No such luck.

-- 
Jerry Baker

Comment 11

[Dan M]

  I see this problem fairly reliably on two Win2K machines. I tried this:

--- ./xpcom/io/nsPipe2.cpp.1.29	Mon Jul 31 12:00:51 2000+++ ./xpcom/io/
nsPipe2.cpp	Mon Jul 31 11:56:59 2000@@ -620,6 +620,7 @@                                           
PRUint32 *writeCount)
 {
     nsresult rv = NS_OK;
+    nsCOMPtr<nsIBufferOutputStream> kungFuDeathGrip(this);
     nsPipe* pipe = GET_OUTPUTSTREAM_PIPE(this);
     PRUint32 amt = count;
     {
@@ -648,6 +649,7 @@                     if (NS_FAILED(rv)) goto done;
                 }
                 rv = Flush();
+                if (mWriterRefCnt == 1) printf("******* whoa *********\n");
                 if (/*rv == NS_BASE_STREAM_WOULD_BLOCK || */NS_FAILED(rv))
                     goto done;
                 // else we flushed, so go around again

that is, adding a deathgrip at the top of nsPipe::nsPipeOutputStream, and a 
printf should it turn out that the deathgrip was necessary.
  After applying this patch, I'm getting the printf about every other time I 
launch Mozilla, and it *seldom* crashes. Once, I saw a problem further up the 
stack. I think it was a reference to the deleted object after it had already 
safely exited the dangerous routine. But only once, and I wasn't paying 
attention.
  So. The above patch, minus the printf of course, nearly cures the crash. I'm 
still working on tracking down that other, more rare crash.

Comment 12

[cpratt]

Using the 2000073104 build on Windows 2000 (Build 2195: Service Pack 1), I can't 
get Mozilla to crash. Is there a specific thing that's supposed to crash the 
app? (I launched it, viewed a couple dozen pages, quit the app.)

Comment 13

[Dan M]

  (Addendum to my comment above and reply to Christopher: it seems this crash 
only happens under Win 2000. At least every instance I've heard of happened 
there. It also seems to be exacerbated by having recently switched skins -- I 
won't even attempt an explanation. That is, after switching from Modern to 
Classic or vice versa, the next several subsequent launches have a higher chance 
of showing the problem. It's very definitely timing related; probably the result 
of a race condition. Oh yes -- it also seems to happen only on fast, recent 
machines, like P III 500s and up.)
  I've tracked down that other crash I mentioned above. It happens in

nsFileTransport::Process(void) {
  switch(mXferState) {
    ...
    case END_READ :
      ...
      mBufferOutputStream->Flush()

because mBufferOutputStream is null. This crash is much more rare and *seems* to 
happen only after surviving the crash this bug report addresses, using my above 
patch. (The stack trace put nsFileTransport::Run as the caller, and then standard 
stuff calling that.)
  I don't understand this one. Just plugging through the code, it seems to imply 
that end END_READ state was executed twice. Ring any bells, anyone?
  Since nsFileTransport already holds an owning reference to its member variable 
mBufferOutputStream, another layer of deathgrip outside my suggested one in 
WriteSegments() seems inapplicable to this other crash. I suggest worrying about 
this other crash after going with the above patch to WriteSegments.

Comment 14

[Jay Patel [:jay]]

Putting on [nsbeta2+] radar for beta2 fix. 

Comment 15

[Warren Harris]

danm: See bug 45358.

Comment 16

[ruslan]

*** Bug 45358 has been marked as a duplicate of this bug. ***

Comment 17

[leger]

Updating ETA 7/31

Comment 18

[Dan M]

  I'm getting some resistance to checking in the above patch, which merely hides 
the real problem. The folks who own this code want to use that as a last resort 
if the real problem can't be found.
  So, we have a "fix" for the crash that can be pretty much safely checked in at 
any time, but Ruslan and Warren want to hold off for now.

Comment 19

[Warren Harris]

I didn't say I wanted to hold off. I said I wanted some data (a stacktrace) on 
who was releasing the pipe too early in the failure case...


Subject: 
             Re: that crash in nsPipe on startup
       Date: 
             Mon, 31 Jul 2000 17:16:58 -0700
       From: 
             [e-mail] (Daniel Matejka)
          To: 
             Warren Harris <[e-mail]>
         CC: 
             Ruslan Belkin <[e-mail]>, [e-mail]
 References: 
             1 , 2 , 3




Warren Harris wrote: 

  It seems that we have a refcounting problem here, but I don't know why 
holding another ref to the pipe's output stream (and
  consequently the pipe indirectly) is what's needed here. Have you been able 
to set a breakpoint in the pipe's destructor to see
  when it's being called in the failure case? That will point you to the real 
problem. 

  Who's got a w2k machine that we can reproduce this on? Dan?

fairly easily reproduced on mine. I just got back from meetings. I'll try that. 
More soon. 

Comment 20

[Dan M]

  I've tried watching nsPipe and nsPipeOutputStream destructors happen, but no 
joy. There's a bunch of 'em at startup, and I suspect that the breakpoints mess 
up whatever accident of timing makes the crash happen. I didn't get anywhere with 
that. Could try some more tomorrow, if you like.

Comment 21

[Jerry Baker]

Would a Dr. Watson log help here? I can't get this to happen in a debug build, 
but Dr. Watson logs contain stacktraces and symbols for every thread active at 
the time of the crash. I will attach part of the Dr. Watson log (the thread 
containing the fault) as an attachment.

Comment 22

[Jerry Baker]

Attachment: Portion of Dr. Watson log

Comment 23

[Jerry Baker]

I can also provide a full mem dump if anyone wants to step through that with a 
debugger.

Adding self to CC:

Comment 24

[leger]

Setting ETA to 8/01 to get temp fix in TODAY!  But need to get some testing on 
the fix.  gagan to post to mozilla for folks to give feedback.

Comment 25

[Dan M]

  I've checked in the deathgrip which prevents this crash without addressing the 
underlying cause, which remains mysterious. Checkin was on both the trunk and the 
M17 branch. The patch is marked with #ifdef MASK_PREMATURE_STREAM_RELEASE on the 
trunk version, in the expectation that it will be backed out once it's no longer 
necessary.
  There's still work to be done here, so I'm not closing the bug. But the crash 
should be averted now, and this problem off nsbeta2 radar.

Comment 26

[leger]

Putting on Resolved/Fixed to get tested on the branch.  Please open new bug for 
trunk work to be done.

Comment 27

[Warren Harris]

Filed bug 47263 to fix this for real.

Comment 28

[Tom Everingham]

verified
W2K 2000080304

Comment 29

[benc]

-relnote2, this is fixed and not in current relnotes.

Comment 30

[Jerry Baker]

Mass removing self from CC list.

Comment 31

[Jerry Baker]

Now I feel sumb because I have to add back. Sorry for the spam.