593842 - crash on send in nsSocketTransportService::OnDispatchedEvent

Status: RESOLVED INCOMPLETE

(Core :: Networking, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ send]
#93 crash for v3.1.2

typical stack...
bp-9f277eb8-0649-4f3e-bfea-2e2b82100816 v3.1.1
0	ws2_32.dll	send	
1	nspr4.dll	_PR_MD_SEND	nsprpub/pr/src/md/windows/w95sock.c:357
2	nspr4.dll	SocketSend	nsprpub/pr/src/io/prsocket.c:681
3	nspr4.dll	SocketWrite	nsprpub/pr/src/io/prsocket.c:701
4	nspr4.dll	PR_SetPollableEvent	nsprpub/pr/src/io/prpolevt.c:232
5	thunderbird.exe	nsSocketTransportService::OnDispatchedEvent	netwerk/base/src/nsSocketTransportService2.cpp:520
6	xpcom_core.dll	nsThread::PutEvent	xpcom/threads/nsThread.cpp:371
7	xpcom_core.dll	nsThread::Dispatch	xpcom/threads/nsThread.cpp:409
8	thunderbird.exe	nsSocketTransportService::Dispatch	netwerk/base/src/nsSocketTransportService2.cpp:122
9	xpcom_core.dll	nsAStreamCopier::PostContinuationEvent_Locked	xpcom/io/nsStreamUtils.cpp:471
10	xpcom_core.dll	nsAStreamCopier::PostContinuationEvent	xpcom/io/nsStreamUtils.cpp:462
11	xpcom_core.dll	nsAStreamCopier::OnInputStreamReady	xpcom/io/nsStreamUtils.cpp:426
12	thunderbird.exe	nsSocketInputStream::OnSocketReady	netwerk/base/src/nsSocketTransport2.cpp:256
13	thunderbird.exe	nsSocketTransport::OnSocketReady	netwerk/base/src/nsSocketTransport2.cpp:1519
14	thunderbird.exe	nsSocketTransportService::DoPollIteration	netwerk/base/src/nsSocketTransportService2.cpp:686
15	thunderbird.exe	nsSocketTransportService::OnProcessNextEvent	netwerk/base/src/nsSocketTransportService2.cpp:535 


bp-a486f495-93bd-4e06-8887-5df8b2100902 (howardrudd)

Comment 1

[Wayne Mery (:wsmwk)]

all ms-windows afaict, but not just one flavor.


bp-7be3cb3a-ed3e-4627-90c3-eefc92100902 FF 4.0
0	ws2_32.dll	send	
1	nspr4.dll	_PR_MD_SEND	nsprpub/pr/src/md/windows/w95sock.c:357
2	nspr4.dll	SocketSend	nsprpub/pr/src/io/prsocket.c:681
3	nspr4.dll	SocketWrite	nsprpub/pr/src/io/prsocket.c:701
4	nspr4.dll	PR_SetPollableEvent	nsprpub/pr/src/io/prpolevt.c:232
5	xul.dll	nsSocketTransportService::OnDispatchedEvent	netwerk/base/src/nsSocketTransportService2.cpp:528
6	xul.dll	nsThread::Dispatch	xpcom/threads/nsThread.cpp:418
7	xul.dll	nsSocketTransportService::Dispatch	netwerk/base/src/nsSocketTransportService2.cpp:124
8	xul.dll	nsHttpConnectionMgr::PostEvent	netwerk/protocol/http/nsHttpConnectionMgr.cpp:175
9	xul.dll	nsHttpConnectionMgr::AddTransaction	netwerk/protocol/http/nsHttpConnectionMgr.cpp:188
10	xul.dll	nsHttpChannel::Connect	netwerk/protocol/http/nsHttpChannel.cpp:319

Comment 2

[Wan-Teh Chang]

This kind of crash is usually a bug in the upper
layer nsSocketTransportService.  It can also be
caused by a bug in some Winsock Layered Socket
Provider (LSP) installed on the computer.

Comment 3

[Scoobidiver (away)]

It is #57 top crasher in 4.0b8pre for the last week.
In 4.0b8pre, it happens mainly with vksaver.dll 2.2.2.0 loaded: 98% of every crashes vs 2% for others crashes.

Here is a typical crashing thread:
Frame 	Module 	Signature [Expand] 	Source
0 	ws2_32.dll 	send 	
1 	vksaver.dll 	vksaver.dll@0x5d4a 	
2 	nspr4.dll 	_PR_MD_SEND 	nsprpub/pr/src/md/windows/w95sock.c:357
3 	nspr4.dll 	SocketSend 	nsprpub/pr/src/io/prsocket.c:681
4 	nspr4.dll 	SocketWrite 	nsprpub/pr/src/io/prsocket.c:701
5 	nspr4.dll 	PR_SetPollableEvent 	nsprpub/pr/src/io/prpolevt.c:232
6 	xul.dll 	nsSocketTransportService::OnDispatchedEvent 	netwerk/base/src/nsSocketTransportService2.cpp:528
7 	xul.dll 	nsThread::Dispatch 	xpcom/threads/nsThread.cpp:433
8 	xul.dll 	nsSocketTransportService::Dispatch 	netwerk/base/src/nsSocketTransportService2.cpp:124
9 	xul.dll 	nsHttpConnectionMgr::PostEvent 	netwerk/protocol/http/nsHttpConnectionMgr.cpp:181
10 	xul.dll 	nsHttpConnectionMgr::AddTransaction 	netwerk/protocol/http/nsHttpConnectionMgr.cpp:249
11 	xul.dll 	nsHttpChannel::Connect 	netwerk/protocol/http/nsHttpChannel.cpp:321
12 	xul.dll 	nsHttpChannel::OnNormalCacheEntryAvailable 	netwerk/protocol/http/nsHttpChannel.cpp:2229
13 	xul.dll 	nsHttpChannel::OnCacheEntryAvailable 	netwerk/protocol/http/nsHttpChannel.cpp:4400
14 	xul.dll 	nsCacheListenerEvent::Run 	netwerk/cache/nsCacheService.cpp:1441
15 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:626

Comment 4

[Wayne Mery (:wsmwk)]

Scoobidiver, the thunderbird crash doesn't correlate to vksave. In fact, it has no correlations at all. except all windows, all versions.
 http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&date=2010-11-26%2004%3A00%3A00&signature=send&version=Thunderbird%3A3.1.6

please file a new bug for firefox, and see Bug 540692

Comment 5

[Wayne Mery (:wsmwk)]

timeless, does the thunderbird crash correlate to ksaver even though it's not on the stack?  I feel like I'm miss something.

(Scoobidiver filed bug 614966 for firefox)

Comment 6

[timeless]

sorry, i skipped comment 2.

generally speaking lsp's are usually to blame for such faults.

at this point i'm making the foolish assumption that people wouldn't file a bug about crashing in @send if they didn't see something *different* from general LSP injected crashes :)

Comment 7

[Wayne Mery (:wsmwk)]

(In reply to comment #6)
> sorry, i skipped comment 2.
> 
> generally speaking lsp's are usually to blame for such faults.
> 
> at this point i'm making the foolish assumption that people wouldn't file a bug
> about crashing in @send if they didn't see something *different* from general
> LSP injected crashes :)

I wouldn't call it foolish :)  Actually, when I filed this I checked past bugs and I wasn't certain the issue is mozilla.  I filed this to be safe.

Comment 9

[Wayne Mery (:wsmwk)]

same crash ?
_PR_MD_SEND | SocketSend | SocketWrite | PR_SetPollableEvent | nsSocketTransportService::OnDispatchedEvent(nsIThreadInternal*) 
bp-688727bd-6b4e-4421-bdc2-0bd9b2120407

Comment 10

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #9)
> same crash ?
> _PR_MD_SEND | SocketSend | SocketWrite | PR_SetPollableEvent |
> nsSocketTransportService::OnDispatchedEvent(nsIThreadInternal*) 
> bp-688727bd-6b4e-4421-bdc2-0bd9b2120407

bp-f6beca89-6971-4013-870f-3f8172120403 (info) is another and he's a frequent crasher

Comment 11

[Wayne Mery (:wsmwk)]

after version 3.1.x, signature has changed to send | SocketSend | SocketWrite | PR_SetPollableEvent | nsSocketTransportService::OnDispatchedEvent(nsIThreadInternal*)

Comment 12

[Wayne Mery (:wsmwk)]

There are still thunderbird crashes for current versions, but I have no testcases nor users complaining.  So not reopening