690425 - HttpChannelChild incorrectly attempts to delete actor when kept alive connection dies

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Josh Matthews [:jdm]]

Attachment: Stack trace demonstrating the problem

Easy way to reproduce:
1. build fennec
2. visit http://ted.mielczarek.org/mozilla/crashme.html, install the addon linked there
3. restart once the addon has installed
4. observe crash in content process

Comment 1

[Josh Matthews [:jdm]]

Darn, I forgot to keep in mind that actors can die inadvertently when reviewing the changes in bug 588256. We should get rid of the mIPCOpen assertion in HttpChannelChild::Release and add mIPCOpen as a condition for the whole if branch instead.

Comment 2

[Josh Matthews [:jdm]]

Specifically, here: http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/HttpChannelChild.cpp#97

Comment 3

[Honza Bambas (:mayhemer)]

Hmm, from the first look it seems that the parent is not giving the child channel information it is gone, right?  I though this never could happen.  (But maybe I'm out now).

Comment 4

[Josh Matthews [:jdm]]

The problem is that if a channel is kept alive in OnStopRequest, we just assume that we should send an IPDL message to delete the actor in Release. However, if we're releasing because the IPDL actor has been destroyed, we should not do this.

Comment 5

[Justin Lebar (not reading bugmail)]

Should we delete this if |mKeptAlive && mRefCnt == 1 && !mIPCOpen|, or should we just return mRefCnt?

Comment 6

[Josh Matthews [:jdm]]

If the refcount is 1 and mIPCOpen is false, that means that somebody is holding a reference to the channel. Deleting at this point would be bad.

Comment 7

[Justin Lebar (not reading bugmail)]

Attachment: Patch v1

Comment 8

[Jason Duell]

Comment on attachment 595534 [details] [diff] [review]
Patch v1

Review of attachment 595534 [details] [diff] [review]:
-----------------------------------------------------------------

Yup, looks good.  Thanks!

Comment 9

[Jason Duell]

Landed: cd44c3d677ef

Comment 10

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/cd44c3d677ef