Last Comment Bug 712021 - spdy: crash on cancel of queued session
: spdy: crash on cancel of queued session
: crash
Product: Core
Classification: Components
Component: Networking: HTTP (show other bugs)
: 11 Branch
: x86_64 Linux
-- critical (vote)
: mozilla11
Assigned To: Patrick McManus [:mcmanus]
: Patrick McManus [:mcmanus]
Depends on:
  Show dependency treegraph
Reported: 2011-12-19 09:06 PST by Patrick McManus [:mcmanus]
Modified: 2011-12-20 05:54 PST (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch v0 (1.33 KB, patch)
2011-12-19 09:29 PST, Patrick McManus [:mcmanus]
honzab.moz: review+
Details | Diff | Splinter Review

Description User image Patrick McManus [:mcmanus] 2011-12-19 09:06:57 PST
Before the uplift of 11 to aurora I checked on socorro looking for any unknown spdy issues. I found just 2 reports which I believe are dups of each other:

In each case the stream is crashing when being activated out of the pending queue. I believe that the stream had actually been canceled and freed prior to activation. (i.e. it got queued due to an extreme level of parallelization (>100) and was cancelled in that state probably because the user navigated off the page).

0 	mozilla::net::SpdyStream::ReadSegments 	netwerk/protocol/http/SpdyStream.cpp:124
1 	mozilla::net::SpdySession::ReadSegments 	netwerk/protocol/http/SpdySession.cpp:1223
2 	mozilla::net::SpdySession::ActivateStream 	netwerk/protocol/http/SpdySession.cpp:283
3 	mozilla::net::SpdySession::ProcessPending 	netwerk/protocol/http/SpdySession.cpp:295
Comment 1 User image Patrick McManus [:mcmanus] 2011-12-19 09:29:02 PST
Created attachment 582856 [details] [diff] [review]
patch v0

This touches only SpdySession.cpp

I can reproduce this and confirm the fix by loading a page with thousands of icons off (commments on a celeb posting for example) and immediately closing the windows.
Comment 2 User image Honza Bambas (:mayhemer) 2011-12-19 12:52:41 PST
Comment on attachment 582856 [details] [diff] [review]
patch v0

Review of attachment 582856 [details] [diff] [review]:

r=honzab, full review this time (for spdy.enabled = true as well)

void pointers are bitches...
Comment 3 User image Patrick McManus [:mcmanus] 2011-12-19 13:43:06 PST

thanks honza
Comment 4 User image Ed Morley [:emorley] 2011-12-20 05:54:14 PST

Note You need to log in before you can comment on or make changes to this bug.