739024 - crash in nsHttpPipeline::WriteSegments

Status: RESOLVED DUPLICATE of bug 741056

(Core :: Networking: HTTP, defect)

Description

[Scoobidiver (away)]

It first appeared in 14.0a1/20120324 and is currently #3 top crasher in 14.0a1 over the last day with combined signatures.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ab2ff3b5611f&tochange=df1f94b2bdee

Signature 	memmove | nsTArray_base<nsTArrayDefaultAllocator>::ShiftData(unsigned int, unsigned int, unsigned int, unsigned int, unsigned int) | nsHttpPipeline::WriteSegments(nsAHttpSegmentWriter*, unsigned int, unsigned int*) More Reports Search
UUID	3aab0a94-ca07-4cff-b8eb-f52642120325
Date Processed	2012-03-25 05:34:25
Uptime	9
Last Crash	2.4 minutes before submission
Install Age	5.9 minutes since version was first installed.
Install Time	2012-03-25 05:36:08
Product	Firefox
Version	14.0a1
Build ID	20120324031100
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address	0x6a789000
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x2e32, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.15.10.1749
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True	
Total Virtual Memory	4294836224
Available Virtual Memory	4038377472
System Memory Use Percentage	48
Available Page File	6237286400
Available Physical Memory	2182045696

Frame 	Module 	Signature [Expand] 	Source
0 	msvcr100.dll 	memmove 	f:\\dd\\vctools\\crt_bld\\SELF_X86\\crt\\src\\Intel\\MEMCPY.ASM:185
1 	xul.dll 	nsTArray_base<nsTArrayDefaultAllocator>::ShiftData 	obj-firefox/dist/include/nsTArray-inl.h:277
2 	xul.dll 	nsHttpPipeline::WriteSegments 	netwerk/protocol/http/nsHttpPipeline.cpp:768
3 	xul.dll 	nsHttpConnection::OnSocketReadable 	netwerk/protocol/http/nsHttpConnection.cpp:1368
4 	xul.dll 	nsHttpConnection::OnInputStreamReady 	netwerk/protocol/http/nsHttpConnection.cpp:1488
5 	xul.dll 	nsSocketInputStream::OnSocketReady 	netwerk/base/src/nsSocketTransport2.cpp:256
6 	xul.dll 	nsSocketTransport::OnSocketReady 	netwerk/base/src/nsSocketTransport2.cpp:1575
7 	xul.dll 	nsSocketTransportService::DoPollIteration 	netwerk/base/src/nsSocketTransportService2.cpp:762
8 	xul.dll 	nsSocketTransportService::Run 	netwerk/base/src/nsSocketTransportService2.cpp:645
9 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:657
10 	xul.dll 	nsThread::ThreadFunc 	xpcom/threads/nsThread.cpp:289
11 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
12 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
13 	msvcr100.dll 	_callthreadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c:314
14 	msvcr100.dll 	_threadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c:292
15 	kernel32.dll 	BaseThreadInitThunk 	
16 	ntdll.dll 	__RtlUserThreadStart 	
17 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=memmove+|+nsTArray_base%3CnsTArrayDefaultAllocator%3E%3A%3AShiftData%28unsigned+int%2C+unsigned+int%2C+unsigned+int%2C+unsigned+int%2C+unsigned+int%29+|+nsHttpPipeline%3A%3AWriteSegments%28nsAHttpSegmentWriter*%2C+unsigned+int%2C+unsigned+int*%29
https://crash-stats.mozilla.com/report/list?signature=memcpy+|+nsHttpPipeline%3A%3AWriteSegments%28nsAHttpSegmentWriter*%2C+unsigned+int%2C+unsigned+int*%29

Comment 1

[Josh Aas]

Patrick - a regression from your recent pipelining patches?

Comment 2

[Patrick McManus [:mcmanus]]

I just wanted to note in the bug that this is at the top of my coding list, I'm just out of the office this week and it is not clear if I'll have time to tackle it until next monday.

Comment 3

[Andrea Guglielmi]

It seems that my latest submitted crashes:
bp-1fdb3279-026f-4556-a031-d0a612120326
bp-5c8d969c-faf5-4e2f-8f52-51e8e2120326
bp-43fafad5-6449-4112-a626-709322120326
are related to this bug. 
We are talking about it on the MozillaZine forum and it looks like it could be "proxy" related as all people experiencing crashes wrote they're using a proxy server.
Just to let you know...

Comment 4

[Patrick McManus [:mcmanus]]

good info, thanks. HTTP or HTTPs?

Comment 5

[martin.herok]

It crashes on both.

Comment 7

[Robert Kaiser]

This crash is #2 and #3 on trunk right now, bug 739023 which is #4 sounds like it could be related (also HTTP networking).

Comment 9

[alex_mayorga]

FWIW Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:14.0) Gecko/20120329 Firefox/14.0a1 ID:20120329031156 crashes on click with this URL https://support.xobni.com/entries/20151838

bp-417dc8c5-3ef9-401f-83d3-701c02120329
bp-96bfabbc-e0a4-4ffa-b06a-89a192120329

The site seems to implement SPDY[1].

[1] http://forums.mozillazine.org/viewtopic.php?p=11864363#p11864363

Comment 10

[Patrick McManus [:mcmanus]]

doesn't crash for me with one click :(

The crash isn't spdy centric - though spdy/pipeline code interaction is certainly possible. Thanks for the URL - next monday I will really try it in detail. 

I don't think xobni is actually running spdy - I think its using google analytics as subresource over spdy and the community add on is a little misleading about that.

Comment 11

[alex_mayorga]

Do more crashes help?

This one is from another random page bp-864c6483-dedf-4e9e-ad40-fb7dd2120330

Comment 12

[Patrick McManus [:mcmanus]]

(In reply to alex_mayorga from comment #11)
> Do more crashes help?
> 
> This one is from another random page bp-864c6483-dedf-4e9e-ad40-fb7dd2120330

More data is always good - I just haven't thoroughly been through what is here because I've been away from my desk all week. Next week will be much better and the more info in the bug when that time arrives the better.  Thanks for the help!

Comment 13

[Scoobidiver (away)]

Based on bug 740168 comment 5, it's caused by bug 447866.

Comment 14

[Patrick McManus [:mcmanus]]

see comment 14 in bug 741056 for the same stack. This is indeed proxy related.