Last Comment Bug 743587 - Intermittent Linux talos crash [@ nsHttpConnection::CloseTransaction]
: Intermittent Linux talos crash [@ nsHttpConnection::CloseTransaction]
Status: RESOLVED FIXED
: crash, intermittent-failure
Product: Core
Classification: Components
Component: Networking: HTTP (show other bugs)
: Trunk
: x86 Linux
: -- critical (vote)
: mozilla14
Assigned To: Patrick McManus [:mcmanus]
:
Mentors:
Depends on:
Blocks: 438871
  Show dependency treegraph
 
Reported: 2012-04-08 15:08 PDT by Phil Ringnalda (:philor)
Modified: 2012-11-25 19:31 PST (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch 0 (1.01 KB, patch)
2012-04-11 07:11 PDT, Patrick McManus [:mcmanus]
honzab.moz: review+
Details | Diff | Review

Description Phil Ringnalda (:philor) 2012-04-08 15:08:12 PDT
https://tbpl.mozilla.org/php/getParsedLog.php?id=10672438&tree=Fx-Team
Rev3 Fedora 12 fx-team talos dromaeo on 2012-04-05 11:50:14 PDT for push 5d654a428c97

Crash reason:  SIGSEGV
Crash address: 0x0

Thread 3 (crashed)
 0  libxul.so!nsHttpConnection::CloseTransaction [nsHttpConnection.cpp : 1136 + 0x9]
    eip = 0x011cd137   esp = 0xb55ff0c4   ebp = 0x00000000   ebx = 0x023f7d20
    esi = 0xaaf6b420   edi = 0x80004004   eax = 0x00000000   ecx = 0x00000000
    edx = 0x00000000   efl = 0x00010292
    Found by: given as instruction pointer in context
 1  libxul.so!nsHttpConnection::OnOutputStreamReady [nsHttpConnection.cpp : 1514 + 0xa]
    eip = 0x011ce3fa   esp = 0xb55ff0f0   ebp = 0x80004004   ebx = 0x023f7d20
    esi = 0xaaf6b420   edi = 0xab45def8
    Found by: call frame info
 2  libxul.so!nsSocketOutputStream::OnSocketReady [nsSocketTransport2.cpp : 525 + 0x8]
    eip = 0x01182b99   esp = 0xb55ff110   ebp = 0x80004004   ebx = 0x023f7d20
    esi = 0xab45df34   edi = 0xab45def8
    Found by: call frame info
 3  libxul.so!nsSocketTransport::OnSocketDetached [nsSocketTransport2.cpp : 1660 + 0x10]
    eip = 0x011854ed   esp = 0xb55ff150   ebp = 0x00000008   ebx = 0x023f7d20
    esi = 0xab45de30   edi = 0xb68be760
    Found by: call frame info
 4  libxul.so!nsSocketTransportService::DetachSocket [nsSocketTransportService2.cpp : 214 + 0xc]
    eip = 0x0118670e   esp = 0xb55ff180   ebp = 0x00000008   ebx = 0x023f7d20
    esi = 0xb56b7400   edi = 0xb68be760
    Found by: call frame info
 5  libxul.so!nsSocketTransportService::DoPollIteration [nsSocketTransportService2.cpp : 711 + 0x8]
    eip = 0x011868ce   esp = 0xb55ff1b0   ebp = 0x00000008   ebx = 0x023f7d20
    esi = 0xb68be760   edi = 0x00000000
    Found by: call frame info
 6  libxul.so!nsSocketTransportService::Run [nsSocketTransportService2.cpp : 645 + 0x12]
    eip = 0x01186f7d   esp = 0xb55ff210   ebp = 0xb55ff23f   ebx = 0x023f7d20
    esi = 0xb68be760   edi = 0xb68be820
    Found by: call frame info
 7  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp : 656 + 0x5]
    eip = 0x01c36029   esp = 0xb55ff260   ebp = 0xb55ff31c   ebx = 0x023f7d20
    esi = 0xb68be820   edi = 0x00000000
    Found by: call frame info

https://tbpl.mozilla.org/php/getParsedLog.php?id=10726905&tree=Mozilla-Inbound
Rev3 Fedora 12x64 mozilla-inbound pgo talos dirty on 2012-04-07 07:13:54 PDT for push d5589821fc04

Crash reason:  SIGSEGV
Crash address: 0x0

Thread 3 (crashed)
 0  libxul.so!nsHttpConnection::CloseTransaction [nsHttpConnection.cpp:d5589821fc04 : 1136 + 0x6]
    rbx = 0x000c1020   r12 = 0x80004004   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15c2e185   rsp = 0x0bbfec30   rbp = 0x00000000
 1  libxul.so!nsHttpConnection::OnOutputStreamReady [nsHttpConnection.cpp:d5589821fc04 : 1514 + 0xd]
    rbx = 0x000c1020   r12 = 0x0be228e0   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15c2ed13   rsp = 0x0bbfec50   rbp = 0x17649088
 2  libxul.so!nsSocketOutputStream::OnSocketReady [nsSocketTransport2.cpp:d5589821fc04 : 525 + 0x8]
    rbx = 0x0be22940   r12 = 0x0be228e0   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15be3154   rsp = 0x0bbfec60   rbp = 0x17649088
 3  libxul.so!nsSocketTransport::OnSocketDetached [nsSocketTransport2.cpp:d5589821fc04 : 1660 + 0xe]
    rbx = 0x0be227e0   r12 = 0x0be11000   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15be59c8   rsp = 0x0bbfec90   rbp = 0x0be11000
 4  libxul.so!nsSocketTransportService::DetachSocket [nsSocketTransportService2.cpp:d5589821fc04 : 214 + 0xe]
    rbx = 0x0be02b60   r12 = 0x0be11000   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15be6e01   rsp = 0x0bbfece0   rbp = 0x0be11000
 5  libxul.so!nsSocketTransportService::DoPollIteration [nsSocketTransportService2.cpp:d5589821fc04 : 711 + 0x7]
    rbx = 0x0be02b60   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15be7174   rsp = 0x0bbfed20   rbp = 0x00000010
 6  libxul.so!nsSocketTransportService::Run [nsSocketTransportService2.cpp:d5589821fc04 : 645 + 0x13]
    rbx = 0x1901f560   r12 = 0x0bbfed7f   r13 = 0x0be02ba8   r14 = 0x178628b0
    r15 = 0x00000003   rip = 0x15be755b   rsp = 0x0bbfed70   rbp = 0x0be02b60
 7  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:d5589821fc04 : 656 + 0x7]
    rbx = 0x1901f560   r12 = 0x17641578   r13 = 0x0bbfee4f   r14 = 0x00000000
    r15 = 0x00000003   rip = 0x16728270   rsp = 0x0bbfedb0   rbp = 0x0bbfede0
Comment 2 Honza Bambas (:mayhemer) 2012-04-11 04:38:27 PDT
Looks like mTransation was null: http://hg.mozilla.org/mozilla-central/annotate/5d654a428c97/netwerk/protocol/http/nsHttpConnection.cpp#l1136
Comment 3 Patrick McManus [:mcmanus] 2012-04-11 07:11:27 PDT
Created attachment 613983 [details] [diff] [review]
patch 0

I don't see any reason CloseTransaction() couldn't get called from OnInputStreamReady (perhaps with EOF or just framing complete) and then again from OnOutputstreamReady as a forced detach on shutdown (as seen in the stack) before things were fully torn down.. just checking mTransaction for null appears sufficient to fix it.
Comment 5 Honza Bambas (:mayhemer) 2012-04-11 09:22:56 PDT
Comment on attachment 613983 [details] [diff] [review]
patch 0

Review of attachment 613983 [details] [diff] [review]:
-----------------------------------------------------------------

r=honzab
Comment 6 Patrick McManus [:mcmanus] 2012-04-11 10:20:33 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/d770f8c6e19b
Comment 7 :Ehsan Akhgari (busy, don't ask for review please) 2012-04-12 10:25:23 PDT
https://hg.mozilla.org/mozilla-central/rev/d770f8c6e19b

Note You need to log in before you can comment on or make changes to this bug.