743587 - Intermittent Linux talos crash [@ nsHttpConnection::CloseTransaction]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=10672438&tree=Fx-Team
Rev3 Fedora 12 fx-team talos dromaeo on 2012-04-05 11:50:14 PDT for push 5d654a428c97

Crash reason:  SIGSEGV
Crash address: 0x0

Thread 3 (crashed)
 0  libxul.so!nsHttpConnection::CloseTransaction [nsHttpConnection.cpp : 1136 + 0x9]
    eip = 0x011cd137   esp = 0xb55ff0c4   ebp = 0x00000000   ebx = 0x023f7d20
    esi = 0xaaf6b420   edi = 0x80004004   eax = 0x00000000   ecx = 0x00000000
    edx = 0x00000000   efl = 0x00010292
    Found by: given as instruction pointer in context
 1  libxul.so!nsHttpConnection::OnOutputStreamReady [nsHttpConnection.cpp : 1514 + 0xa]
    eip = 0x011ce3fa   esp = 0xb55ff0f0   ebp = 0x80004004   ebx = 0x023f7d20
    esi = 0xaaf6b420   edi = 0xab45def8
    Found by: call frame info
 2  libxul.so!nsSocketOutputStream::OnSocketReady [nsSocketTransport2.cpp : 525 + 0x8]
    eip = 0x01182b99   esp = 0xb55ff110   ebp = 0x80004004   ebx = 0x023f7d20
    esi = 0xab45df34   edi = 0xab45def8
    Found by: call frame info
 3  libxul.so!nsSocketTransport::OnSocketDetached [nsSocketTransport2.cpp : 1660 + 0x10]
    eip = 0x011854ed   esp = 0xb55ff150   ebp = 0x00000008   ebx = 0x023f7d20
    esi = 0xab45de30   edi = 0xb68be760
    Found by: call frame info
 4  libxul.so!nsSocketTransportService::DetachSocket [nsSocketTransportService2.cpp : 214 + 0xc]
    eip = 0x0118670e   esp = 0xb55ff180   ebp = 0x00000008   ebx = 0x023f7d20
    esi = 0xb56b7400   edi = 0xb68be760
    Found by: call frame info
 5  libxul.so!nsSocketTransportService::DoPollIteration [nsSocketTransportService2.cpp : 711 + 0x8]
    eip = 0x011868ce   esp = 0xb55ff1b0   ebp = 0x00000008   ebx = 0x023f7d20
    esi = 0xb68be760   edi = 0x00000000
    Found by: call frame info
 6  libxul.so!nsSocketTransportService::Run [nsSocketTransportService2.cpp : 645 + 0x12]
    eip = 0x01186f7d   esp = 0xb55ff210   ebp = 0xb55ff23f   ebx = 0x023f7d20
    esi = 0xb68be760   edi = 0xb68be820
    Found by: call frame info
 7  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp : 656 + 0x5]
    eip = 0x01c36029   esp = 0xb55ff260   ebp = 0xb55ff31c   ebx = 0x023f7d20
    esi = 0xb68be820   edi = 0x00000000
    Found by: call frame info

https://tbpl.mozilla.org/php/getParsedLog.php?id=10726905&tree=Mozilla-Inbound
Rev3 Fedora 12x64 mozilla-inbound pgo talos dirty on 2012-04-07 07:13:54 PDT for push d5589821fc04

Crash reason:  SIGSEGV
Crash address: 0x0

Thread 3 (crashed)
 0  libxul.so!nsHttpConnection::CloseTransaction [nsHttpConnection.cpp:d5589821fc04 : 1136 + 0x6]
    rbx = 0x000c1020   r12 = 0x80004004   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15c2e185   rsp = 0x0bbfec30   rbp = 0x00000000
 1  libxul.so!nsHttpConnection::OnOutputStreamReady [nsHttpConnection.cpp:d5589821fc04 : 1514 + 0xd]
    rbx = 0x000c1020   r12 = 0x0be228e0   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15c2ed13   rsp = 0x0bbfec50   rbp = 0x17649088
 2  libxul.so!nsSocketOutputStream::OnSocketReady [nsSocketTransport2.cpp:d5589821fc04 : 525 + 0x8]
    rbx = 0x0be22940   r12 = 0x0be228e0   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15be3154   rsp = 0x0bbfec60   rbp = 0x17649088
 3  libxul.so!nsSocketTransport::OnSocketDetached [nsSocketTransport2.cpp:d5589821fc04 : 1660 + 0xe]
    rbx = 0x0be227e0   r12 = 0x0be11000   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15be59c8   rsp = 0x0bbfec90   rbp = 0x0be11000
 4  libxul.so!nsSocketTransportService::DetachSocket [nsSocketTransportService2.cpp:d5589821fc04 : 214 + 0xe]
    rbx = 0x0be02b60   r12 = 0x0be11000   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15be6e01   rsp = 0x0bbfece0   rbp = 0x0be11000
 5  libxul.so!nsSocketTransportService::DoPollIteration [nsSocketTransportService2.cpp:d5589821fc04 : 711 + 0x7]
    rbx = 0x0be02b60   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x00000000   rip = 0x15be7174   rsp = 0x0bbfed20   rbp = 0x00000010
 6  libxul.so!nsSocketTransportService::Run [nsSocketTransportService2.cpp:d5589821fc04 : 645 + 0x13]
    rbx = 0x1901f560   r12 = 0x0bbfed7f   r13 = 0x0be02ba8   r14 = 0x178628b0
    r15 = 0x00000003   rip = 0x15be755b   rsp = 0x0bbfed70   rbp = 0x0be02b60
 7  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:d5589821fc04 : 656 + 0x7]
    rbx = 0x1901f560   r12 = 0x17641578   r13 = 0x0bbfee4f   r14 = 0x00000000
    r15 = 0x00000003   rip = 0x16728270   rsp = 0x0bbfedb0   rbp = 0x0bbfede0

Comment 1

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=10776246&tree=Firefox

Comment 2

[Honza Bambas (:mayhemer)]

Looks like mTransation was null: http://hg.mozilla.org/mozilla-central/annotate/5d654a428c97/netwerk/protocol/http/nsHttpConnection.cpp#l1136

Comment 3

[Patrick McManus [:mcmanus]]

Attachment: patch 0

I don't see any reason CloseTransaction() couldn't get called from OnInputStreamReady (perhaps with EOF or just framing complete) and then again from OnOutputstreamReady as a forced detach on shutdown (as seen in the stack) before things were fully torn down.. just checking mTransaction for null appears sufficient to fix it.

Comment 4

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=10811448&tree=Mozilla-Inbound

Comment 5

[Honza Bambas (:mayhemer)]

Comment on attachment 613983 [details] [diff] [review]
patch 0

Review of attachment 613983 [details] [diff] [review]:
-----------------------------------------------------------------

r=honzab

Comment 6

[Patrick McManus [:mcmanus]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d770f8c6e19b

Comment 7

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/d770f8c6e19b