crash in nsLoadGroup::TelemetryReportChannel

RESOLVED FIXED in Firefox 24

Status

()

Core
Networking
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Scoobidiver (away), Assigned: sworkman)

Tracking

({crash, regression, topcrash})

24 Branch
mozilla24
All
Windows 7
crash, regression, topcrash
Points:
---

Firefox Tracking Flags

(firefox23 unaffected, firefox24+ verified)

Details

(crash signature)

(Reporter)

Description

5 years ago
It's related to bug 883541.
It first showed up in 24.0a1/201306015. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b197bed90a98&tochange=3d16d59c9317
It's likely a regression from bug 497003.

Signature 	mozilla::net::nsHttpChannel::GetDomainLookupStart(mozilla::TimeStamp*) More Reports Search
UUID	c76f0b84-36b8-4150-84c9-374852130616
Date Processed	2013-06-16 06:45:54
Uptime	436
Last Crash	2.3 weeks before submission
Install Age	32.0 minutes since version was first installed.
Install Time	2013-06-16 06:13:44
Product	Firefox
Version	24.0a1
Build ID	20130615031212
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x18
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x689e, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.12.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor03_phx1_mozilla_com_1914:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x689e
Total Virtual Memory	2621308928
Available Virtual Memory	1819811840
System Memory Use Percentage	54
Available Page File	4677222400
Available Physical Memory	1573380096

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::net::nsHttpChannel::GetDomainLookupStart 	netwerk/protocol/http/nsHttpChannel.cpp:4659
1 	xul.dll 	nsLoadGroup::TelemetryReportChannel 	netwerk/base/src/nsLoadGroup.cpp:909
2 	xul.dll 	nsLoadGroup::TelemetryReport 	netwerk/base/src/nsLoadGroup.cpp:874
3 	xul.dll 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:663
4 	xul.dll 	nsLoadGroup::Cancel 	netwerk/base/src/nsLoadGroup.cpp:286
5 	xul.dll 	nsDocLoader::Stop 	uriloader/base/nsDocLoader.cpp:268
6 	xul.dll 	nsDocShell::Stop 	docshell/base/nsDocShell.cpp:4662
7 	xul.dll 	nsDocShell::InternalLoad 	docshell/base/nsDocShell.cpp:9209
8 	xul.dll 	nsDocShell::LoadURI 	docshell/base/nsDocShell.cpp:1520
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3AnsHttpChannel%3A%3AGetDomainLookupStart%28mozilla%3A%3ATimeStamp*%29
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3AnsHttpChannel%3A%3AGetDomainLookupEnd%28mozilla%3A%3ATimeStamp*%29
(Reporter)

Updated

5 years ago
Crash Signature: [@ mozilla::net::nsHttpChannel::GetDomainLookupStart(mozilla::TimeStamp*)] [@ mozilla::net::nsHttpChannel::GetDomainLookupEnd(mozilla::TimeStamp*)] → [@ mozilla::net::nsHttpChannel::GetDomainLookupStart(mozilla::TimeStamp*) ] [@ mozilla::net::nsHttpChannel::GetDomainLookupEnd(mozilla::TimeStamp*) ]

Comment 1

5 years ago
I'm baffled as to why this appears to be a null dereference crash, since all callers of TelementryReportChannel do null checks, and GetDomainLookupStart null checks any potential failure points. I would be surprised if bug 497003 caused this, too.

Comment 2

5 years ago
Oh wait, OnStopRequest can be called off the main thread and it nulls out mTransaction and mDNSPrefetch, both of which are checked in GetDomainLookupStart.
(Reporter)

Comment 3

5 years ago
(In reply to Josh Matthews [:jdm] from comment #1)
> I would be surprised if bug 497003 caused this, too.
It has a stack trace similar to bug 882913/bug 883541 and Ryan found it was caused by bug 497003 (see bug 882913 comment 20)

Updated

5 years ago
tracking-firefox24: ? → +
Passing this to Steve as bug 497003  is the suspected bug here that caused this regression.
Assignee: nobody → sworkman
(Assignee)

Comment 5

5 years ago
RyanVM backed the offending patches out:

https://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=d78e02224026

I'll close this once the failures disappear.
Status: NEW → ASSIGNED
(Assignee)

Comment 6

5 years ago
Inbound looks ok now - closing this bug.
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Comment 7

5 years ago
Fixed by the backout of bug 497003.
status-firefox24: affected → fixed
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.