Closed Bug 883607 Opened 7 years ago Closed 7 years ago

crash in nsLoadGroup::TelemetryReportChannel

Categories

(Core :: Networking, defect, critical)

24 Branch
All
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla24
Tracking Status
firefox23 --- unaffected
firefox24 + verified

People

(Reporter: scoobidiver, Assigned: sworkman)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

It's related to bug 883541.
It first showed up in 24.0a1/201306015. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b197bed90a98&tochange=3d16d59c9317
It's likely a regression from bug 497003.

Signature 	mozilla::net::nsHttpChannel::GetDomainLookupStart(mozilla::TimeStamp*) More Reports Search
UUID	c76f0b84-36b8-4150-84c9-374852130616
Date Processed	2013-06-16 06:45:54
Uptime	436
Last Crash	2.3 weeks before submission
Install Age	32.0 minutes since version was first installed.
Install Time	2013-06-16 06:13:44
Product	Firefox
Version	24.0a1
Build ID	20130615031212
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x18
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x689e, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.12.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor03_phx1_mozilla_com_1914:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x689e
Total Virtual Memory	2621308928
Available Virtual Memory	1819811840
System Memory Use Percentage	54
Available Page File	4677222400
Available Physical Memory	1573380096

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::net::nsHttpChannel::GetDomainLookupStart 	netwerk/protocol/http/nsHttpChannel.cpp:4659
1 	xul.dll 	nsLoadGroup::TelemetryReportChannel 	netwerk/base/src/nsLoadGroup.cpp:909
2 	xul.dll 	nsLoadGroup::TelemetryReport 	netwerk/base/src/nsLoadGroup.cpp:874
3 	xul.dll 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:663
4 	xul.dll 	nsLoadGroup::Cancel 	netwerk/base/src/nsLoadGroup.cpp:286
5 	xul.dll 	nsDocLoader::Stop 	uriloader/base/nsDocLoader.cpp:268
6 	xul.dll 	nsDocShell::Stop 	docshell/base/nsDocShell.cpp:4662
7 	xul.dll 	nsDocShell::InternalLoad 	docshell/base/nsDocShell.cpp:9209
8 	xul.dll 	nsDocShell::LoadURI 	docshell/base/nsDocShell.cpp:1520
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3AnsHttpChannel%3A%3AGetDomainLookupStart%28mozilla%3A%3ATimeStamp*%29
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3AnsHttpChannel%3A%3AGetDomainLookupEnd%28mozilla%3A%3ATimeStamp*%29
Crash Signature: [@ mozilla::net::nsHttpChannel::GetDomainLookupStart(mozilla::TimeStamp*)] [@ mozilla::net::nsHttpChannel::GetDomainLookupEnd(mozilla::TimeStamp*)] → [@ mozilla::net::nsHttpChannel::GetDomainLookupStart(mozilla::TimeStamp*) ] [@ mozilla::net::nsHttpChannel::GetDomainLookupEnd(mozilla::TimeStamp*) ]
I'm baffled as to why this appears to be a null dereference crash, since all callers of TelementryReportChannel do null checks, and GetDomainLookupStart null checks any potential failure points. I would be surprised if bug 497003 caused this, too.
Oh wait, OnStopRequest can be called off the main thread and it nulls out mTransaction and mDNSPrefetch, both of which are checked in GetDomainLookupStart.
(In reply to Josh Matthews [:jdm] from comment #1)
> I would be surprised if bug 497003 caused this, too.
It has a stack trace similar to bug 882913/bug 883541 and Ryan found it was caused by bug 497003 (see bug 882913 comment 20)
Passing this to Steve as bug 497003  is the suspected bug here that caused this regression.
Assignee: nobody → sworkman
RyanVM backed the offending patches out:

https://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=d78e02224026

I'll close this once the failures disappear.
Status: NEW → ASSIGNED
Inbound looks ok now - closing this bug.
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Fixed by the backout of bug 497003.
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.