971893 - crash in mozilla::net::nsHttpConnectionMgr::OnMsgCancelTransaction(int, void*)

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect)

Description

[Brogan Zumwalt [Inactive]]

This bug was filed from the Socorro interface and is 
report bp-83eaeb34-2a72-45b8-8974-aae962140212.
=============================================================

crash in mozilla::net::nsHttpConnectionMgr::OnMsgCancelTransaction(int, void*)

Description:
Issue occurred while closing tab in browser app while receiving very large bluetooth file transfer (15+ minute .3gp file). Will investigate further, no solid STR at this time.

Environmental Variables:
Device: Buri v1.4 Master Mozilla RIL
BuildID: 20140212040203
Gaia: 4c6b5142d3b716f1c4ea502eeb92d3119f2b01c6
Gecko: 802d87c77e76
Version: 30.0a1
Firmware Version: V1.2-device.cfg

Comment 1

[Jason Smith [:jsmith]]

Leaving needinfo on you to see if you can get consistent STR

Comment 2

[Brogan Zumwalt [Inactive]]

Could not replicate to get good STR. Attempted following scenarios:

- Exact same state with closing crashed tab in browser w/o bluetooth transfer in background
- Same bluetooth transfer (.3gp, 15+ minute rt, 25+ MB size) w/o browser open
- Exact same state for browser described in bullet 1 while running bluetooth transfer described above in background

Monitoring logcat output during tests revealed multiple out of PMEM messages during all scenarios involving browser, but no crash was produced.

Comment 3

[J. Ryan Stinnett [:jryans] (Use needinfo, replies may be slow)]

Doesn't seem specific to B2G, as there are ~200 desktop reports as well.

Comment 4

[Robert Kaiser]

Yes, this is the top crash on Firefox Nightly in the last day.

Comment 5

[Patrick McManus [:mcmanus]]

thanks for the bug report.. regression from 970279.. ent needs to be checked for null

Comment 6

[Patrick McManus [:mcmanus]]

Attachment: crash in onMsgCancelTransaction

Comment 7

[Patrick McManus [:mcmanus]]

Comment on attachment 8375547 [details] [diff] [review]
crash in onMsgCancelTransaction

Review of attachment 8375547 [details] [diff] [review]:
-----------------------------------------------------------------

I'm not sure why bzexport assigns reviews to [e-mail] when I do -r :hurley

Comment 8

[Patrick McManus [:mcmanus]]

https://bugzilla.mozilla.org/show_bug.cgi?id=917893

Comment 9

[Patrick McManus [:mcmanus]]

(In reply to Patrick McManus [:mcmanus] from comment #8)
> https://bugzilla.mozilla.org/show_bug.cgi?id=917893

that was a brilliant comment :)

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/5dd0f145d79d

Comment 10

[Wayne Mery (:wsmwk)]

bp-a510b6ca-5e88-4e0d-b779-232242140213
I could not reproduce

Comment 11

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/5dd0f145d79d

Comment 12

[Benjamin Kerensa [:bkerensa]]

We are going to track this in case it comes up again

Comment 14

[Tracy Walker [:tracy]]

There are but 2 crashes on Nightly desktop with builds after the fix here was checked in on 20140213.  And one of those crashed has the poisoned memory location.