200365 - Trunk M140A topcrash [@ nsUnknownDecoder::SniffForImageMimeType]

Status: VERIFIED FIXED

(Core :: Networking, defect, P1)

Description

[Jan Carpenter]

This stack signature is a topcrash on M130

16   nsUnknownDecoder::SniffForImageMimeType   96 

 
 	Source File :
/builds/client/linux22/seamonkey/mozilla/netwerk/streamconv/converters/nsUnknownDecoder.cpp
line : 413
 
====================================================================================================
     Count   Offset    Real Signature
[ 62   nsUnknownDecoder::SniffForImageMimeType dcf4a6f3 -
nsUnknownDecoder::SniffForImageMimeType ]
[ 1   nsUnknownDecoder::SniffForImageMimeType efd9b6cc -
nsUnknownDecoder::SniffForImageMimeType ]
[ 1   nsUnknownDecoder::SniffForImageMimeType b447edf5 -
nsUnknownDecoder::SniffForImageMimeType ]
[ 1   nsUnknownDecoder::SniffForImageMimeType b3d836f5 -
nsUnknownDecoder::SniffForImageMimeType ]
[ 1   nsUnknownDecoder::SniffForImageMimeType ad7f2a1d -
nsUnknownDecoder::SniffForImageMimeType ]
[ 1   nsUnknownDecoder::SniffForImageMimeType 915edb08 -
nsUnknownDecoder::SniffForImageMimeType ]
 
     Count   Platform List 
     32   Windows NT 5.1 build 2600
     28   Windows NT 5.0 build 2195
     4   Windows 98 4.10 build 67766446
     2   Windows NT 4.0 build 1381
     1   Windows 98 4.90 build 73010104
 
     Count   Build Id List 
     67   2003031211
 
     No of Unique Users        57
 
 Stack trace(Frame) 

	 nsUnknownDecoder::SniffForImageMimeType
[c:/builds/seamonkey/mozilla/netwerk/streamconv/converters/nsUnknownDecoder.cpp
 line 414] 
	 nsUnknownDecoder::DetermineContentType
[c:/builds/seamonkey/mozilla/netwerk/streamconv/converters/nsUnknownDecoder.cpp
 line 357] 
	 nsUnknownDecoder::OnStopRequest
[c:/builds/seamonkey/mozilla/netwerk/streamconv/converters/nsUnknownDecoder.cpp
 line 248] 
	 nsStreamListenerTee::OnStopRequest
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsStreamListenerTee.cpp  line 66] 
	 nsHttpChannel::OnStopRequest
[c:/builds/seamonkey/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp  line
2949] 
	 nsInputStreamPump::OnStateStop
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsInputStreamPump.cpp  line 471] 
	 nsInputStreamPump::OnInputStreamReady
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsInputStreamPump.cpp  line 325]  
 
     (18714718)	URL: http://www.heise.de
     (18714718)	Comments: closing mozilla  
     (18703162)	URL: www.ntcompatible.com
     (18703162)	Comments: Browsing forums & switching posts there @
ntcompatible.com VERY fast
     (18697490)	Comments: exiting after normal use
     (18650000)	Comments: open a pdf via an internet-site
     (18639574)	Comments: exiting mozilla using 'X' in top right corner.
     (18598494)	Comments: Stopped Mozilla. Some download entries could not
deleted from the download manager before. I do not know if this is related.
     (18551522)	Comments: closing a tab
     (18516454)	URL: www.tomshardware.com
     (18476552)	Comments: Nothing... :(
     (18468626)	Comments: Shutting down browser.
     (18468049)	Comments: Just started Mozilla browser.
     (18393220)	URL: http://www.heise.de
     (18393220)	Comments: I closed the browser Window.

Comment 1

[Darin Fisher]

Attachment: v1 patch

wild.. the only possible explanation for this crash is the inability to get the
imgLoader service.  maybe OnStopRequest is happening after xpcom-shutdown?!? 
at any rate, this could could certainly use some null checks.

Comment 2

[Boris Zbarsky [:bzbarsky]]

+  if (NS_FAILED(rv) || !(temp && *temp)) return PR_FALSE;
 
-  return temp != nsnull;
+  mContentType.Adopt(temp);

This leaks temp if *temp = '\0' but temp was allocated...

Comment 3

[Darin Fisher]

bz: doh!! thank you for catching that :)

Comment 4

[Darin Fisher]

Attachment: v2 patch

ok, forget checking for an empty string.  we never cared about that before, and
there really isn't any reason to care about that now.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 119264 [details] [diff] [review]
v2 patch

Looks good.  ;)

If you wanted to be pedantic, you could return !mContentType.IsEmpty().... but
either way is fine.

Comment 6

[Darin Fisher]

ok, patch checked in.. let's see if that fixes the crash.

Comment 7

[Jay Patel [:jay]]

Adding M140A to summary for future reference.  This is a topcrasher with Mozilla
1.4 alpha...but should no longer be a problem since it has been fixed on the
MozillaTrunk after that milestone release. 

Comment 8

[Jay Patel [:jay]]

v.fixed.  no more crashes in recent MozillaTrunk builds according to Talkback.