1009032 - crash in nsStandardURL::Release()

Status: VERIFIED DUPLICATE of bug 1006530

(Core :: Networking, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-ef677b33-297e-4e67-898b-14e752140506.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	nsStandardURL::Release() 	netwerk/base/src/nsStandardURL.cpp
1 	libxul.so 	mozilla::net::RtspControllerParent::~RtspControllerParent 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/netwerk/protocol/rtsp/../../../dist/include/nsCOMPtr.h
2 	libxul.so 	mozilla::net::RtspControllerParent::~RtspControllerParent 	netwerk/protocol/rtsp/controller/RtspControllerParent.cpp
3 	libxul.so 	mozilla::net::RtspControllerParent::Release() 	netwerk/protocol/rtsp/controller/RtspControllerParent.cpp
4 	libxul.so 	IPC::Principal::~Principal 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/ipc/ipdl/../../dist/include/nsCOMPtr.h
5 	libxul.so 	mozilla::net::SendOnDisconnectedTask::~SendOnDisconnectedTask 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/netwerk/protocol/rtsp/../../../dist/include/nsCOMPtr.h
6 	libxul.so 	mozilla::net::SendOnDisconnectedTask::~SendOnDisconnectedTask 	netwerk/protocol/rtsp/controller/RtspController.cpp
7 	libxul.so 	AsyncLatencyLogger::Release() 	content/media/Latency.cpp
8 	libxul.so 	mozilla::net::RtspController::OnDisconnected(unsigned char, unsigned int) 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/netwerk/protocol/rtsp/../../../dist/include/nsAutoPtr.h
9 	libxul.so 	android::RTSPSource::onDisconnected(android::sp<android::AMessage> const&) 	netwerk/protocol/rtsp/rtsp/RTSPSource.cpp
10 	libxul.so 	android::RTSPSource::onMessageReceived(android::sp<android::AMessage> const&) 	netwerk/protocol/rtsp/rtsp/RTSPSource.cpp
11 	libxul.so 	android::AHandlerReflector<android::RTSPSource>::onMessageReceived(android::sp<android::AMessage> const&) 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/netwerk/protocol/rtsp/../../../../frameworks/base/include/media/stagefright/foundation/AHandlerReflector.h
12 	libstagefright_foundation.so 	android::ALooperRoster::deliverMessage 	frameworks/base/media/libstagefright/foundation/ALooperRoster.cpp
13 	libstagefright_foundation.so 	android::ALooper::loop 	frameworks/base/media/libstagefright/foundation/ALooper.cpp
14 	libstagefright_foundation.so 	android::ALooper::LooperThread::threadLoop 	frameworks/base/media/libstagefright/foundation/ALooper.cpp
15 	libutils.so 	android::Thread::_threadLoop 	frameworks/base/libs/utils/Threads.cpp
16 	libutils.so 	thread_data_t::trampoline 	frameworks/base/libs/utils/Threads.cpp
17 	libc.so 	__thread_entry 	bionic/libc/bionic/pthread.c
18 	libc.so 	pthread_create 	bionic/libc/bionic/pthread.c

More reports:
https://crash-stats.mozilla.com/report/list?product=B2G&signature=nsStandardURL%3A%3ARelease%28%29#tab-reports

Comment 1

[Patrick McManus [:mcmanus]]

:valentin, do you think this is a regression?

Comment 2

[Valentin Gosu [:valentin] (he/him)]

I don't think recent changes to nsStandardURL could have caused this.
From what I can tell from the stack trace, it crashes when releasing the URI off the main thread. Similar to Bug 912514.

Comment 3

[Steve Workman [:sworkman] (INACTIVE)]

This looks like a dup of an RTSP bug that was fixed and landed just last week on m-c.

Comment 4

[William Hsu [:whsu]]

I verified this patch.
No crash happened during verification.
Thanks.

* Build Information:
 - Gaia      2f89c43e798ccba631025bedc47a1fb24e830cf2
 - Gecko     https://hg.mozilla.org/mozilla-central/rev/4b6d63b05a0a
 - BuildID   20140512160204
 - Version   32.0a1

Comment 5

[Ethan Tseng [:ethan]]

(In reply to Naoki Hirata :nhirata (please use needinfo instead of cc) from comment #0)
> This bug was filed from the Socorro interface and is 
> report bp-ef677b33-297e-4e67-898b-14e752140506.
> =============================================================

This bug is resolved and verified.
But I am just a little confused.

We judged this bug as a duplicate of 1006530 according to the stack trace.
But the content of this crash report doesn't conform to the gdb stack trace in comment #0. Why?

Comment 6

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

I think I made a mistake in clicking.  I must have clicked on the report for a windows within socorro, and then had a different stack in my copy buffer when I pasted.

Thanks for noting it was a duplicate.

Comment 7

[Ethan Tseng [:ethan]]

(In reply to Naoki Hirata :nhirata (please use needinfo instead of cc) from comment #6)
> I think I made a mistake in clicking.  I must have clicked on the report for
> a windows within socorro, and then had a different stack in my copy buffer
> when I pasted.
> 
> Thanks for noting it was a duplicate.
No problem.
Just to clarify it. :)