1056919 - crash in memcpy | mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult)

Status: VERIFIED FIXED

(Core :: Networking: Cache, defect)

Description

[Liz Henry (:lizzard) (relman/hg->git project)]

This bug was filed from the Socorro interface and is 
report bp-072e1fe5-862b-45d7-a677-55b672140820.
=============================================================
This isn't a high volume crash, but it and a similar signature first appeared 2014-07-11 for Firefox 34.0a1. There are 75/11183 crashes in the last 7 days. They're all amd64.

Crashing thread:

0 	msvcr100.dll 	memcpy 	f:\dd\vctools\crt_bld\SELF_64_amd64\crt\src\amd64\memcpy.asm:278
1 	xul.dll 	mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult) 	netwerk/cache2/CacheFileChunk.cpp
2 	xul.dll 	mozilla::net::ReadEvent::Run() 	netwerk/cache2/CacheFileIOManager.cpp
3 	xul.dll 	mozilla::net::CacheIOThread::LoopOneLevel(unsigned int) 	netwerk/cache2/CacheIOThread.cpp
4 	xul.dll 	mozilla::net::CacheIOThread::ThreadFunc() 	netwerk/cache2/CacheIOThread.cpp
5 	xul.dll 	mozilla::net::CacheIOThread::ThreadFunc(void*) 	netwerk/cache2/CacheIOThread.cpp
6 	nss3.dll 	PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
7 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
8 	msvcr100.dll 	_callthreadstartex 	f:\dd\vctools\crt_bld\self_64_amd64\crt\src\threadex.c:314
9 	msvcr100.dll 	_threadstartex 	f:\dd\vctools\crt_bld\self_64_amd64\crt\src\threadex.c:292
10 	kernel32.dll 	BaseThreadInitThunk 	
11 	ntdll.dll 	RtlUserThreadStart 	
12 	kernel32.dll 	BasepReportFault 	
13 	kernel32.dll 	BasepReportFault

Comment 1

[Michal Novotny [:michal]]

Attachment: fix

Comment 2

[Michal Novotny [:michal]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f738941da13c

Comment 3

[Michal Novotny [:michal]]

Comment on attachment 8489896 [details] [diff] [review]
fix

Approval Request Comment
[Feature/regressing bug #]: 1013395
[User impact if declined]: crash in a very specific case
[Describe test coverage new/current, TBPL]: none, it's impossible to write a test covering this code path
[Risks and why]: none, it fixes an obvious mistake
[String/UUID change made/needed]: none

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/f738941da13c

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/52e09c968b30
https://hg.mozilla.org/releases/mozilla-beta/rev/62d020eff891

Comment 6

[Ada [:adalucinet]]

No new crash reports in Socorro after fixing this issue for Firefox 35.0a1, 34.0a2 and 33.0b:
1. [@ _VEC_memcpy | mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult) ] signature: http://goo.gl/4oCwyU
2. [@ memcpy | mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult)] signature: http://goo.gl/5kgA5B