Closed Bug 1159500 Opened 9 years ago Closed 9 years ago

crash in mozilla::net::CacheIndexIterator::GetNextHash(unsigned char (*)[20])

Categories

(Core :: Networking: Cache, defect)

38 Branch
Unspecified
Windows NT
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla41
Tracking Status
firefox39 --- fixed
firefox40 --- fixed
firefox41 --- fixed

People

(Reporter: MatsPalmgren_bugz, Assigned: michal)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-b3135641-2603-4d82-ae5b-1035b2150331.
=============================================================

The volume for this signature is relatively high in 38/39/40
compared to earlier versions.

Reported crashes over the past 28 days:

Product	Version	Percentage	Number Of Crashes
Firefox 	38.0b1 	17.08 %	271
Firefox 	38.0b6 	16.07 %	255
Firefox 	39.0a2 	13.48 %	214
Firefox 	38.0b3 	13.04 %	207
Firefox 	38.0b5 	12.98 %	206
Firefox 	38.0b2 	10.14 %	161
Firefox 	38.0b4 	9.83 %	156
Firefox 	38.0a2 	4.10 %	65
Firefox 	40.0a1 	2.52 %	40
Firefox 	36.0.4 	0.19 %	3
Firefox 	37.0.1 	0.19 %	3
Firefox 	37.0 	0.13 %	2
Firefox 	37.0.2 	0.13 %	2
Firefox 	37.0b3 	0.06 %	1
Firefox 	39.0a1 	0.06 %	1

(the low 39.0a1 number at the end seems odd, but perhaps this was
a bad version that we pulled quickly?)

All reported crashes are on Windows.
The user comment in this report might give a clue:
bp-aaec65a4-926f-412c-8d77-751a02150403
"FF Dev Edition with FireBug3 crashed when using the 'Forget History' button set at 24 hours. The page closed, reopened, and then crashed."
bp-fe1c0828-c6f1-468a-9bc1-cf6eb2150416
"I was deleting my last five minutes of history, when the "history is cleared happy browsing" message came up, the browser crashed"

A few other reports also have user comments that mentions "forget history".
Attached patch fixSplinter Review
Arrays in iterators are not cleared when the index is cleared by CacheIndex::RemoveAll().
Assignee: nobody → michal.novotny
Status: NEW → ASSIGNED
Attachment #8608877 - Flags: review?(honzab.moz)
Attachment #8608877 - Flags: review?(honzab.moz) → review+
https://hg.mozilla.org/mozilla-central/rev/0100fb165a6c
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
Comment on attachment 8608877 [details] [diff] [review]
fix

Approval Request Comment
[Feature/regressing bug #]: the bug is in cache2 since the beginning
[User impact if declined]: crash in case the cache is cleared while the storage is being visited
[Describe test coverage new/current, TreeHerder]: tested manually, automated test isn't possible
[Risks and why]: very low, this is a trivial change
[String/UUID change made/needed]: none
Attachment #8608877 - Flags: approval-mozilla-beta?
Attachment #8608877 - Flags: approval-mozilla-aurora?
Comment on attachment 8608877 [details] [diff] [review]
fix

Stability patch, taking it for both 40 & 39.
Attachment #8608877 - Flags: approval-mozilla-beta?
Attachment #8608877 - Flags: approval-mozilla-beta+
Attachment #8608877 - Flags: approval-mozilla-aurora?
Attachment #8608877 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.