1167562 - crash in mozilla::net::nvFIFO::Length()

Status: RESOLVED DUPLICATE of bug 1159747

(Core :: Networking: HTTP, defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-9e253869-ac69-4fbf-b5fc-85b0e2150424.
=============================================================

Low-volume but it's relatively high in v40 which is a bit worrying.
The crash reason is a null-pointer read.
All reported crashes are on x86 Windows.


0   mozilla::net::nvFIFO::Length()
1   mozilla::net::Http2Compressor::ProcessHeader(mozilla::net::nvPair, bool, bool)
2   mozilla::net::Http2Compressor::EncodeHeaderBlock(nsCString const&, nsACString_internal const&, nsACString_internal const&, nsACString_internal const&, nsACString_internal const&, bool, nsACString_internal&)
3   mozilla::net::Http2Stream::GenerateOpen()
4   mozilla::net::Http2Stream::OnReadSegment(char const*, unsigned int, unsigned int*)
5   mozilla::net::nsHttpTransaction::ReadRequestSegment(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*)
6   nsStringInputStream::ReadSegments(nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*)
7   mozilla::net::nsHttpTransaction::ReadSegments(mozilla::net::nsAHttpSegmentReader*, unsigned int, unsigned int*)
8   mozilla::net::Http2Stream::ReadSegments(mozilla::net::nsAHttpSegmentReader*, unsigned int, unsigned int*)
9   mozilla::net::Http2Session::ReadSegments(mozilla::net::nsAHttpSegmentReader*, unsigned int, unsigned int*)
10  mozilla::net::nsHttpConnection::OnSocketWritable()
11  mozilla::net::nsHttpConnection::OnOutputStreamReady(nsIAsyncOutputStream*)
12  mozilla::net::nsHttpConnectionForceIO::Run()
13  nsThread::ProcessNextEvent(bool, bool*)
14  NS_ProcessNextEvent(nsIThread*, bool)
15  nsSocketTransportService::Run()
16  nsThread::ProcessNextEvent(bool, bool*)
17  NS_ProcessNextEvent(nsIThread*, bool)
18  mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)
19  MessageLoop::RunHandler()
20  MessageLoop::Run()
21  nsThread::ThreadFunc(void*)
22  _PR_NativeRunThread
23  pr_root
24  _callthreadstartex
25  msvcr120.dll@0x2c000
26  BaseThreadInitThunk
27  __RtlUserThreadStart
28  _RtlUserThreadStart

Comment 1

[u408661]

I'm 99.9% certain this shares the same root cause (and therefore fix) as bug 1159747 (both crashes are on a line that derefs gStaticHeaders). I'm just trying to figure out why my solution there is causing test timeouts, will have a fix ready soon.

Comment 2

[(Away)]

Yeah, I suspect x86 and x64 merely got different signatures due to inlining.

Comment 3

[Patrick McManus [:mcmanus]]

this does not exist in crash-stats >= 40 which is where 1159747 was fixed