make nsHttpChannel::OnDataAvailable thread-safe

RESOLVED WONTFIX

Status

()

Core
Networking
RESOLVED WONTFIX
3 years ago
a year ago

People

(Reporter: schien, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [necko-backlog][PBg-HTTP-M2])

|nsHttpChannel::OnDataAvailable| is not protected by any critical section. In HTTP OMT scenario, there is a chance that |mListener->OnDataAvailable| [1] is called after HTTP channel is canceled (if context switch happened within the function). It'll cause the following input stream read operation fail and might trigger assertions or runtime error.

We should be able to trigger this bug with chaos mode (bug 955888) because it  creates a greater chance to context switch after dispatching |OnTransportStatusAsyncEvent| in [2].

[1] https://dxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsHttpChannel.cpp#6097
[2] https://dxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsHttpChannel.cpp#6079
Whiteboard: [necko-backlog]
Whiteboard: [necko-backlog] → [necko-backlog][PBg-HTTP-M2]
After bug 1325915 is landed, we are not going to do sync dispatch for obtaining progress/status. There will be no force context switch  while implementing PBg-Http in parent side to trigger this issue.
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.