|nsHttpChannel::OnDataAvailable| is not protected by any critical section. In HTTP OMT scenario, there is a chance that |mListener->OnDataAvailable|  is called after HTTP channel is canceled (if context switch happened within the function). It'll cause the following input stream read operation fail and might trigger assertions or runtime error. We should be able to trigger this bug with chaos mode (bug 955888) because it creates a greater chance to context switch after dispatching |OnTransportStatusAsyncEvent| in .  https://dxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsHttpChannel.cpp#6097  https://dxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsHttpChannel.cpp#6079
Whiteboard: [necko-backlog] → [necko-backlog][PBg-HTTP-M2]
After bug 1325915 is landed, we are not going to do sync dispatch for obtaining progress/status. There will be no force context switch while implementing PBg-Http in parent side to trigger this issue.
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.