crash in nsTArray_Impl<T>::DestructRange | nsTArray_Impl<T>::ReplaceElementsAt<T> | mozilla::net::HttpChannelChild::OnStartRequest

RESOLVED DUPLICATE of bug 1247982

Status

()

Core
Networking: HTTP
P3
critical
RESOLVED DUPLICATE of bug 1247982
2 years ago
2 years ago

People

(Reporter: blassey, Unassigned)

Tracking

({crash})

unspecified
x86
Windows NT
crash
Points:
---

Firefox Tracking Flags

(e10s+)

Details

(Whiteboard: [gfx-noted][necko-active], crash signature)

This bug was filed from the Socorro interface and is 
report bp-08b2cd32-a6ec-41c8-9f4e-71de82160217.
=============================================================
This is the #27 top crash for e10s and doesn't show up in non-e10s
Whiteboard: [gfx-noted]
I don't think this is graphics related.
Component: Graphics: Layers → Networking: HTTP
Whiteboard: [gfx-noted] → [gfx-noted][necko-active]

Comment 2

2 years ago
Patrick are you guys looking at this?
tracking-e10s: ? → +
Flags: needinfo?(mcmanus)
Priority: -- → P3
Flags: needinfo?(mcmanus) → needinfo?(jduell.mcbugs)
See Also: → bug 1247982
This looks like the same issue as 1247982
The first report I found for this was:
https://crash-stats.mozilla.com/report/index/a8c9036f-1099-4903-86d7-36e9e2151102
Version:43.0a2  Build ID:20151020004123
All of the 1138 reports are on windows - it may be windows only or it may that we don't have any reports for other platforms yet.

From what I can tell, this is a memory corruption.
When replacing mRequestHead, it clears mHeaders, it calls to nsTArray::DestructRange(). In order to execute that code Length() will be non-zero, so either nsTArray's mHdr pointer is corrupted, or or its value. (I suspect it's the pointer).
It sounds like we have no idea how to fix this, then?
Flags: needinfo?(jduell.mcbugs)
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1247982
You need to log in before you can comment on or make changes to this bug.