Closed Bug 1250816 Opened 9 years ago Closed 9 years ago

crash in nsTArray_Impl<T>::DestructRange | nsTArray_Impl<T>::ReplaceElementsAt<T> | mozilla::net::HttpChannelChild::OnStartRequest

Categories

(Core :: Networking: HTTP, defect, P3)

Product:
Core
Component:
Networking: HTTP
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1247982
Tracking Flags:
Tracking Status
e10s + ---

People

(Reporter: blassey, Unassigned)

References

Details

(Keywords: crash, Whiteboard: [gfx-noted][necko-active])

Crash Data

This bug was filed from the Socorro interface and is report bp-08b2cd32-a6ec-41c8-9f4e-71de82160217. ============================================================= This is the #27 top crash for e10s and doesn't show up in non-e10s
Whiteboard: [gfx-noted]
I don't think this is graphics related.
Component: Graphics: Layers → Networking: HTTP
Whiteboard: [gfx-noted] → [gfx-noted][necko-active]
Patrick are you guys looking at this?
tracking-e10s: ? → +
Flags: needinfo?(mcmanus)
Priority: -- → P3
Flags: needinfo?(mcmanus) → needinfo?(jduell.mcbugs)
See Also: → 1247982
This looks like the same issue as 1247982
The first report I found for this was: https://crash-stats.mozilla.com/report/index/a8c9036f-1099-4903-86d7-36e9e2151102 Version:43.0a2 Build ID:20151020004123 All of the 1138 reports are on windows - it may be windows only or it may that we don't have any reports for other platforms yet. From what I can tell, this is a memory corruption. When replacing mRequestHead, it clears mHeaders, it calls to nsTArray::DestructRange(). In order to execute that code Length() will be non-zero, so either nsTArray's mHdr pointer is corrupted, or or its value. (I suspect it's the pointer).
It sounds like we have no idea how to fix this, then?
Flags: needinfo?(jduell.mcbugs)
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.