Crash in mozilla::net::AppendRequestsToArray

NEW
Unassigned

Status

()

Core
Networking
P2
critical
11 months ago
4 months ago

People

(Reporter: philipp, Unassigned)

Tracking

({crash, regression})

49 Branch
x86
Windows
crash, regression
Points:
---

Firefox Tracking Flags

(firefox51 wontfix, firefox52 wontfix, firefox53 ?, firefox54 ?)

Details

(Whiteboard: [necko-next], crash signature)

(Reporter)

Description

11 months ago
This bug was filed from the Socorro interface and is 
report bp-318fe3b4-1e51-4e1b-81b3-697f22170224.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::net::AppendRequestsToArray 	netwerk/base/nsLoadGroup.cpp:207
1 	xul.dll 	mozilla::net::nsLoadGroup::Cancel(nsresult) 	netwerk/base/nsLoadGroup.cpp:230
2 	xul.dll 	nsDocLoader::Stop() 	uriloader/base/nsDocLoader.cpp:243
3 	xul.dll 	nsDocShell::Stop(unsigned int) 	docshell/base/nsDocShell.cpp:5512
4 	xul.dll 	nsDocShell::InternalLoad(nsIURI*, nsIURI*, bool, nsIURI*, unsigned int, nsIPrincipal*, unsigned int, char16_t const*, char const*, nsAString_internal const&, nsIInputStream*, nsIInputStream*, unsigned int, nsISHEntry*, bool, nsAString_internal const&, nsIDocShell*, nsIURI*, nsIDocShell**, nsIRequest**) 	docshell/base/nsDocShell.cpp:10517
5 	xul.dll 	nsDocShell::LoadHistoryEntry(nsISHEntry*, unsigned int) 	docshell/base/nsDocShell.cpp:12457
6 	xul.dll 	nsDocShell::LoadURI(nsIURI*, nsIDocShellLoadInfo*, unsigned int, bool) 	docshell/base/nsDocShell.cpp:1437
7 		@0x46c463 	
8 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:458
9 	xul.dll 	js::TypeMonitorResult(JSContext*, JSScript*, unsigned char*, JS::Value const&) 	js/src/vm/TypeInference.cpp:3275
10 	xul.dll 	js::NativeObject::getChildProperty(js::ExclusiveContext*, JS::Handle<js::NativeObject*>, JS::Handle<js::Shape*>, JS::MutableHandle<js::StackShape>) 	js/src/vm/Shape.cpp:446
11 	xul.dll 	XPCWrappedNative::GetNewOrUsed(xpcObjectHelper&, XPCWrappedNativeScope*, XPCNativeInterface*, XPCWrappedNative**) 	js/xpconnect/src/XPCWrappedNative.cpp:460
12 	xul.dll 	XPCConvert::NativeInterface2JSObject(JS::MutableHandle<JS::Value>, nsIXPConnectJSObjectHolder**, xpcObjectHelper&, nsID const*, bool, nsresult*) 	js/xpconnect/src/XPCConvert.cpp:874

this crash signature was first appearing in firefox 49 - it's mostly affecting 32bit versions of firefox on windows. the share of crash reports from ru & zh-cn also looks higher than usual...
I'm not sure how this can happen. Requests are added to mRequests only in nsLoadGroup::AddRequest(), if the request were null there it would crash on null pointer in MergeDefaultLoadFlags() or MergeLoadFlags().

Updated

11 months ago
Whiteboard: [necko-next]
Too late for firefox 52, mass-wontfix.
status-firefox52: affected → wontfix
You need to log in before you can comment on or make changes to this bug.