1356580 - Crash in mozilla::ipc::PMemoryStreamChild::SendAddChunk

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-53ec7f04-294b-4236-880b-f11ab0170414.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::ipc::PMemoryStreamChild::SendAddChunk(nsTArray<unsigned char> const&) 	obj-firefox/ipc/ipdl/PMemoryStreamChild.cpp:38
1 	xul.dll 	mozilla::dom::`anonymous namespace'::SerializeInputStreamInChunks<mozilla::dom::nsIContentChild> 	dom/file/ipc/Blob.cpp:661
2 	xul.dll 	mozilla::dom::BlobDataFromBlobImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*, mozilla::dom::BlobData&) 	dom/file/ipc/Blob.cpp:995
3 	xul.dll 	nsTArray_Impl<mozilla::dom::BlobData, nsTArrayInfallibleAllocator>::InsertElementsAt<nsTArrayInfallibleAllocator>(unsigned int, unsigned int) 	obj-firefox/dist/include/nsTArray.h:1903
4 	xul.dll 	mozilla::dom::BlobDataFromBlobImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*, mozilla::dom::BlobData&) 	dom/file/ipc/Blob.cpp:968
5 	xul.dll 	mozilla::dom::BlobDataFromBlobImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*, mozilla::dom::BlobData&) 	dom/file/ipc/Blob.cpp:968
6 	xul.dll 	mozilla::dom::MultipartBlobImpl::QueryInterface(nsID const&, void**) 	dom/file/MultipartBlobImpl.cpp:25
7 	xul.dll 	mozilla::dom::BlobChild::GetOrCreateFromImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*) 	dom/file/ipc/Blob.cpp:3603
8 	xul.dll 	mozilla::BroadcastBlobURLRegistration(nsACString const&, mozilla::dom::BlobImpl*, nsIPrincipal*) 	dom/file/nsHostObjectProtocolHandler.cpp:147
9 	xul.dll 	nsHostObjectProtocolHandler::AddDataEntry(mozilla::dom::BlobImpl*, nsIPrincipal*, nsACString&) 	dom/file/nsHostObjectProtocolHandler.cpp:524
10 	xul.dll 	mozilla::dom::`anonymous namespace'::CreateObjectURLInternal<mozilla::dom::BlobImpl*> 	dom/url/URL.cpp:52
11 	xul.dll 	mozilla::dom::URL::CreateObjectURL(mozilla::dom::GlobalObject const&, mozilla::dom::Blob&, nsAString&, mozilla::ErrorResult&) 	dom/url/URL.cpp:1716
...

cross platform crahses with this signature started showing up in 55.0a1 & 54.0a2 in this cycle. this seems to coincide with the patch of bug 1340921 landing.

Comment 1

[Hsin-Yi Tsai (she/her) [:hsinyi]]

hi :baku, could you please take a look at this?

Comment 2

[Andrea Marchesini [:baku]]

Attachment: crash_memoryStream.patch

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/603563fad0fe
Better check of PMemoryStream actor creation in Blob code, r=qdot

Comment 4

[Andrea Marchesini [:baku]]

Comment on attachment 8859148 [details] [diff] [review]
crash_memoryStream.patch

Approval Request Comment
[Feature/Bug causing the regression]: multi-e10s and PBlob
[User impact if declined]: a crash can occur
[Is this code covered by automated tests?]: none. very hard to reproduce.
[Has the fix been verified in Nightly?]: I don't think it's possible to verify.
[Needs manual test from QE? If yes, steps to reproduce]: none
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: I added a null check.
[String changes made/needed]: none

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8859148 [details] [diff] [review]
crash_memoryStream.patch

54 went to Beta today and Aurora's gone.

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/603563fad0fe

Comment 7

[Gerry Chang [:gchang]]

Comment on attachment 8859148 [details] [diff] [review]
crash_memoryStream.patch

Fix a crash. Beta54+. Should be in 54 beta 1.

Comment 8

[Iris Hsiao [:ihsiao]]

Pushed: https://hg.mozilla.org/releases/mozilla-beta/rev/c8a873cdb79a - Andrea Marchesini - Bug 1356580 - Better check of PMemoryStream actor creation in Blob code, r=qdot. a=gchang