1377369 - Crash in memcpy | mozilla::net::CacheFileChunkBuffer::FillInvalidRanges

Status: VERIFIED FIXED

(Core :: Networking: Cache, defect)

Description

[Ekanan Ketunuti]

Attachment: log.tar.xz

This bug was filed from the Socorro interface and is 
report bp-331dd3d0-9018-4f07-8088-bc9b80170630.
=============================================================

Frequent crashes with JSBC eager and most of them are from facebook.com.

Attached log modules: timestamp,rotate:50,nsHttp:5,nsSocketTransport:5,nsStreamPump:5,nsHostResolver:5,cache2:5,sync

Comment 3

[Ekanan Ketunuti]

Attachment: timestamp,sync,rotate200,cache25-a84d3182-2580-423e-8bb7-2ba510170702.tar.xz

Attached the log for bp-a84d3182-2580-423e-8bb7-2ba510170702 while opening inoreader.com.

Comment 4

[Nicolas B. Pierron [:nbp]]

Ekanan, thanks for the reports.

One thing I noticed, and which is also verified from crash stats reports is that when this crash appear the first time, it will likely appear on the same website repeatedly after.

Comment 5

[Michal Novotny [:michal]]

Attachment: fix

CacheFileChunkBuffer::FillInvalidRanges uses aOther->mBufSize instead of aOther->mDataSize. mBufSize is size of the buffer (allocated as 2^n) and we want to access only mDataSize bytes. This bug never occurred before storing alt-data stuff because the new data was always bigger than the data read from the disk. This is no longer true.

Comment 6

[Valentin Gosu [:valentin] (he/him)]

Comment on attachment 8883060 [details] [diff] [review]
fix

Review of attachment 8883060 [details] [diff] [review]:
-----------------------------------------------------------------

Michal says Honza might not be available on short notice. Patch looks simple enough. r+

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/216b686cdbaa
Crash in memcpy | mozilla::net::CacheFileChunkBuffer::FillInvalidRanges, r=valentin

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/216b686cdbaa