1465775 - Crash in mozilla::Maybe<T>::operator*

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[Kartikaya Gupta (email:[e-mail])]

This bug was filed from the Socorro interface and is
report bp-8cdf6dc0-2c48-4bed-90d2-9d1f80180531.
=============================================================

Top 10 frames of crashing thread:

0 libxul.so mozilla::Maybe<nsresult>::operator* mfbt/Maybe.h:581
1 libxul.so mozilla::image::SourceBuffer::AppendFromInputStream image/SourceBuffer.cpp:525
2 libxul.so mozilla::image::RasterImage::OnImageDataAvailable image/RasterImage.cpp:989
3 libxul.so imgRequest::OnDataAvailable image/imgRequest.cpp:1205
4 libxul.so mozilla::net::nsStreamListenerTee::OnDataAvailable netwerk/base/nsStreamListenerTee.cpp:92
5 libxul.so mozilla::net::nsHttpChannel::OnDataAvailable netwerk/protocol/http/nsHttpChannel.cpp:7543
6 libxul.so nsInputStreamPump::OnStateTransfer netwerk/base/nsInputStreamPump.cpp:593
7 libxul.so nsInputStreamPump::OnInputStreamReady netwerk/base/nsInputStreamPump.cpp:428
8 libxul.so nsInputStreamReadyEvent::Run xpcom/io/nsStreamUtils.cpp:102
9 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1088

=============================================================


Seen in crash-stats. This crash appears a couple of times in the last 7 days, both on FennecAndroid.

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

I've touched this area recently. Probably my fault.

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

SourceBuffer::Append has no path in which it fails, and SourceBuffer::mStatus is Nothing. As such, I can only conclude that aInputStream in SourceBuffer::AppendFromInputStream itself failed to read the requested number of bytes, despite the fact we were told how many are available. We used to just ignore this. Reviewing a few other OnDataAvailable listeners (e.g. EventSourceImpl::OnDataAvailable, nsPingListener::OnDataAvailable, FetchDriver::OnDataAvailable, CSPViolationReportListener::OnDataAvailable), it seems they aren't too upset if there is a size mismatch. I'll make it fail only if there was an allocation failure inside SourceBuffer, but not assume there is.

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Attachment: 0001-Bug-1465775-Fix-crash-in-SourceBuffer-AppendFromInpu.patch, v1

Comment 5

[Mats Palmgren (inactive)]

(the signature from the duped bug)

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/47f3020c6aa7
Fix crash in SourceBuffer::AppendFromInputStream due to incomplete read. r=tnikkel

Comment 7

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/47f3020c6aa7