1653928 - Crash in [@ mozilla::net::WebSocketChannel::DoStopSession]

Status: RESOLVED DUPLICATE of bug 1653642

(Core :: Networking: WebSockets, defect)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-5efd72b9-f01e-417f-be26-c09770200717.

Top 10 frames of crashing thread:

0 XUL mozilla::net::WebSocketChannel::DoStopSession netwerk/protocol/websocket/WebSocketChannel.cpp:2294
1 XUL non-virtual thunk to mozilla::net::WebSocketChannel::OnError netwerk/protocol/websocket/WebSocketChannel.cpp
2 XUL mozilla::net::nsWebSocketConnection::OnOutputStreamReady netwerk/protocol/websocket/nsWebSocketConnection.cpp:222
3 XUL non-virtual thunk to mozilla::net::nsWebSocketConnection::OnOutputStreamReady netwerk/protocol/websocket/nsWebSocketConnection.cpp
4 XUL nsOutputStreamReadyEvent::Run xpcom/io/nsStreamUtils.cpp:182
5 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1234
6 XUL NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:513
7 XUL mozilla::net::nsSocketTransportService::Run netwerk/base/nsSocketTransportService2.cpp:1195
8 XUL non-virtual thunk to mozilla::net::nsSocketTransportService::Run netwerk/base/nsSocketTransportService2.cpp
9 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1234

This does not look like a new bug because we have crash reports going back a while though with slightly different stacks. This manifests itself as either a NULL-pointer access or an access to 0xffffffffffffffff, however digging through recent crash reports I found the poison pattern often among the register contents so this might as well be an use-after-free crash.

A couple of user comments mention this happening on shutdown

Comment 1

[Kershaw Chang [:kershaw]]

This could be a dup of bug 1653642.