179166 - A null event queue crashes necko app; need eventQueue check for Proxy release in nsRequestObserverProxy destructor

Status: VERIFIED WORKSFORME

(Core :: Networking, defect)

Description

[David Epstein]

Mozilla 1.2b Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.2b) Gecko/20021106
1. cd to /mozilla/dist/bin.
2. TestSocketTransport
Result: crash with "memory could not be read". unhandled exception. Causes proxy
init to fail.

In nsRequestObserverProxy.cpp,
nsRequestObserverProxy::~nsRequestObserverProxy(), need:
if(mEventQ)
   ProxyRelease(mEventQ, obs);
else ...

In TestSocketTransport.cpp (TestConnection::Run), add code for eventQService
handling. Need to get a real event queue.

Call stack:
ProxyRelease(nsIEventQueue * 0x00000000, nsIRequestObserver * 0x00d920c4) line
87 + 7 bytes
nsRequestObserverProxy::~nsRequestObserverProxy() line 229 + 21 bytes
nsRequestObserverProxy::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsRequestObserverProxy::Release(nsRequestObserverProxy * const 0x00da4480) line
239 + 147 bytes
nsStreamListenerProxy::~nsStreamListenerProxy() line 92 + 27 bytes
nsStreamListenerProxy::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsStreamListenerProxy::Release(nsStreamListenerProxy * const 0x00da4aa0) line
227 + 147 bytes
nsCOMPtr<nsIStreamListenerProxy>::~nsCOMPtr<nsIStreamListenerProxy>() line 491
NS_NewStreamListenerProxy(nsIStreamListener * * 0x017afee8, nsIStreamListener *
0x00d920c4, nsIEventQueue * 0x00000000, unsigned int 2048, unsigned int 8192)
line 528 + 26 bytes
nsSocketTransport::AsyncRead(nsSocketTransport * const 0x00dfbae0,
nsIStreamListener * 0x00d920c4, nsISupports * 0x00dfbae0, unsigned int 0,
unsigned int 4294967295, unsigned int 0, nsIRequest * * 0x00d920ec) line 1755 +
55 bytes
TestConnection::Run(TestConnection * const 0x00d920c0) line 391 + 86 bytes
nsThread::Main(void * 0x00dfcbc0) line 120 + 26 bytes
_PR_NativeRunThread(void * 0x00dfc9a0) line 433 + 13 bytes
_threadstartex(void * 0x00dfc7f0) line 212 + 13 bytes
KERNEL3

Comment 1

[David Epstein]

oops, try the url again!

Comment 2

[rpotts (gone)]

Attachment: Make TestSocketTransport create an event queue for each helper thread.

This patch works around the problem in nsRequestObserverProxy where a crash
will occur if there is NO event queue for the thread...

-- rick

Comment 3

[Doug Turner (:dougt)]

Comment on attachment 108949 [details] [diff] [review]
Make TestSocketTransport create an event queue for each helper thread.

instead of createThreadEventQueue use createMonitoredThreadEventQueue.

Comment 4

[Darin Fisher]

Comment on attachment 108949 [details] [diff] [review]
Make TestSocketTransport create an event queue for each helper thread.

sr=darin

Comment 5

[rpotts (gone)]

Attachment: new patch addressing dougt's comments

Comment 6

[rpotts (gone)]

I've checked in the most recent patch for TestSocketTransport.

-- rick

Comment 7

[rpotts (gone)]

darin,

can you fix the problem in nsRequestObserverProxy.cpp where a crash occurs if
the eventQ is null?

you can reproduce this crash by running TestSocketTransport without the patch i
just checked in :-)

thanks,
-- rick

Comment 8

[Darin Fisher]

rick: hmm.. from reading the code it looks like the crash will occur if
nsRequestObserverProxy::Init is not called.  it is trivial to make it null check
mEventQ, but i wonder why Init is not being called.

Comment 9

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 10

[Darin Fisher]

TestSocketTransport was rewritten for the async-io landing... it currently uses
CreateMonitoredThreadEventQueue, so bug is WFM ;-)

Comment 11

[Charles Rosendahl]

v