1997437 - crash at null in [@ mozilla::net::DictionaryOrigin::AddEntry]

Status: RESOLVED FIXED

(Core :: Networking: Cache, defect, P2)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20251028-6488d90a06c0 (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting https://www.realclearpolitics.com/#google_vignette.

0|0|libxul.so|mozilla::net::DictionaryOrigin::AddEntry(mozilla::net::DictionaryCacheEntry*, bool)|hg:hg.mozilla.org/mozilla-central:netwerk/cache2/Dictionary.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|1207|0x15f
0|1|libxul.so|mozilla::net::DictionaryCache::AddEntry(nsIURI*, bool, mozilla::net::DictionaryCacheEntry*)|hg:hg.mozilla.org/mozilla-central:netwerk/cache2/Dictionary.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|852|0x340
0|2|libxul.so|mozilla::net::DictionaryCache::AddEntry(nsIURI*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTArray<nsTString<char> >&, nsTSubstring<char> const&, mozilla::Maybe<nsTString<char> > const&, bool, unsigned int, mozilla::net::DictionaryCacheEntry**)|hg:hg.mozilla.org/mozilla-central:netwerk/cache2/Dictionary.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|828|0xcb
0|3|libxul.so|mozilla::net::nsHttpChannel::ParseDictionary(nsICacheEntry*, mozilla::net::nsHttpResponseHead*, bool)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/nsHttpChannel.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|6141|0x3e6
0|4|libxul.so|mozilla::net::nsHttpChannel::ContinueProcessNormal(nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/nsHttpChannel.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|3591|0x2c6
0|5|libxul.so|mozilla::net::nsHttpChannel::ContinueProcessResponse3(nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/nsHttpChannel.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912||0x30c
0|6|libxul.so|mozilla::net::nsHttpChannel::ContinueProcessResponse2(nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/nsHttpChannel.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|3166|0xd8
0|7|libxul.so|mozilla::net::nsHttpChannel::ContinueProcessResponse1(mozilla::net::nsHttpConnectionInfo*)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/nsHttpChannel.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|3127|0x3d1
0|8|libxul.so|mozilla::net::nsHttpChannel::ProcessResponse(mozilla::net::nsHttpConnectionInfo*)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/nsHttpChannel.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|3004|0x483
0|9|libxul.so|mozilla::net::nsHttpChannel::OnStartRequest(nsIRequest*)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/nsHttpChannel.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|8897|0xea9
0|10|libxul.so|nsInputStreamPump::OnStateStart()|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsInputStreamPump.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|524|0x154
0|11|libxul.so|nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsInputStreamPump.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|426|0x110
0|12|libxul.so|{virtual override thunk({offset(-24)}, nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*))}|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsInputStreamPump.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912||0xc
0|13|libxul.so|NS_NewCancelableRunnableFunction<CallbackHolder::CallbackHolder(nsIAsyncInputStream*, nsIInputStreamCallback*, unsigned int, nsIEventTarget*)::{lambda()#1}>(char const*, CallbackHolder::CallbackHolder(nsIAsyncInputStream*, nsIInputStreamCallback*, unsigned int, nsIEventTarget*)::{lambda()#1}&&)::FuncCancelableRunnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:6488d90a06c0b99c9f7000b8c0763c4f44253912|638|0x1f
0|14|libxul.so|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|705|0x17
0|15|libxul.so|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|1325|0x597
0|16|libxul.so|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|1148|0x57
0|17|libxul.so|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|641|0x65
0|18|libxul.so|mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:6488d90a06c0b99c9f7000b8c0763c4f44253912|550|0x16
0|19|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|1166|0x5aa
0|20|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|461|0x4f
0|21|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|85|0xc0
0|22|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6488d90a06c0b99c9f7000b8c0763c4f44253912|343|0x61
0|23|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|152|0x28
0|24|libxul.so|nsAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/gtk/nsAppShell.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|470|0x114
0|25|libxul.so|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|290|0x64
0|26|libxul.so|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|5914|0x108e
0|27|libxul.so|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|6169|0x5ae
0|28|libxul.so|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|6242|0x118
0|29|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:6488d90a06c0b99c9f7000b8c0763c4f44253912|532|0x444

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/fjxs9H9JCxAf-DkxTLKXrA/index.html

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

Attachment: Bug 1997437: Fix null-deref when removing a compression-dictionary before the cache entry is available r=#necko-reviewers!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/711947df5d30
https://hg.mozilla.org/integration/autoland/rev/219b442ed0a6
Fix null-deref when removing a compression-dictionary before the cache entry is available r=necko-reviewers,valentin

Comment 4

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/219b442ed0a6