207846 - M17x FF10PR1 [@ msvcrt.dll - nsStorageInputStream::Read] Miscellaneous non-repeatable browsing crashes

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[David Campbell]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030526
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030526

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030526 has
crashed a couple of times on me while browsing web pages.  I can't give the
specific urls and the problem is non-repeatable anyway.  So...reporting them
here.  Let me know if I should have done otherwise.

Incident IDs TB20360440E and TB20331961G.



Reproducible: Couldn't Reproduce

Steps to Reproduce:
Can't reproduce.

Comment 1

[Olivier Cahagne]

-> Layout (hoping that someone will retreive TB data)

Comment 2

[Tino]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5a) Gecko/20030601

I agree... since 1.4b mozilla crashed after a period of browsing. On windows 98
the resources of system (Explorer/?/info) go rapidly down. With 128MB RAM and
eight tabs of sourceforge.net only 30% are free of the resources. Before this it
was 85%!! When it's at 0% the buttons(back/forward...) hide, fonts are bigger
and so on.

Reproducible: 128MB RAM, more and more tabs...

Comment 3

[Michael Lefevre]

only mozilla drivers should set the blocking1.4 flag to "+". to nominate a bug
for consideration, the flag should be "?". would be hard to consider this bug
until there's more information about it...

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Incident ID 20360440
Stack Signature 	MSVCRT.DLL + 0x124c (0x7800124c) da6b6e61
Email Address 	[e-mail]
Product ID 	MozillaTrunk
Build ID 	2003051604
Trigger Time 	2003-05-22 19:47:39
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	MSVCRT.DLL
URL visited 	
User Comments 	viewing a web page, don't know url
Trigger Reason 	Access violation
Source File Name 	
Trigger Line No. 	
Stack Trace 	
MSVCRT.DLL + 0x124c (0x7800124c)
nsStorageInputStream::Read
[c:/builds/seamonkey/mozilla/xpcom/io/nsStorageStream.cpp, line 408]
nsCacheEntryDescriptor::nsInputStreamWrapper::Read
[c:/builds/seamonkey/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp, line 529]
nsInputStreamTransport::FillPipeSegment
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsStreamTransportService.cpp, line
161]
nsPipeOutputStream::WriteSegments
[c:/builds/seamonkey/mozilla/xpcom/io/nsPipe3.cpp, line 1062]
nsInputStreamTransport::Run
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsStreamTransportService.cpp, line
207]
nsThreadPoolRunnable::Run
[c:/builds/seamonkey/mozilla/xpcom/threads/nsThread.cpp, line 900] 


Incident ID 20331961
Stack Signature 	MSVCRT.DLL + 0x124c (0x7800124c) da6b6e61
Email Address 	[e-mail]
Product ID 	MozillaTrunk
Build ID 	2003051604
Trigger Time 	2003-05-22 01:24:40
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	MSVCRT.DLL
URL visited 	
User Comments 	Browsing, but don't know page, but it was at www.dataaction.com.au
Trigger Reason 	Access violation
Source File Name 	
Trigger Line No. 	
Stack Trace 	
MSVCRT.DLL + 0x124c (0x7800124c)
nsStorageInputStream::Read
[c:/builds/seamonkey/mozilla/xpcom/io/nsStorageStream.cpp, line 408]
nsCacheEntryDescriptor::nsInputStreamWrapper::Read
[c:/builds/seamonkey/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp, line 529]
nsInputStreamTransport::FillPipeSegment
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsStreamTransportService.cpp, line
161]
nsPipeOutputStream::WriteSegments
[c:/builds/seamonkey/mozilla/xpcom/io/nsPipe3.cpp, line 1062]
nsInputStreamTransport::Run
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsStreamTransportService.cpp, line
207]
nsThreadPoolRunnable::Run
[c:/builds/seamonkey/mozilla/xpcom/threads/nsThread.cpp, line 900] 

Comment 5

[Olivier Cahagne]

-> Networking: Cache (as per bug 61398)

Comment 6

[Jay Patel [:jay]]

*** Bug 211224 has been marked as a duplicate of this bug. ***

Comment 7

[Jay Patel [:jay]]

This has been a topcrash for a long time and is very difficult to
reproduce/debug/understand.  I just wanted to update this bug to show that it's
still showing up in the latest releases.

Here are a few recent groups of crashes from Mozilla 1.7rc1 Talkback data:
Count   Offset    Real Signature
[ 7   MSVCRT.DLL + 0x109b3 (0x780109b3) 8d94e7f2 - MSVCRT.DLL + 0x109b3
(0x780109b3) ]
 
     Crash date range: 08-MAY-04 to 14-MAY-04
     Min/Max Seconds since last crash: 7109 - 1033871
     Min/Max Runtime: 12806 - 1033871
 
     Count   Platform List 
     7   [Windows NT 5.0 build 2195]   
 
     Count   Build Id List 
     7   2004042109
 
     No of Unique Users         7
 
 Stack trace(Frame) 

	 MSVCRT.DLL + 0x109b3 (0x780109b3)  
	 nsStorageInputStream::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStorageStream.cpp
 line 408] 
	 nsCacheEntryDescriptor::nsInputStreamWrapper::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp
 line 529] 
	 nsInputStreamTransport::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsStreamTransportService.cpp
 line 234] 
	 nsStreamCopierIB::ConsumeInputBuffer
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 488] 
	 nsPipeOutputStream::WriteSegments
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsPipe3.cpp 
line 1099] 
	 nsStreamCopierOB::DoCopy
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 548] 
	 nsAStreamCopier::Process
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 322]  
 
     (41783)	URL: https://chpayment.mbnanetaccess.com

===========================================================================

Count   Offset    Real Signature
[ 3   MSVCRT.DLL + 0x11ce (0x780011ce) 4707d1de - MSVCRT.DLL + 0x11ce (0x780011ce) ]
 
     Crash date range: 08-MAY-04 to 14-MAY-04
     Min/Max Seconds since last crash: 10559 - 1068021
     Min/Max Runtime: 10559 - 1068021
 
     Count   Platform List 
     1   [Windows NT 5.0 build 2195]   
     1   [Windows 98 4.90 build 73010104]   
     1   [Windows 98 4.10 build 67766222]   
 
     Count   Build Id List 
     3   2004042109
 
     No of Unique Users         3
 
 Stack trace(Frame) 

	 MSVCRT.DLL + 0x11ce (0x780011ce)  
	 nsStorageInputStream::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStorageStream.cpp
 line 408] 
	 nsCacheEntryDescriptor::nsInputStreamWrapper::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp
 line 529] 
	 nsInputStreamTransport::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsStreamTransportService.cpp
 line 234] 
	 nsStreamCopierIB::ConsumeInputBuffer
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 488] 
	 nsPipeOutputStream::WriteSegments
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsPipe3.cpp 
line 1099] 
	 nsStreamCopierOB::DoCopy
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 548] 
	 nsAStreamCopier::Process
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 322]  
 
     (47656)	URL: https://www.mattweb.cfefcu.com/asp/USERS/Common/Login/NetLogin.asp
     (47656)	Comments: Trying to login with several tabs open
     (42311)	Comments: browsing a web page
     (41699)	URL: www.toefl.org
     (41699)	Comments: saving a web page
 

Reassigning to Darin (owner of the bug I just marked dup of this one).

Comment 8

[Andreas Kunz]

TB51440W - the page I crashed is password protected, but I can say I were there
several times without crashing. As one would expect with a cache bug :-/

Comment 9

[timeless]

my bet is that memcpy is crashing

Comment 10

[Jay Patel [:jay]]

Updating summary with M17rc2 for tracking.  Still seeing these crashes in
Mozilla 1.7 rc2 Talkback data.

Comment 11

[Jay Patel [:jay]]

This is definitely still around in Mozilla 1.7...and there are a lot of crashes
with Firefox 0.9.x.  Unless someone can go off of comment #9 and find a possible
fix, this might be around for a while...it's been impossible to reproduce this.

Mozilla 1.7 Talkback data:
Count   Offset    Real Signature
[ 6   MSVCRT.DLL + 0x11ce (0x780011ce) 4707d1de - nsStorageInputStream::Read ]
[ 3   MSVCRT.DLL + 0x11b09 (0x78011b09) 34ad3660 - nsStorageInputStream::Read ]
[ 2   MSVCRT.DLL + 0x1648 (0x78001648) 863536a6 - nsStorageInputStream::Read ]
 
     Crash date range: 01-AUG-04 to 30-JUL-04
     Min/Max Seconds since last crash: 63 - 1256107
     Min/Max Runtime: 13403 - 1256107
 
     Count   Platform List 
     8   Windows 98 [Windows 98 4.10 build 67766446] 
     2   Windows ME [Windows 98 4.90 build 73010104] 
     1   Windows 2K [Windows NT 5.0 build 2195] 
 
     Count   Build Id List 
     11   2004061609
 
     No of Unique Users         9
 
 Stack trace(Frame) 

	 MSVCRT.DLL + 0x11ce (0x780011ce)  
	 nsStorageInputStream::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStorageStream.cpp
 line 408] 
	 nsCacheEntryDescriptor::nsInputStreamWrapper::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp
 line 529] 
	 nsInputStreamTransport::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsStreamTransportService.cpp
 line 234] 
	 nsStreamCopierIB::ConsumeInputBuffer
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 488] 
	 nsPipeOutputStream::WriteSegments
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsPipe3.cpp 
line 1099] 
	 nsStreamCopierOB::DoCopy
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 548] 
	 nsAStreamCopier::Process
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 322]  
 
     (430462)	URL: www.firstinterstatebank.com
     (411712)	URL: cunacu.org
     (411712)	Comments: going to this site.  It did not shut down and I was able
to do what I wanted.
     (407018)	URL: www.firstinterstatebank.com
     (402743)	URL: www.wbsavings.com

Count   Offset    Real Signature
[ 18   msvcrt.dll + 0x32f43 (0x77c42f43) 90bfe334 - nsStorageInputStream::Read ]
[ 1   msvcrt.dll + 0x36fa3 (0x77c16fa3) c40f7769 - nsStorageInputStream::Read ]
 
     Crash date range: 01-AUG-04 to 31-JUL-04
     Min/Max Seconds since last crash: 198 - 1234080
     Min/Max Runtime: 12328 - 2697850
 
     Count   Platform List 
     19   Windows XP [Windows NT 5.1 build 2600] 
 
     Count   Build Id List 
     19   2004061609
 
     No of Unique Users        18
 
 Stack trace(Frame) 

	 msvcrt.dll + 0x32f43 (0x77c42f43)  
	 nsStorageInputStream::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStorageStream.cpp
 line 408] 
	 nsCacheEntryDescriptor::nsInputStreamWrapper::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp
 line 529] 
	 nsInputStreamTransport::Read
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsStreamTransportService.cpp
 line 234] 
	 nsStreamCopierIB::ConsumeInputBuffer
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 488] 
	 nsPipeOutputStream::WriteSegments
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsPipe3.cpp 
line 1099] 
	 nsStreamCopierOB::DoCopy
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 548] 
	 nsAStreamCopier::Process
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 322] 
	 nsAStreamCopier::HandleContinuationEvent
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 393] 
	 PL_HandleEvent
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c
 line 674] 
	 nsIOThreadPool::ThreadFunc
[d:/BUILDS/tinderbox/Mozilla1.7/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsIOThreadPool.cpp
 line 280] 
	 _PR_NativeRunThread()  
	 _PR_MD_CREATE_THREAD()  
	 msvcrt.dll + 0x27fb8 (0x77c37fb8)   
 
     (451120)	URL: www.palm.imarketsource.com
     (451120)	Comments: I was working on a report and was kicked out back to my
main computer screen.
     (435269)	Comments: completing online study guide for human kinetics Active
living   arthritis study
     (428026)	URL: http://www.mba.org.cn
     (427515)	URL: http://www.mba.org.cn
     (426698)	URL: www.mozilla.org
     (426698)	Comments: processing order. 
     (426667)	URL: www.mozilla.org
     (426667)	Comments: processing order. 
     (422557)	URL: https://www.zigzag2000.co.il/catalog/shipping.php
     (422557)	Comments: i went into the page above  and suddenly  crash!
     (410367)	URL: www.blair.com
     (410367)	Comments: trying to logout
     (406311)	URL: comcast.net

========================================
Firefox 0.9.2 Talkback data:
Count   Offset    Real Signature
[ 104   msvcrt.dll + 0x32f43 (0x77c42f43) 81636e56 - nsStorageInputStream::Read ]
[ 16   msvcrt.dll + 0x32f43 (0x77c32f43) b108330d - nsStorageInputStream::Read ]
[ 8   msvcrt.dll + 0x32e43 (0x77c42e43) 73a8bc38 - nsStorageInputStream::Read ]
 
     Crash date range: 01-AUG-04 to 31-JUL-04
     Min/Max Seconds since last crash: 46 - 1355248
     Min/Max Runtime: 466 - 1355248
 
     Count   Platform List 
     128   Windows XP [Windows NT 5.1 build 2600] 
 
     Count   Build Id List 
     128   2004070723
 
     No of Unique Users       111
 
 Stack trace(Frame) 

	 msvcrt.dll + 0x32f43 (0x77c42f43)  
	 nsStorageInputStream::Read
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStorageStream.cpp
 line 408] 
	 nsCacheEntryDescriptor::nsInputStreamWrapper::Read
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp
 line 528] 
	 nsStreamCopierIB::ConsumeInputBuffer
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 488] 
	 nsStreamCopierOB::DoCopy
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 547] 
	 nsAStreamCopier::Process
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 321] 
	 nsAStreamCopier::HandleContinuationEvent
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp
 line 393]  
 
     (468401)	URL: www.parknationalbank.com
     (467420)	Comments: trying to open links in new tabs in teh background
     (464382)	Comments: communicating with MS site server
     (463588)	Comments: clicked on url on web page to go to another part of the site
     (443977)	Comments: online with  SSL3. getting account statement
     (443418)	URL: www.computerrepair.com
     (443418)	Comments: clink on a link
     (442460)	Comments: Was using Outlook Express e-mail
     (439687)	URL: http://www.tigerdirect.com
     (439687)	Comments: Just trying to calculate shipping on a package.
     (439578)	URL:
http://www.kerrykit.com/order.html?id=3172-3252725-zaVUQIeJnqwCNlpdhzmiSA
     (439578)	Comments: Accessing url from email message
     (437764)	URL: http://www.national.com.au/
     (437764)	Comments: Alternating between website and Quicken software package
comparing figures.
     (435962)	Comments: Secure transaction (bank).
     (435355)	URL:
http://www.tigerdirect.ca/applications/category/category_slc.asp?CatId=880
     (425419)	URL: directv.com
     (425419)	Comments: Specific URL unknown - was attempting to log in to
DirecTV's website using my name  phone  zip and last 4 SSN digits.  Browser
crashed upon form submit.
     (425333)	URL: www.parknationalbank.com
     (424721)	URL: https://blt.ops.aol.com/_cqr/index.cgi
     (424721)	Comments: Attempting to open a bug during a scrub.
     (422924)	Comments: trying to send emails  but not getting on very well with
constant shutdown
     (420816)	URL: www.tecksel.com.au
     (420816)	Comments: I hit the "back" button
     (420044)	Comments: I Can't get Netscape to download. Every time I try to
download it I get disconnected and it can't be resumed. I've tried to do a
complete program (30 meg) download and I've tried the online update. I've been
trying to get my mail through another E-Mail
     (420044)	Comments:  program but I don't even know my server information for
my [e-mail] account 
     (419695)	URL:
http://nrma.fitness2live.com.au/default.asp?pg=memberszone&spg=promotion
     (419695)	Comments: Clicked on a "register now" button
     (418782)	URL: www.promistar.com
     (418782)	Comments: opening page  
     (418315)	URL: www.scottrade.com
     (418315)	Comments: browsing
     (418281)	URL: www.scottrade.com
     (417486)	URL: http://www.newegg.com/
     (415700)	URL: http://www.xbox.com/en-gb/signin.htm
     (414043)	URL: www.newegg.com
     (414043)	Comments: Opening my account
     (413355)	URL: www.graysonline.com.au
     (413355)	Comments: logging into the 'my info' membership part of the site
     (413096)	Comments: signing on to Gameplay.com
     (406680)	URL: http://www.long-sword.com/catalog/images/mrl/MUREP-8-276.jpg
     (406680)	Comments: opened up a link
     (404329)	Comments: logging into a webpage
     (402874)	URL: https://www.forumcuonline.com
     (402698)	URL: https://www.forumcuonline.com
     (402572)	URL: www.usaa.com
     (402572)	Comments: Logging out of website
 

Comment 12

[Adam Hauner]

*** Bug 256816 has been marked as a duplicate of this bug. ***

Comment 13

[David Bradley]

Looking back at past revisions, yes it's memcpy, so either it's the incoming
buffer or the object the Read method was called on is dead.

Without registers from talkback or seeing the crash in a debugger, it's
impossible to narrow it down further.

Comment 14

[Maciej Maczynski]

Just a short info: if you want to catch this (probably this?) bug in debugger,
just go to www.pekao24.pl. When page is loaded, just reload it. It crashes
_always_. At least on my computer on few other around.
I've posted it as bug 256816 and it was marked as a duplicate of this bug.

Comment 15

[Johnny Stenback (:jst)]

Loading that site in a debugger I hit the assertion:

        NS_ASSERTION(indx < GetSegmentCount(), "index out of bounds");

in nsSegmentedBuffer::GetSegment(unsigned int indx=5). That call comes from
nsStorageInputStream::Read() which ends up getting mReadCursor set to null, and
mSegmentEnd is set to mReadCursor + PR_MIN(mSegmentSize, available), which in my
cases ended up being 0x0000000b, then the code does a memcpy out of mReadCursor,
which is obviously bad... If I step our of the method at this point, the page
loads w/o crashing, but there's stuff missing on the page, so we're not getting
all the data in that case.

I don't see this crash on linux, only on WinXP so far...

Comment 16

[David Bradley]

I'm wondering if for some reason the stream was closed or deleted. When I 
looked up the stack, the caller or two above this function, mInput didn't look 
in good shape. Haven't had time to look into more.

Comment 17

[Darin Fisher]

> I don't see this crash on linux, only on WinXP so far...

I'm able to repro this under linux with exactly the same bogus values for
mReadCursor and mSegmentEnd (i.e., 0xb).

Investigating...

Comment 18

[Darin Fisher]

The problem appears to be with the fact that mLogicalLength of the storage
stream is 20491, but it only contains 5 segments, each 4096 bytes in length. 
That means there is only 20480 bytes in the storage stream.  mLogicalCursor for
the storage input stream is exactly 20480 when we crash, so it is clear that it
thought it needed to ask for the 6th buffer segment.  Unfortunately, that
segment is NULL for some reason, and so we crash.

This bug seems to be about figuring out why the storage stream's mLogicalLength
does not match its physical length.

Comment 19

[Darin Fisher]

I suspect that this crash is caused by some aspect of nsStorageInputStream that
is not threadsafe.  It should be possible to read from the storage stream
without requiring any fancy locking since the cache would be protecting the
storage stream contents from being modified.  Hmm...

Comment 20

[David Bradley]

I ran the thing under Purify several times and couldn't get it to crash, but
under the debugger it crashed fairly quickly. Which would seem to back up your
thread/race condition theory.

Comment 21

[Darin Fisher]

I have a simplified testcase.  The problem has nothing to do with threads =)

It turns out that the problem is triggered whenever we write some data to a
storage stream, read the data, then write some more (appending to the existing
data), and then we finally crash when we try to read from the storage stream
again becaues the storage stream was left in a bad state by the writer who
appended data.

Digging further...

Comment 22

[Darin Fisher]

Attachment: v1 patch

Wow... patching code from 1999!

Comment 23

[Darin Fisher]

Attachment: TestStorageStream.cpp - testcase

Comment 24

[David Bradley]

FYI, I'm planning on reviewing the patch this evening. I want to take a little 
time to understand the surrounding code and get a better context. The change 
itself looks good.

Comment 25

[David Bradley]

Comment on attachment 160303 [details] [diff] [review]
v1 patch

r=dbradley

Looks good, I didn't see any other similar situations in the rest of the code
as well.

Comment 26

[chris hofmann]

lets get this for 1.0

Comment 27

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 160303 [details] [diff] [review]
v1 patch

sr=bzbarsky

Comment 28

[Darin Fisher]

fixed-on-trunk

Comment 29

[Darin Fisher]

I also checked in TestStorageStream.cpp on the trunk since it may be useful in
the future if anyone needs to wack nsStorageStream again.

Comment 30

[chris hofmann]

Comment on attachment 160303 [details] [diff] [review]
v1 patch

a=chofmann for the branches

Comment 31

[Darin Fisher]

fixed1.7.x, fixed-aviary1.0

Comment 32

[Jay Patel [:jay]]

Updating summary with FF10PR1 and M17x for tracking.

Comment 33

[Jay Patel [:jay]]

*** Bug 249548 has been marked as a duplicate of this bug. ***

Comment 34

[benc]

so is this really xpcom (not cache?)

Comment 35

[Darin Fisher]

-> xpcom