21884 - [dogfood] crash visiting various websites in the image / networking code

Status: CLOSED FIXED

(Core :: Networking, defect, P3)

Description

[Scott MacGregor]

This started showing up in the builds tonight (12/15). I see it when loading
phonebook. Other people see it visiting various websites.

We crash because lib container has been deleted and we are getting an On data
available call that causes image lib to try to use this deleted container in
IL_StreamWriteReady.

I started seein this right after I pulled Rick's changes to http tonight. So I'm
wondering if that may be related.

Here's a stack trace
0xcdc033ca
il_image_abort
[d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 1258]
IL_StreamAbort [d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line
1595]
NetReaderImpl::StreamAbort
[d:\builds\seamonkey\mozilla\modules\libimg\src\ilNetReader.cpp, line 114]
ImageConsumer::OnDataAvailable
[d:\builds\seamonkey\mozilla\gfx\src\nsImageNetContextAsync.cpp, line 278]
nsDocumentOpenInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 218]
nsChannelListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1604]
nsHTTPResponseListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cpp,
line 202]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line
370]
nsStreamListenerEvent::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line
94]
PL_HandleEvent [plevent.c, line 523]
_md_EventReceiverProc [plevent.c, line
951]
KERNEL32.DLL + 0x35d9 (0xbff735d9)
0x08730016
0xff540070

Comment 1

[Scott MacGregor]

Okay, I backed out Rick's checkin from tonight and that fixed the crash. Chris
H. wanted me to back out Rick's checkins if we can't reach him tonight.

Comment 2

[Scott MacGregor]

Rick, I backed out your changes tonight to fix the crashing problem. I'll
re-assign this to you. I suppose you could mark this fixed and then re-open the
original bug you were fixing?

Comment 3

[chris hofmann]

orignal bug fix that appears to have caused this regression was
http://bugzilla.mozilla.org/show_bug.cgi?id=21459

Comment 4

[rpotts (gone)]

So, I've fixed the changes for bug #21459 to prevent this crash :-)
I've just checked in the changes again...

Comment 5

[Tom Everingham]

closing this per engineers comments