367817 - nsJAR::GetInputStreamWithSpec closes same fd twice in failure case

Status: RESOLVED FIXED

(Core :: Networking: JAR, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I've (as of very recently) been seeing crashes when I rebuild JAR files underneath a running Mozilla.  (In the past, I sometimes saw runtime problems, but not crashes.)

From the stack of the crash, I suspect the problem *may* be the following bug (although I'm not convinced).  When nsJAR::GetInputStreamWithSpec's call to jis->InitFile fails, in some of the failure cases, jis owns the file descriptor (which it closes when it is released).  This means we'll call PR_Close on the same file descriptor twice.

I'll attach a patch that fixes this bug (I'm not yet sure if it fixes the crashes I've been seeing, though).

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

From a quick skim, looks like a regression from bug 337561, which added this PR_Close(fd).

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I haven't seen the crash since I wrote this patch, so I think it does fix the crash.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Checked in to trunk.