523814 - valgrind - Invalid Read of size 4 in nsMediaCacheStream::BlockList::NotifyBlockSwapped (mNextBlock/mPrevBlock)

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Bob Clary [:bc] (inactive)]

valgrind mochitest linux mozilla-central. valgrind 3.2.1, built with
--enable-valgrind, not run with --smc-check=all

Occurs after content/media/test/test_mixed_principals.html

Invalid read of size 4
   at 0x7190F76: nsMediaCacheStream::BlockList::NotifyBlockSwapped(int, int) (nsMediaCache.cpp:470)
   by 0x71911E8: nsMediaCache::SwapBlocks(int, int) (nsMediaCache.cpp:843)
   by 0x7193D19: nsMediaCache::Update() (nsMediaCache.cpp:1050)
   by 0x71969DB: UpdateEvent::Run() (nsMediaCache.cpp:1241)
   by 0x42FE99E: nsThread::ProcessNextEvent(int, int*) (nsThread.cpp:527)
   by 0x428607C: NS_ProcessNextEvent_P(nsIThread*, int) (nsThreadUtils.cpp:230)
   by 0x4F90715: nsBaseAppShell::Run() (nsBaseAppShell.cpp:170)
   by 0x5C2D692: nsAppStartup::Run() (nsAppStartup.cpp:182)
   by 0x403F6B3: XRE_main (nsAppRunner.cpp:3471)
   by 0x8048DE0: main (nsBrowserApp.cpp:156)
 Address 0xB15B0D4 is 492 bytes inside a block of size 516 free'd
   at 0x4004FDA: free (vg_replace_malloc.c:233)
   by 0x427680B: PL_DHashFreeTable (pldhash.c:120)
   by 0x4277617: ChangeTable (pldhash.c:599)
   by 0x4277957: PL_DHashTableOperate (pldhash.c:695)
   by 0x719680C: nsTHashtable<nsMediaCacheStream::BlockList::Entry>::RemoveEntry(unsigned const&) (nsTHashtable.h:199)
   by 0x7190F6C: nsMediaCacheStream::BlockList::NotifyBlockSwapped(int, int) (nsMediaCache.cpp:467)
   by 0x71911E8: nsMediaCache::SwapBlocks(int, int) (nsMediaCache.cpp:843)
   by 0x7193D19: nsMediaCache::Update() (nsMediaCache.cpp:1050)
   by 0x71969DB: UpdateEvent::Run() (nsMediaCache.cpp:1241)
   by 0x42FE99E: nsThread::ProcessNextEvent(int, int*) (nsThread.cpp:527)
   by 0x428607C: NS_ProcessNextEvent_P(nsIThread*, int) (nsThreadUtils.cpp:230)
   by 0x4F90715: nsBaseAppShell::Run() (nsBaseAppShell.cpp:170)

Invalid read of size 4
   at 0x7190F7F: nsMediaCacheStream::BlockList::NotifyBlockSwapped(int, int) (nsMediaCache.cpp:471)
   by 0x71911E8: nsMediaCache::SwapBlocks(int, int) (nsMediaCache.cpp:843)
   by 0x7193D19: nsMediaCache::Update() (nsMediaCache.cpp:1050)
   by 0x71969DB: UpdateEvent::Run() (nsMediaCache.cpp:1241)
   by 0x42FE99E: nsThread::ProcessNextEvent(int, int*) (nsThread.cpp:527)
   by 0x428607C: NS_ProcessNextEvent_P(nsIThread*, int) (nsThreadUtils.cpp:230)
   by 0x4F90715: nsBaseAppShell::Run() (nsBaseAppShell.cpp:170)
   by 0x5C2D692: nsAppStartup::Run() (nsAppStartup.cpp:182)
   by 0x403F6B3: XRE_main (nsAppRunner.cpp:3471)
   by 0x8048DE0: main (nsBrowserApp.cpp:156)
 Address 0xB15B0D0 is 488 bytes inside a block of size 516 free'd
   at 0x4004FDA: free (vg_replace_malloc.c:233)
   by 0x427680B: PL_DHashFreeTable (pldhash.c:120)
   by 0x4277617: ChangeTable (pldhash.c:599)
   by 0x4277957: PL_DHashTableOperate (pldhash.c:695)
   by 0x719680C: nsTHashtable<nsMediaCacheStream::BlockList::Entry>::RemoveEntry(unsigned const&) (nsTHashtable.h:199)
   by 0x7190F6C: nsMediaCacheStream::BlockList::NotifyBlockSwapped(int, int) (nsMediaCache.cpp:467)
   by 0x71911E8: nsMediaCache::SwapBlocks(int, int) (nsMediaCache.cpp:843)
   by 0x7193D19: nsMediaCache::Update() (nsMediaCache.cpp:1050)
   by 0x71969DB: UpdateEvent::Run() (nsMediaCache.cpp:1241)
   by 0x42FE99E: nsThread::ProcessNextEvent(int, int*) (nsThread.cpp:527)
   by 0x428607C: NS_ProcessNextEvent_P(nsIThread*, int) (nsThreadUtils.cpp:230)
   by 0x4F90715: nsBaseAppShell::Run() (nsBaseAppShell.cpp:170)

Comment 1

[Matthew Gregan [:kinetik]]

This could explain the crash in bug 520528, too.

Comment 2

[Matthew Gregan [:kinetik]]

Attachment: patch v0

I don't have a working Valgrind to see if I can reproduce this, but I think this is the necessary fix.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 407921 [details] [diff] [review]
patch v0

Very nice catch!

Comment 4

[Matthew Gregan [:kinetik]]

http://hg.mozilla.org/mozilla-central/rev/6ef41ffcc521

Comment 5

[Matthew Gregan [:kinetik]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/5b85f2b7b820