54724 - Crash due to full cache array in AssociateCacheEntryWithRecord

Status: VERIFIED DUPLICATE of bug 54072

(Core :: Networking: Cache, defect, P3)

Description

[Randell Jesup [:jesup] (needinfo me)]

FreeBSD 4.1 20000928xx

I was looking at a web page pointed to by an entry in bug 48203, and I got this
assertion.  After I continued from the assertion, it crashed.

It appears the problem is in nsReplacementPolicy::AssociateCacheEntryWithRecord
because it wants to extend the array (since all the entries are used), and
the calculation for the new size is:
        newCapacity = mCapacityRankedEntriesArray + STATS_GROWTH_INCREMENT;
        if (newCapacity > mMaxEntries)
            newCapacity = mMaxEntries;
But mNumEntries is already the same as mMaxEntries, so this merely realloc's
the same size as before, so there are still no empty entries.  This causes an
assertion, and also will I think cause it not to delete any entries.

I suggest either allowing them to grow beyond mMaxEntries(?), or rework things
to check for this case and instead delete an entry.  The problem with that
is that this was called from DeleteAtleastOneEntry()...

Right after continuing from this assertion, mozilla segfaulted.  See
backtrace of the segfault at the end of this file.

Backtrace and many structure dumps attached

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

Attachment: backtrace and structure dumps

Comment 2

[R.K.Aa.]

*** Bug 54723 has been marked as a duplicate of this bug. ***

Comment 3

[neeti]

*** This bug has been marked as a duplicate of 54072 ***

Comment 4

[Scott Brodmerkle]

Verified dupe.