Last Comment Bug 666997 - Firefox Crash @ mozilla::net::nsPreloadedStream::AsyncWait(nsIInputStreamCallback*
: Firefox Crash @ mozilla::net::nsPreloadedStream::AsyncWait(nsIInputStreamCall...
Status: VERIFIED FIXED
[qa-]
: crash
Product: Core
Classification: Components
Component: Networking: WebSockets (show other bugs)
: Trunk
: x86 Windows 7
: -- critical (vote)
: mozilla7
Assigned To: Patrick McManus [:mcmanus]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-06-24 11:43 PDT by Marcia Knous [:marcia - use ni]
Modified: 2011-09-29 10:49 PDT (History)
5 users (show)
mounir: in‑testsuite?
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed
fixed


Attachments
preloaded asyncwait null v1 (1.02 KB, patch)
2011-06-24 12:11 PDT, Patrick McManus [:mcmanus]
jduell.mcbugs: review+
cbiesinger: review+
asa: approval‑mozilla‑aurora+
Details | Diff | Splinter Review

Description Marcia Knous [:marcia - use ni] 2011-06-24 11:43:45 PDT
Seen while reviewing crash stats. Small volume Windows only crash which is only seen on the trunk: https://crash-stats.mozilla.com/report/list?signature=mozilla::net::nsPreloadedStream::AsyncWait%28nsIInputStreamCallback*,%20unsigned%20int,%20unsigned%20int,%20nsIEventTarget*%29.

Crashes started showing up using the 2011062200 build.

Possible pushlog regression range:  http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a285146675dc&tochange=b7a93f1279b7. There was a merge during this time.

https://crash-stats.mozilla.com/report/index/cb1151a3-6494-4778-bc06-f22482110624

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	mozilla::net::nsPreloadedStream::AsyncWait 	netwerk/base/src/nsPreloadedStream.cpp:176
1 	xul.dll 	mozilla::net::nsWebSocketHandler::CleanupConnection 	netwerk/protocol/websocket/nsWebSocketHandler.cpp:1323
2 	xul.dll 	mozilla::net::nsWebSocketHandler::StopSession 	netwerk/protocol/websocket/nsWebSocketHandler.cpp:1413
3 	xul.dll 	mozilla::net::nsWebSocketHandler::PrimeNewOutgoingMessage 	netwerk/protocol/websocket/nsWebSocketHandler.cpp:1173
Comment 1 Patrick McManus [:mcmanus] 2011-06-24 12:05:54 PDT
I have a fix for this in a differnet bug, which I didn't think could happen on the trunk.

This stack means do_CreateInstance("@mozilla.org/timer;1", &rv) failed. Maybe at shutdown time?
Comment 2 Patrick McManus [:mcmanus] 2011-06-24 12:11:13 PDT
Created attachment 541754 [details] [diff] [review]
preloaded asyncwait null v1

canceling asyncwait on a nsPreloadedStream with data still buffered could deref nsnull
Comment 3 Josh Matthews [:jdm] 2011-06-24 12:13:01 PDT
Yeah, timer creation failure is typically a shutdown thing.
Comment 4 Jason Duell [:jduell] (needinfo me) 2011-06-24 16:45:07 PDT
Comment on attachment 541754 [details] [diff] [review]
preloaded asyncwait null v1

Is this bug on aurora too?  If so seems worth fixing there--simple one-line fix.
Comment 5 Marcia Knous [:marcia - use ni] 2011-06-24 16:49:08 PDT
According to crash stats, that signature is not showing up in Aurora crash stats, only trunk. But even on trunk there is very few crashes.

(In reply to comment #4)
> Comment on attachment 541754 [details] [diff] [review] [review]
> preloaded asyncwait null v1
> 
> Is this bug on aurora too?  If so seems worth fixing there--simple one-line
> fix.
Comment 6 Christian :Biesinger (don't email me, ping me on IRC) 2011-06-25 06:54:44 PDT
Comment on attachment 541754 [details] [diff] [review]
preloaded asyncwait null v1

Why not put this check before the if (!mLen)?
Comment 7 Christian :Biesinger (don't email me, ping me on IRC) 2011-06-25 06:55:34 PDT
Comment on attachment 541754 [details] [diff] [review]
preloaded asyncwait null v1

er, nevermind, this code is correct as it is.
Comment 8 Patrick McManus [:mcmanus] 2011-06-25 07:52:49 PDT
the bug is on aurora - probably not seeing it there because nobody is running a website (yet) with the prefixed js api.

will nom for aurora after it lands on m-c.
Comment 9 Mounir Lamouri (:mounir) 2011-06-27 02:10:49 PDT
Pushed:
http://hg.mozilla.org/mozilla-central/rev/436d9fd4db12
Comment 10 Patrick McManus [:mcmanus] 2011-06-30 07:47:48 PDT
http://hg.mozilla.org/releases/mozilla-aurora/rev/866ac43c5b8b
Comment 11 Virgil Dicu [:virgil] [QA] 2011-08-19 08:30:28 PDT
Mozilla/5.0 (X11; Linux x86_64; rv:7.0) Gecko/20100101 Firefox/7.0

Is this issue fixed? Or are there any steps to follow in order to verify it in QA?
Comment 12 Patrick McManus [:mcmanus] 2011-08-19 09:52:48 PDT
(In reply to Virgil Dicu from comment #11)
> Mozilla/5.0 (X11; Linux x86_64; rv:7.0) Gecko/20100101 Firefox/7.0
> 
> Is this issue fixed?

Status == FIXED.

> Or are there any steps to follow in order to verify it
> in QA?

No known STR, fixed by inspection from the crash report.
Comment 13 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2011-09-22 15:31:09 PDT
qa- as no QA verification needed (check crashstats if you want to mark verified)
Comment 14 Marcia Knous [:marcia - use ni] 2011-09-29 10:49:47 PDT
No crashes are showing up in crash stats over a 4 week period, so marking this verified fixed based on that fact.

Note You need to log in before you can comment on or make changes to this bug.