Last Comment Bug 679783 - crash [@ mozilla::net::WebSocketChannel::OnInputStreamReady]
: crash [@ mozilla::net::WebSocketChannel::OnInputStreamReady]
Status: VERIFIED FIXED
[inbound]
: crash, verified-aurora, verified-beta
Product: Core
Classification: Components
Component: Networking: WebSockets (show other bugs)
: Trunk
: x86 Windows 7
: -- critical (vote)
: mozilla9
Assigned To: Patrick McManus [:mcmanus]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-08-17 10:38 PDT by Martijn Wargers [:mwargers] (not working for Mozilla)
Modified: 2011-09-14 11:10 PDT (History)
8 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed
fixed


Attachments
patch 1 (1.06 KB, patch)
2011-08-17 12:54 PDT, Patrick McManus [:mcmanus]
jduell.mcbugs: review+
asa: approval‑mozilla‑aurora+
asa: approval‑mozilla‑beta+
Details | Diff | Splinter Review

Description Martijn Wargers [:mwargers] (not working for Mozilla) 2011-08-17 10:38:30 PDT
This bug was filed from the Socorro interface and is 
report bp-b60f8316-99ec-4a39-99fa-fa5742110817 .
============================================================= 
0 	xul.dll 	mozilla::net::WebSocketChannel::OnInputStreamReady 	netwerk/protocol/websocket/WebSocketChannel.cpp:2416
1 	xul.dll 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:114
2 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
3 	xul.dll 	nsSocketTransportService::DoPollIteration 	netwerk/base/src/nsSocketTransportService2.cpp:770
4 	xul.dll 	nsSocketTransportService::Run 	netwerk/base/src/nsSocketTransportService2.cpp:638
5 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
6 	xul.dll 	nsRunnable::Release 	obj-firefox/xpcom/build/nsThreadUtils.cpp:55
7 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
8 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
9 	mozcrt19.dll 	_callthreadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:348
10 	mozcrt19.dll 	_threadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:326
11 	kernel32.dll 	BaseThreadInitThunk 	
12 	ntdll.dll 	__RtlUserThreadStart 	
13 	ntdll.dll 	_RtlUserThreadStart 	

While doing some testing with Websockets, I got this crash.
Sorry, I don't really have a testcase at hand.
Comment 1 Patrick McManus [:mcmanus] 2011-08-17 11:19:08 PDT
crud. It appears that an input event was queued, the websocket channel socket closed down, and then the input event was run which deref'd the channel socket.

Easy enough to fix at least. After it lands we can figure out if it applies to aurora/beta (probly does).
Comment 2 Patrick McManus [:mcmanus] 2011-08-17 12:54:23 PDT
Created attachment 553876 [details] [diff] [review]
patch 1
Comment 3 Mozilla RelEng Bot 2011-08-17 20:40:43 PDT
Try run for 14c2617c6cd7 is complete.
Detailed breakdown of the results available here:
    http://tbpl.mozilla.org/?tree=Try&rev=14c2617c6cd7
Results (out of 2 total builds):
    success: 2
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/mcmanus@ducksong.com-14c2617c6cd7
Comment 4 Jason Duell [:jduell] (needinfo me) 2011-08-26 12:07:49 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/cff7682167aa
Comment 5 Jason Duell [:jduell] (needinfo me) 2011-08-26 12:08:43 PDT
Comment on attachment 553876 [details] [diff] [review]
patch 1

one-line nullcheck avoids crashes, does no harm...
Comment 6 Marco Bonardo [::mak] (Away 6-20 Aug) 2011-08-27 01:48:18 PDT
http://hg.mozilla.org/mozilla-central/rev/cff7682167aa
Comment 7 Scoobidiver (away) 2011-08-27 03:30:37 PDT
It is #26 top browser crasher in 7.0b1 and #31 in 8.0a2.
Comment 9 Ioana (away) 2011-08-30 04:07:40 PDT
Can anyone please help me with a test case, STR or guidelines I can use to verify this fix?

Thank you
Comment 10 Martijn Wargers [:mwargers] (not working for Mozilla) 2011-08-30 04:44:42 PDT
I can't reproduce it anymore, using: 9.0a1 (2011-08-29)
Comment 11 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2011-09-09 14:55:41 PDT
QA tracking, needs verification on Firefox 7 and 8 by checking crashstats.
Comment 12 Scoobidiver (away) 2011-09-10 03:02:09 PDT
(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #11)
> QA tracking, needs verification on Firefox 7 and 8 by checking crashstats.
No crashes from 7.0b3 and 8.0a2/20110830:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3AWebSocketChannel%3A%3AOnInputStreamReady%28nsIAsyncInputStream*%29
https://crash-stats.mozilla.com/report/list?signature=mozilla::net::WebSocketChannel::OnInputStreamReady
Comment 13 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2011-09-14 11:10:32 PDT
Adding verified-flags based on comment 12.

Note You need to log in before you can comment on or make changes to this bug.