679783 - crash [@ mozilla::net::WebSocketChannel::OnInputStreamReady]

Status: VERIFIED FIXED

(Core :: Networking: WebSockets, defect)

Description

[Martijn Wargers (dead)]

This bug was filed from the Socorro interface and is 
report bp-b60f8316-99ec-4a39-99fa-fa5742110817 .
============================================================= 
0 	xul.dll 	mozilla::net::WebSocketChannel::OnInputStreamReady 	netwerk/protocol/websocket/WebSocketChannel.cpp:2416
1 	xul.dll 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:114
2 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
3 	xul.dll 	nsSocketTransportService::DoPollIteration 	netwerk/base/src/nsSocketTransportService2.cpp:770
4 	xul.dll 	nsSocketTransportService::Run 	netwerk/base/src/nsSocketTransportService2.cpp:638
5 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
6 	xul.dll 	nsRunnable::Release 	obj-firefox/xpcom/build/nsThreadUtils.cpp:55
7 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
8 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
9 	mozcrt19.dll 	_callthreadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:348
10 	mozcrt19.dll 	_threadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:326
11 	kernel32.dll 	BaseThreadInitThunk 	
12 	ntdll.dll 	__RtlUserThreadStart 	
13 	ntdll.dll 	_RtlUserThreadStart 	

While doing some testing with Websockets, I got this crash.
Sorry, I don't really have a testcase at hand.

Comment 1

[Patrick McManus [:mcmanus]]

crud. It appears that an input event was queued, the websocket channel socket closed down, and then the input event was run which deref'd the channel socket.

Easy enough to fix at least. After it lands we can figure out if it applies to aurora/beta (probly does).

Comment 2

[Patrick McManus [:mcmanus]]

Attachment: patch 1

Comment 3

[Mozilla RelEng Bot]

Try run for 14c2617c6cd7 is complete.
Detailed breakdown of the results available here:
    http://tbpl.mozilla.org/?tree=Try&rev=14c2617c6cd7
Results (out of 2 total builds):
    success: 2
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-14c2617c6cd7

Comment 4

[Jason Duell]

http://hg.mozilla.org/integration/mozilla-inbound/rev/cff7682167aa

Comment 5

[Jason Duell]

Comment on attachment 553876 [details] [diff] [review]
patch 1

one-line nullcheck avoids crashes, does no harm...

Comment 6

[Marco Bonardo [:mak]]

http://hg.mozilla.org/mozilla-central/rev/cff7682167aa

Comment 7

[Scoobidiver (away)]

It is #26 top browser crasher in 7.0b1 and #31 in 8.0a2.

Comment 8

[LegNeato]

http://hg.mozilla.org/releases/mozilla-aurora/rev/c392c0bbee02
http://hg.mozilla.org/releases/mozilla-beta/rev/d0b794291f3d

Comment 9

[Ioana (away)]

Can anyone please help me with a test case, STR or guidelines I can use to verify this fix?

Thank you

Comment 10

[Martijn Wargers (dead)]

I can't reproduce it anymore, using: 9.0a1 (2011-08-29)

Comment 11

[u279076]

QA tracking, needs verification on Firefox 7 and 8 by checking crashstats.

Comment 12

[Scoobidiver (away)]

(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #11)
> QA tracking, needs verification on Firefox 7 and 8 by checking crashstats.
No crashes from 7.0b3 and 8.0a2/20110830:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3AWebSocketChannel%3A%3AOnInputStreamReady%28nsIAsyncInputStream*%29
https://crash-stats.mozilla.com/report/list?signature=mozilla::net::WebSocketChannel::OnInputStreamReady

Comment 13

[u279076]

Adding verified-flags based on comment 12.