Closed Bug 679783 Opened 10 years ago Closed 10 years ago

crash [@ mozilla::net::WebSocketChannel::OnInputStreamReady]

Categories

(Core :: Networking: WebSockets, defect)

x86
Windows 7
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla9
Tracking Status
firefox7 --- fixed
firefox8 --- fixed

People

(Reporter: martijn.martijn, Assigned: mcmanus)

Details

(Keywords: crash, verified-aurora, verified-beta, Whiteboard: [inbound])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-b60f8316-99ec-4a39-99fa-fa5742110817 .
============================================================= 
0 	xul.dll 	mozilla::net::WebSocketChannel::OnInputStreamReady 	netwerk/protocol/websocket/WebSocketChannel.cpp:2416
1 	xul.dll 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:114
2 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
3 	xul.dll 	nsSocketTransportService::DoPollIteration 	netwerk/base/src/nsSocketTransportService2.cpp:770
4 	xul.dll 	nsSocketTransportService::Run 	netwerk/base/src/nsSocketTransportService2.cpp:638
5 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
6 	xul.dll 	nsRunnable::Release 	obj-firefox/xpcom/build/nsThreadUtils.cpp:55
7 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
8 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
9 	mozcrt19.dll 	_callthreadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:348
10 	mozcrt19.dll 	_threadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:326
11 	kernel32.dll 	BaseThreadInitThunk 	
12 	ntdll.dll 	__RtlUserThreadStart 	
13 	ntdll.dll 	_RtlUserThreadStart 	

While doing some testing with Websockets, I got this crash.
Sorry, I don't really have a testcase at hand.
Component: General → Networking: WebSockets
Product: Firefox → Core
QA Contact: general → networking.websockets
Version: unspecified → Trunk
crud. It appears that an input event was queued, the websocket channel socket closed down, and then the input event was run which deref'd the channel socket.

Easy enough to fix at least. After it lands we can figure out if it applies to aurora/beta (probly does).
Attached patch patch 1Splinter Review
Assignee: nobody → mcmanus
Status: NEW → ASSIGNED
Attachment #553876 - Flags: review?(jduell.mcbugs)
Try run for 14c2617c6cd7 is complete.
Detailed breakdown of the results available here:
    http://tbpl.mozilla.org/?tree=Try&rev=14c2617c6cd7
Results (out of 2 total builds):
    success: 2
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/mcmanus@ducksong.com-14c2617c6cd7
Attachment #553876 - Flags: review?(jduell.mcbugs) → review+
Comment on attachment 553876 [details] [diff] [review]
patch 1

one-line nullcheck avoids crashes, does no harm...
Attachment #553876 - Flags: approval-mozilla-beta?
Attachment #553876 - Flags: approval-mozilla-aurora?
Target Milestone: --- → mozilla9
http://hg.mozilla.org/mozilla-central/rev/cff7682167aa
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
It is #26 top browser crasher in 7.0b1 and #31 in 8.0a2.
Attachment #553876 - Flags: approval-mozilla-beta?
Attachment #553876 - Flags: approval-mozilla-beta+
Attachment #553876 - Flags: approval-mozilla-aurora?
Attachment #553876 - Flags: approval-mozilla-aurora+
Can anyone please help me with a test case, STR or guidelines I can use to verify this fix?

Thank you
I can't reproduce it anymore, using: 9.0a1 (2011-08-29)
Status: RESOLVED → VERIFIED
Crash Signature: [@ mozilla::net::WebSocketChannel::OnInputStreamReady(nsIAsyncInputStream*)] → [@ mozilla::net::WebSocketChannel::OnInputStreamReady(nsIAsyncInputStream*)] [@ mozilla::net::WebSocketChannel::OnInputStreamReady ]
QA tracking, needs verification on Firefox 7 and 8 by checking crashstats.
Whiteboard: [inbound] → [inbound][qa+]
(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #11)
> QA tracking, needs verification on Firefox 7 and 8 by checking crashstats.
No crashes from 7.0b3 and 8.0a2/20110830:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3AWebSocketChannel%3A%3AOnInputStreamReady%28nsIAsyncInputStream*%29
https://crash-stats.mozilla.com/report/list?signature=mozilla::net::WebSocketChannel::OnInputStreamReady
Adding verified-flags based on comment 12.
Whiteboard: [inbound][qa+] → [inbound]
You need to log in before you can comment on or make changes to this bug.