The default bug view has changed. See this FAQ.

crash [@ mozilla::net::WebSocketChannel::OnInputStreamReady]

VERIFIED FIXED in Firefox 7

Status

()

Core
Networking: WebSockets
--
critical
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: Martijn Wargers (dead), Assigned: mcmanus)

Tracking

({crash, verified-aurora, verified-beta})

Trunk
mozilla9
x86
Windows 7
crash, verified-aurora, verified-beta
Points:
---

Firefox Tracking Flags

(firefox7 fixed, firefox8 fixed)

Details

(Whiteboard: [inbound], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
This bug was filed from the Socorro interface and is 
report bp-b60f8316-99ec-4a39-99fa-fa5742110817 .
============================================================= 
0 	xul.dll 	mozilla::net::WebSocketChannel::OnInputStreamReady 	netwerk/protocol/websocket/WebSocketChannel.cpp:2416
1 	xul.dll 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:114
2 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
3 	xul.dll 	nsSocketTransportService::DoPollIteration 	netwerk/base/src/nsSocketTransportService2.cpp:770
4 	xul.dll 	nsSocketTransportService::Run 	netwerk/base/src/nsSocketTransportService2.cpp:638
5 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
6 	xul.dll 	nsRunnable::Release 	obj-firefox/xpcom/build/nsThreadUtils.cpp:55
7 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
8 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
9 	mozcrt19.dll 	_callthreadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:348
10 	mozcrt19.dll 	_threadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:326
11 	kernel32.dll 	BaseThreadInitThunk 	
12 	ntdll.dll 	__RtlUserThreadStart 	
13 	ntdll.dll 	_RtlUserThreadStart 	

While doing some testing with Websockets, I got this crash.
Sorry, I don't really have a testcase at hand.
(Reporter)

Updated

6 years ago
Component: General → Networking: WebSockets
Product: Firefox → Core
QA Contact: general → networking.websockets
Version: unspecified → Trunk
(Assignee)

Comment 1

6 years ago
crud. It appears that an input event was queued, the websocket channel socket closed down, and then the input event was run which deref'd the channel socket.

Easy enough to fix at least. After it lands we can figure out if it applies to aurora/beta (probly does).
(Assignee)

Comment 2

6 years ago
Created attachment 553876 [details] [diff] [review]
patch 1
Assignee: nobody → mcmanus
Status: NEW → ASSIGNED
Attachment #553876 - Flags: review?(jduell.mcbugs)

Comment 3

6 years ago
Try run for 14c2617c6cd7 is complete.
Detailed breakdown of the results available here:
    http://tbpl.mozilla.org/?tree=Try&rev=14c2617c6cd7
Results (out of 2 total builds):
    success: 2
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/mcmanus@ducksong.com-14c2617c6cd7
Attachment #553876 - Flags: review?(jduell.mcbugs) → review+
http://hg.mozilla.org/integration/mozilla-inbound/rev/cff7682167aa
Whiteboard: [inbound]
Comment on attachment 553876 [details] [diff] [review]
patch 1

one-line nullcheck avoids crashes, does no harm...
Attachment #553876 - Flags: approval-mozilla-beta?
Attachment #553876 - Flags: approval-mozilla-aurora?
Target Milestone: --- → mozilla9
http://hg.mozilla.org/mozilla-central/rev/cff7682167aa
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Comment 7

6 years ago
It is #26 top browser crasher in 7.0b1 and #31 in 8.0a2.
status-firefox7: --- → affected
status-firefox8: --- → affected

Updated

6 years ago
Attachment #553876 - Flags: approval-mozilla-beta?
Attachment #553876 - Flags: approval-mozilla-beta+
Attachment #553876 - Flags: approval-mozilla-aurora?
Attachment #553876 - Flags: approval-mozilla-aurora+

Comment 8

6 years ago
http://hg.mozilla.org/releases/mozilla-aurora/rev/c392c0bbee02
http://hg.mozilla.org/releases/mozilla-beta/rev/d0b794291f3d
status-firefox7: affected → fixed
status-firefox8: affected → fixed

Comment 9

6 years ago
Can anyone please help me with a test case, STR or guidelines I can use to verify this fix?

Thank you
(Reporter)

Comment 10

6 years ago
I can't reproduce it anymore, using: 9.0a1 (2011-08-29)
Status: RESOLVED → VERIFIED
Crash Signature: [@ mozilla::net::WebSocketChannel::OnInputStreamReady(nsIAsyncInputStream*)] → [@ mozilla::net::WebSocketChannel::OnInputStreamReady(nsIAsyncInputStream*)] [@ mozilla::net::WebSocketChannel::OnInputStreamReady ]
QA tracking, needs verification on Firefox 7 and 8 by checking crashstats.
Whiteboard: [inbound] → [inbound][qa+]

Comment 12

6 years ago
(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #11)
> QA tracking, needs verification on Firefox 7 and 8 by checking crashstats.
No crashes from 7.0b3 and 8.0a2/20110830:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Anet%3A%3AWebSocketChannel%3A%3AOnInputStreamReady%28nsIAsyncInputStream*%29
https://crash-stats.mozilla.com/report/list?signature=mozilla::net::WebSocketChannel::OnInputStreamReady
Adding verified-flags based on comment 12.
Keywords: verified-aurora, verified-beta
Whiteboard: [inbound][qa+] → [inbound]
You need to log in before you can comment on or make changes to this bug.