720100 - crash [@ nsCOMPtr_base::~nsCOMPtr_base | nsSocketTransport::~nsSocketTransport ]

Status: RESOLVED WORKSFORME

(Core :: Networking, defect)

Description

[Christian Riechers]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0) Gecko/20100101 Firefox/10.0
Build ID: 20120118081945



Actual results:

Thunderbird 10b4 on Linux OpenSuSE 11.4
Crash Report [@ nsCOMPtr_base::~nsCOMPtr_base | nsSocketTransport::~nsSocketTransport ] 

ID: 57c1504e-349b-4baf-8d40-1af7c2120121
Signature: nsCOMPtr_base::~nsCOMPtr_base | nsSocketTransport::~nsSocketTransport

An infrequent crash for Thunderbird.

Comment 1

[Ludovic Hirlimann [:Usul]]

0 	libxul.so 	nsCOMPtr_base::~nsCOMPtr_base 	objdir-tb/mozilla/xpcom/build/nsCOMPtr.cpp:81
1 	libxul.so 	nsSocketTransport::~nsSocketTransport 	nsCOMPtr.h:522
2 	libxul.so 	nsSocketTransport::~nsSocketTransport 	netwerk/base/src/nsSocketTransport2.cpp:745
3 		@0x990eebdf 	
4 	libxul.so 	nsSocketTransport::Release 	netwerk/base/src/nsSocketTransport2.cpp:1687
5 	libxul.so 	nsSocketOutputStream::Release 	netwerk/base/src/nsSocketTransport2.cpp:533
6 	libxul.so 	nsCOMPtr_base::assign_assuming_AddRef 	
7 	libxul.so 	nsCOMPtr_base::assign_with_AddRef 	objdir-tb/mozilla/xpcom/build/nsCOMPtr.cpp:89
8 	libxul.so 	nsAStreamCopier::Process 	
9 	libxul.so 	nsAStreamCopier::Run 	xpcom/io/nsStreamUtils.cpp:435
10 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
11 	libxul.so 	NS_ProcessNextEvent_P 	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:245
12 	libxul.so 	nsSocketTransportService::Run 	netwerk/base/src/nsSocketTransportService2.cpp:639
13 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
14 	libxul.so 	NS_ProcessNextEvent_P 	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:245
15 	libxul.so 	nsThread::ThreadFunc 	xpcom/threads/nsThread.cpp:272
16 	libnspr4.so 	_pt_root 	nsprpub/pr/src/pthreads/ptthread.c:187
17 	libpthread-2.11.3.so 	libpthread-2.11.3.so@0x5b04 	
18 	libc-2.11.3.so 	libc-2.11.3.so@0xd3d5d

Comment 2

[Christian Riechers]

Another one with TB 22.0b1 on Linux openSUSE 12.3.
ID: bp-105812a4-391f-4e17-85f8-f388d2130601
Signature: nsCOMPtr_base::~nsCOMPtr_base | nsSocketTransport::~nsSocketTransport

Comment 3

[Wayne Mery (:wsmwk)]

Christian, have  you seen this crash signature (or any network signature) since 2013-06-01?

 nsSocketTransport::~nsSocketTransport() occurs on 24.x with similar stack 
Exploitability is High

bp-d37cf5a3-10c3-4d4c-b49d-9449c2140601 24.5.0
0	xul.dll	nsSocketTransport::~nsSocketTransport()	netwerk/base/src/nsSocketTransport2.cpp
1	xul.dll	nsSocketTransport::`scalar deleting destructor'(unsigned int)	
2	xul.dll	nsSocketTransport::Release()	netwerk/base/src/nsSocketTransport2.cpp
3	xul.dll	nsSocketInputStream::Release()	netwerk/base/src/nsSocketTransport2.cpp
4	xul.dll	nsCOMPtr_base::assign_with_AddRef(nsISupports *)	objdir-tb/mozilla/xpcom/build/nsCOMPtr.cpp
5	xul.dll	nsAStreamCopier::Process()	xpcom/io/nsStreamUtils.cpp
6	xul.dll	nsAStreamCopier::Run()	xpcom/io/nsStreamUtils.cpp
7	xul.dll	nsThread::ProcessNextEvent(bool,bool *)	xpcom/threads/nsThread.cpp
8	xul.dll	NS_ProcessNextEvent(nsIThread *,bool)	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp
9	xul.dll	nsSocketTransportService::Run()	netwerk/base/src/nsSocketTransportService2.cpp 

hg@1 712 nsSocketTransportService *serv = gSocketTransportService;
hg@1 713 NS_RELEASE(serv); // nulls argument
hg@1 714 } 

bp-46697f70-252e-4f01-91c5-316672140531

Comment 4

[Christian Riechers]

I haven't seen this crash recently. Closing the bug.