The default bug view has changed. See this FAQ.

Race condition in async stream copier

RESOLVED FIXED in mozilla16

Status

()

Core
Networking
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: janv, Assigned: janv)

Tracking

unspecified
mozilla16
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
nsAsyncStreamCopier::AsyncCopy() calls NS_AsyncCopy()
The background thread can copy the stream so quickly that it calls the complete callback before NS_AsyncCopy() finishes.

So the main thread calls NS_AsyncCopy() and executes:
*aCopierCtx = static_cast<nsISupports*>(
              static_cast<nsIRunnable*>(copier));

context switch

The background thread finishes copying, calls nsAsyncStreamCopier::OnAsyncCopyComplete() and then nsAsyncStreamCopier::Complete()
which executes:
MutexAutoLock lock(mLock);
mCopierCtx = nsnull;

context switch

The main thread executes:
NS_ADDREF(*aCopierCtx);
which is now null


Testing a fix on try ...
(Assignee)

Comment 1

5 years ago
seems like there's a similar bug filed already, bug 559927
(Assignee)

Comment 2

5 years ago
Created attachment 631648 [details] [diff] [review]
fix
Assignee: nobody → Jan.Varga
Status: NEW → ASSIGNED
Attachment #631648 - Flags: review?(cbiesinger)
(Assignee)

Comment 3

5 years ago
the fix passed on try
(Assignee)

Comment 4

5 years ago
we need this to fix bug 762024
Attachment #631648 - Flags: review?(cbiesinger) → review+

Updated

5 years ago
Blocks: 762024
(Assignee)

Comment 5

5 years ago
http://hg.mozilla.org/mozilla-central/rev/72419c5d84df
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla16
(Assignee)

Updated

5 years ago
Duplicate of this bug: 559927
You need to log in before you can comment on or make changes to this bug.