When we hit [1] (the multipart content has preamble and the first token is probed), we only update the cursor to the first token without updating |bufLen|, which will be incorrectly used to compute the data length of |SendData| in [2] if the first chunk from network doesn't contain the entire subresource. (if the first chunk contains all of the first subresource it would be fine since the callback length is not derived from bufLen.) [1] http://hg.mozilla.org/mozilla-central/file/727d765a5ed8/netwerk/streamconv/converters/nsMultiMixedConv.cpp#l666 [2] http://hg.mozilla.org/mozilla-central/file/727d765a5ed8/netwerk/streamconv/converters/nsMultiMixedConv.cpp#l825

Comment on attachment 8670635 [details] [diff] [review] Bug1212223.patch Hi Valentin, Could you please have a review of this patch? To prevent from any potential edge case, I add a couple of different chunks in the test case. Thanks!

Comment on attachment 8670635 [details] [diff] [review] Bug1212223.patch Review of attachment 8670635 [details] [diff] [review]: ----------------------------------------------------------------- Looks good. Nice catch.

Thank you Valentin :)