134793 - URL: hang when [ is in scheme

Status: VERIFIED FIXED

(Core :: Networking, defect, P1)

Description

[Scott]

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:0.9.9+)
Gecko/20020401
BuildID: 2002040103

Basically, you put [/] into the URL bar, press enter, sit back and watch.

I don't know why this happens... I'm assuming it's just a random weird bug. 
Also, I found it in 0.9.9, and only got this nightly to be sure it was still
there, so it's not something extremely new.

Reproducible: Always
Steps to Reproduce:
1. [/] in URL bar
2. <ENTER>
3. *thud*

Actual Results:  Mozilla stopped responding.

Expected Results:  Random error message.

Comment 1

[Andrew Schultz]

worksforme with linux build 20020401 (and 0.9.9).  For me it pulls up file:///

severity->critical.
are you crashing (browser dies) or hanging (browser locks up)?

Have you tried a clean profile (not that it should make any difference, but
sometimes it does).

Comment 2

[Matthias Versen [:Matti]]

wfm in win2k build 20020330..

Reporter: 
Can you please add a talkback ID fro that crash ?
(Use a talkback enabled build and after talkback submitted the crash run
mozilla/components/talkback to get the ID)

Comment 3

[Scott]

On closer inspection, it appears that it is more hanging than crashing.  The CPU
usage for mozilla goes up to 99% and stays there (I waited five minutes before
ending the process manually).  Also, the drop-down URL menu pops up right before
it freezes, and after minimizing and maximizing, that area is blank and hasn't
been redrawn.

Anyway, I'm going to go get a talkback build now... I'll post the talkback stuff
as soon as I get it.

Comment 4

[Scott]

Ok, talkback doesn't catch this... but the crash reporter in windowsxp
wanted to send something.  This is what I salvaged from its error log.  I'm not
sure if any of it will be useful, but here it is anyway:

Server=watson.microsoft.com
UI LCID=1033
Flags=33552
Brand=WINDOWS
TitleName=mozilla.exe
DigPidRegPath=HKLM\Software\Microsoft\Windows NT\CurrentVersion\DigitalProductId
RegSubPath=Microsoft\PCHealth\ErrorReporting\DW
ErrorText=The program is not responding.
HeaderText=You chose to end the nonresponsive program, mozilla.exe.
EventLogSource=Application Hang
Stage1URL=/StageOne/mozilla_exe/0_0_0_0/xpcom_dll/0_0_0_0/0003f787.htm
Stage2URL=/dw/stagetwo.asp?szAppName=mozilla.exe&szAppVer=0.0.0.0&szModName=xpcom.dll&szModVer=0.0.0.0&offset=0003f787
DataFiles=C:\DOCUME~1\default\LOCALS~1\Temp\WER33.tmp.dir00\mozilla.exe.mdmp|C:\DOCUME~1\default\LOCALS~1\Temp\WER33.tmp.dir00\appcompat.txt
ErrorSubPath=mozilla.exe\0.0.0.0\xpcom.dll\0.0.0.0\0003f787

Comment 5

[Paul Wyskoczka]

qa --> [e-mail]

Comment 6

[Scott]

Actually, after more testing, it only takes the [ bracket to do it.  The stuff
that follows doesn't seem to have any effect.

Comment 7

[R.B.]

I see this on Linux 2002032806. Complete hang after entering a lone [ in URL bar
and pressing Return. Unlike most other hangs, I couldn't even activate other
windows, and had to go to another virtual console. Moz was using 100% CPU, and
had to be killed. Very unpleasant.

Comment 8

[Matthias Versen [:Matti]]

Sorry i were stupid !
i tested only "/" and i can confirm the hang with win2k build 20020401..

I get an assertion loop :
###!!! ASSERTION: Infinite loop: can't advance (backward) a reading iterator bey
ond the end of a string: 'one_hop<0', file ../../dist/include/string\nsStringIte
rator.h, line 187

stack trace for that assertion:
NTDLL! 778a018c()
nsDebug::Assertion(const char * 0x1010bc34 `string', const char * 0x1010bc9c 
`string', const char * 0x1010b96c `string', int 187) line 291 + 13 bytes
nsReadingIterator<char>::advance(int -1) line 187 + 31 bytes
IsASCII(const nsACString & {...}) line 355 + 26 bytes
nsStandardURL::GetAsciiHost(nsStandardURL * const 0x03ae3658, nsACString & 
{...}) line 959 + 19 bytes
nsStandardURL::HostsAreEquivalent(nsStandardURL * 0x03ae3658) line 645
nsStandardURL::Equals(nsStandardURL * const 0x03b58458, nsIURI * 0x03ae3658, int 
* 0x0012b8b0) line 1449 + 196 bytes
XPTC_InvokeByIndex(nsISupports * 0x03b58458, unsigned int 22, unsigned int 2, 
nsXPTCVariant * 0x0012b8a0) line 106
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
CALL_METHOD) line 2025 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x017b00e0, JSObject * 0x03acefc0, unsigned int 1, 
long * 0x03dc3360, long * 0x0012bb7c) line 1266 + 14 bytes
js_Invoke(JSContext * 0x017b00e0, unsigned int 1, unsigned int 0) line 788 + 23 
bytes
js_Interpret(JSContext * 0x017b00e0, long * 0x0012c9bc) line 2745 + 15 bytes
js_Invoke(JSContext * 0x017b00e0, unsigned int 2, unsigned int 2) line 805 + 13 
bytes
fun_apply(JSContext * 0x017b00e0, JSObject * 0x03acf3c8, unsigned int 2, long * 
0x03dc31f0, long * 0x0012cb34) line 1552 + 15 bytes
js_Invoke(JSContext * 0x017b00e0, unsigned int 2, unsigned int 0) line 788 + 23 
bytes
js_Interpret(JSContext * 0x017b00e0, long * 0x0012d974) line 2745 + 15 bytes
js_Invoke(JSContext * 0x017b00e0, unsigned int 1, unsigned int 2) line 805 + 13 
bytes
js_InternalInvoke(JSContext * 0x017b00e0, JSObject * 0x03acf3c8, long 61663520, 
unsigned int 0, unsigned int 1, long * 0x0012dbcc, long * 0x0012da9c) line 880 + 
20 bytes
JS_CallFunctionValue(JSContext * 0x017b00e0, JSObject * 0x03acf3c8, long 
61663520, unsigned int 1, long * 0x0012dbcc, long * 0x0012da9c) line 3412 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x017b9850, void * 0x03acf3c8, 
void * 0x03ace920, unsigned int 1, void * 0x0012dbcc, int * 0x0012dbd0, int 0) 
line 1016 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x03ba6520, nsIDOMEvent 
* 0x03bab108) line 180 + 77 bytes
nsXBLPrototypeHandler::ExecuteHandler(nsXBLPrototypeHandler * const 0x03a41240, 
nsIDOMEventReceiver * 0x01765bb0, nsIDOMEvent * 0x03bab108) line 447
DoKey(nsIAtom * 0x017b1940, nsIXBLPrototypeHandler * 0x03a41240, nsIDOMEvent * 
0x03bab108, nsIDOMEventReceiver * 0x01765bb0) line 108
nsXBLKeyHandler::KeyPress(nsXBLKeyHandler * const 0x03a41c20, nsIDOMEvent * 
0x03bab108) line 123 + 40 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x0177f238, 
nsIPresContext * 0x017e1208, nsEvent * 0x0012f900, nsIDOMEvent * * 0x0012f2c8, 
nsIDOMEventTarget * 0x01765bb0, unsigned int 4, nsEventStatus * 0x0012f74c) line 
1648 + 41 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01765ba8, nsIPresContext * 
0x017e1208, nsEvent * 0x0012f900, nsIDOMEvent * * 0x0012f2c8, unsigned int 4, 
nsEventStatus * 0x0012f74c) line 3461
nsXULElement::HandleDOMEvent(nsXULElement * const 0x03b0c8d0, nsIPresContext * 
0x017e1208, nsEvent * 0x0012f900, nsIDOMEvent * * 0x0012f2c8, unsigned int 4, 
nsEventStatus * 0x0012f74c) line 3442
nsXULElement::HandleDOMEvent(nsXULElement * const 0x03a57bc8, nsIPresContext * 
0x017e1208, nsEvent * 0x0012f900, nsIDOMEvent * * 0x0012f2c8, unsigned int 4, 
nsEventStatus * 0x0012f74c) line 3442
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x03a57eb0, 
nsIPresContext * 0x017e1208, nsEvent * 0x0012f900, nsIDOMEvent * * 0x0012f2c8, 
unsigned int 1, nsEventStatus * 0x0012f74c) line 1630
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x03a57eb0, 
nsIPresContext * 0x017e1208, nsEvent * 0x0012f900, nsIDOMEvent * * 0x00000000, 
unsigned int 1, nsEventStatus * 0x0012f74c) line 1381 + 29 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f900, nsIView * 0x017ba5c0, 
unsigned int 1, nsEventStatus * 0x0012f74c) line 6078 + 44 bytes
PresShell::HandleEvent(PresShell * const 0x0179f204, nsIView * 0x017ba5c0, 
nsGUIEvent * 0x0012f900, nsEventStatus * 0x0012f74c, int 1, int & 1) line 6001 + 
25 bytes
nsViewManager::HandleEvent(nsView * 0x017ba5c0, nsGUIEvent * 0x0012f900, int 0) 
line 2018
nsView::HandleEvent(nsViewManager * 0x017ba380, nsGUIEvent * 0x0012f900, int 0) 
line 306
nsViewManager::DispatchEvent(nsViewManager * const 0x017ba380, nsGUIEvent * 
0x0012f900, nsEventStatus * 0x0012f870) line 1869 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f900) line 83
nsWindow::DispatchEvent(nsWindow * const 0x017ba65c, nsGUIEvent * 0x0012f900, 
nsEventStatus & nsEventStatus_eIgnore) line 865 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f900) line 886
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 13, 
long 0) line 2658 + 15 bytes
nsWindow::OnChar(unsigned int 13, unsigned int 13, unsigned char 1) line 2809
nsWindow::ProcessMessage(unsigned int 258, unsigned int 13, long 1835009, long * 
0x0012fd20) line 3441 + 52 bytes
nsWindow::WindowProc(HWND__ * 0x001a026a, unsigned int 258, unsigned int 13, 
long 1835009) line 1130 + 27 bytes
USER32! 77e02e98()
USER32! 77e030e0()
USER32! 77e05824()
nsAppShellService::Run(nsAppShellService * const 0x01686390) line 309
main1(int 2, char * * 0x004430b0, nsISupports * 0x00000000) line 1418 + 32 bytes
main(int 2, char * * 0x004430b0) line 1766 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87d08()

-> Networking

Comment 9

[Darin Fisher]

-> me

Comment 10

[Andrew Schultz]

*** Bug 136601 has been marked as a duplicate of this bug. ***

Comment 11

[Darin Fisher]

-> badami for investigation.

Comment 12

[Darin Fisher]

mass move of bugs assigned to vinay to me

Comment 13

[Darin Fisher]

Attachment: v1 patch

simple patch... now upon typing "[/]" into the URL bar, the user will get an
error that says "www.[.com" could not be found.

Comment 14

[Gagan]

Comment on attachment 83767 [details] [diff] [review]
v1 patch

r=gagan

Comment 15

[rpotts (gone)]

Comment on attachment 83767 [details] [diff] [review]
v1 patch

sr=[e-mail]

Comment 16

[rpotts (gone)]

darin,
what is the bracket notation used for in the hostname?  is it for numeric IP
addresses?  if so, should we verify/force everything within [...] to resolve to
a numeric IP?

-- rick

Comment 17

[Darin Fisher]

it's for numeric IPv6 addresses which can contain colons.  forcing everything
between the []'s to be a valid address would require more work.  it might be
good to do that at some point, but for now, i'd prefer to just be more liberal
in what we accept.  let DNS figure it out ;-)

Comment 18

[Darin Fisher]

fixed-on-trunk

Comment 19

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 83767 [details] [diff] [review]
v1 patch

a=[e-mail] for branch checkin.	Please checkin ASAP

Comment 20

[scottputterman]

adding adt1.0.0+.  Please checkin to the 1.0 branch and add the fixed1.0.0 keyword.

Comment 21

[Darin Fisher]

fixed-on-branch

Comment 22

[Darin Fisher]

fixed-on-branch

Comment 23

[Christine Wozniak]

Adding custrtm-; no impact on customization.

Comment 24

[benc]

Attachment: testcase in link

click to test

Comment 25

[benc]

VERIFIED trunk + branch:
(Netscape 6.2.3 (094 branch) did not have this, so it was probably a late .099
problem...)

Mozilla 1.1b and commercial 2002-08-13-1.0 (Win 98)

Both systems teat "[" as valid hostname and search for it, no abnormal behavior.
This behavior might be another case for filtering invalid DNS characters before
calling the system resolver (bug 140379).

Interestsingly, 6.2.3 treated it as an invalid character, escaped it, then sent
it to DNS as escaped value (which is also probably an invalid DNS hostname.