210119 - Browser crashes when opening URL

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Robert La Ferla]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030620
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030620

Nightly build 2003062004 browser crashes when opening this url:
 
http://realtytimes.com/rtnews/rtapages/20020426_realist.htm


Reproducible: Always

Steps to Reproduce:
1. Open http://realtytimes.com/rtnews/rtapages/20020426_realist.htm
2.
3.

Actual Results:  
Crash


Expected Results:  
Opened page.

Comment 1

[Matthias Versen [:Matti]]

confirming with a 1 day old win2k build

AddNullTerminator(nsStr & {...}) line 350
nsStrPrivate::EnsureCapacity(nsStr & {...}, unsigned int 4294967294) line 127 +
6 bytes
nsStrPrivate::GrowCapacity(nsStr & {...}, unsigned int 4294967294) line 153 + 10
bytes
nsCString::SetCapacity(nsCString * const 0x00000000, unsigned int 4294967294)
line 174 + 10 bytes
nsString::SetLength(nsString * const 0x00000000, unsigned int 4294967294) line 172
nsACString::UncheckedAssignFromReadable(nsACString * const 0x00000000, const
nsACString & {...}) line 793
nsACString::do_AssignFromReadable(nsACString * const 0x00000000, const
nsACString & {...}) line 763
nsHttpHeaderArray::SetHeader(nsHttpHeaderArray * const 0x00000000, nsHttpAtom
{...}, const nsACString & {...}, int 1) line 53 + 35 bytes
nsHttpHeaderArray::ParseHeaderLine(nsHttpHeaderArray * const 0x00000000, char *
0x01229a6c `string', nsHttpAtom * 0x0174fdf0, char * * 0x0174fdfc) line 181
nsHttpResponseHead::ParseHeaderLine(nsHttpResponseHead * const 0x00000000, char
* 0x02196829) line 192
nsHttpTransaction::ParseLine(nsHttpTransaction * const 0x00000000, char *
0x02196820) line 552 + 5 bytes
nsHttpTransaction::ParseLineSegment(nsHttpTransaction * const 0x00000000, char *
0x02345070, unsigned int 17) line 568
nsHttpTransaction::ParseHead(nsHttpTransaction * const 0x00000000, char *
0x02344f0c, unsigned int 376, unsigned int * 0x0174fe68) line 651
nsHttpTransaction::ProcessData(nsHttpTransaction * const 0x00000000, char *
0x02344f0c, unsigned int 376, unsigned int * 0x00000176) line 834
nsHttpTransaction::WritePipeSegment(nsIOutputStream * 0x026d133c, void *
0x022446f0, char * 0x02344f0c, unsigned int 0, unsigned int 4096, unsigned int *
0x0174fea8) line 403 + 13 bytes
nsPipeOutputStream::WriteSegments(nsPipeOutputStream * const 0x02344f0c,
unsigned int (nsIOutputStream *, void *, char *, unsigned int, unsigned int,
unsigned int *)* 0x0120d3da nsHttpTransaction::WritePipeSegment(nsIOutputStream
*, void *, char *, unsigned int, unsigned int, unsigned int *), void *
0x022446f0, unsigned int 4096, unsigned int * 0x00001000) line 1062
nsHttpTransaction::WriteSegments(nsHttpTransaction * const 0x00000000,
nsAHttpSegmentWriter * 0x0273a814, unsigned int 4096, unsigned int * 0x0174fef4)
line 421 + 26 bytes
nsHttpConnection::OnSocketReadable(nsHttpConnection * const 0x00000000) line 619
nsHttpConnection::OnInputStreamReady(nsHttpConnection * const 0x0273a818,
nsIAsyncInputStream * 0x023d55ac) line 717
nsSocketInputStream::OnSocketReady(nsSocketInputStream * const 0x00000000,
unsigned int 18993848) line 188
NECKO! const  nsHttpConnection::`vftable'{for `nsAHttpSegmentWriter'} address
0x0121d2c8
nsHttpConnection::`scalar deleting destructor'(nsHttpConnection * const
0x00000000, unsigned int 18931679) address 0x0120ad8b
nsHttpTransaction::QueryInterface() address 0x0120dfd5
f18b5600()

Comment 2

[Ronald Tilby]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030617
This is WFM on Windows 2000 using 2003061708 nightly.  Is this a regression
since 6/17?

Comment 3

[Darin Fisher]

probably a regression from my patch for bug 208845.

Comment 4

[Mats Palmgren (inactive)]

Bug also occurs in 2003-06-20-08 trunk Linux    (Talkback: TB21221032H)

Comment 5

[Darin Fisher]

Attachment: v1 patch

site sends the header "Pragma:	\r\n"... net_RFindCharNotInSet didn't have
proper bounds checks for searching an empty string.  the patch is pretty
straightforward.

Comment 6

[Darin Fisher]

*** Bug 210334 has been marked as a duplicate of this bug. ***

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 126270 [details] [diff] [review]
v1 patch

sr=bzbarsky

Comment 8

[Darin Fisher]

*** Bug 210111 has been marked as a duplicate of this bug. ***

Comment 9

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 126270 [details] [diff] [review]
v1 patch

r=caillon

Comment 10

[Darin Fisher]

fixed-on-trunk

Comment 11

[Olivier Cahagne]

*** Bug 210495 has been marked as a duplicate of this bug. ***

Comment 12

[hub-san]

This bug probably was related to bug 209979.

Comment 13

[Olivier Cahagne]

*** Bug 210296 has been marked as a duplicate of this bug. ***

Comment 14

[Erik]

*** Bug 210455 has been marked as a duplicate of this bug. ***

Comment 15

[Erik]

*** Bug 210047 has been marked as a duplicate of this bug. ***