Closed Bug 1179154 Opened 9 years ago Closed 9 years ago

crash XMLHttpRequest with empty host and alert

Categories

(Core :: Networking, defect)

38 Branch
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1166133
Tracking Status
firefox38.0.5 --- wontfix
firefox39 --- affected
firefox40 --- fixed
firefox41 --- fixed
firefox42 --- fixed
firefox-esr31 --- unaffected
firefox-esr38 40+ affected

People

(Reporter: millions.of.stones, Unassigned)

References

Details

(4 keywords)

Crash Data

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
Build ID: 20150525141253

Steps to reproduce:

<html><head></head><body>
    <button id="die">crashme</button>
    <script>
    document.getElementById("die").onclick = function () {
        var xmlhttp = new XMLHttpRequest();
        xmlhttp.open('POST', 'https://:2340/cmd', true);
        xmlhttp.onreadystatechange = function() {
            alert("you are already dead\n" + XMLHttpRequest.responseText);
        }
        xmlhttp.setRequestHeader('Content-type', 'application/json');
        xmlhttp.send(JSON.stringify({something: 'nothing'}));
        return false;
    };
    </script>
</body></html>


Actual results:

This crashes on both Win7 x64 firefox 38.0.5 and Mint x64 Firefox 38.0
I can reproduce on 38,

https://crash-stats.mozilla.com/report/index/da48b94f-b949-4794-97d1-2c1702150702
Severity: normal → critical
Status: UNCONFIRMED → NEW
Crash Signature: [ @ nsCORSListenerProxy::OnStartRequest(nsIRequest*, nsISupports*) ]
Component: Untriaged → Networking
Ever confirmed: true
Product: Firefox → Core
This seems to have been fixed in the Firefox 40 cycle.

This means it's fixed in current versions of Firefox Nightly (https://nightly.mozilla.org/ ) and developer edition (https://aurora.mozilla.org/ ) and it will soon be fixed in Firefox beta ( https://beta.mozilla.org/ -- not yet, but the fix should be there sometime the next week)

Olli, can you help me figure out if it's worth finding what exactly fixed this and trying to see if we can fix it on 39 (.0.1) or something like this? Looking at the stack I am a little uneasy, but maybe that is just paranoia...

(asking you because of the onStopRequest crash you fixed in the 38 cycle -- should this bug be in Core::DOM instead of networking?)
Flags: needinfo?(bugs)
[Tracking Requested - why for this release]: ESR38 crashes, but ESR31 does not crash. Regression
Alice, do you by any chance has also the un-regression range?


The regression range hints this is a necko issue.
Flags: needinfo?(bugs)
Depends on: 1166133
Flags: needinfo?(dd.mozilla)
The patch from bug 1166133 will solve the problem.
Flags: needinfo?(dd.mozilla)
(In reply to Dragana Damjanovic [:dragana] from comment #7)
> The patch from bug 1166133 will solve the problem.

So, it will uplift to ESR38?
I am asking for a uplift
Tracking because already fixed in 40, 41, 42. Regression with a fix.
bug 1166133 was minused for 38, so there isn't anything left to do here, I think.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
(In reply to :Gijs Kruitbosch from comment #11)
> bug 1166133 was minused for 38, so there isn't anything left to do here, I
> think.

In fact, this is probably more correct.
Resolution: FIXED → DUPLICATE
You need to log in before you can comment on or make changes to this bug.