29477 - crash while processing redirect

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[Dan Mosedale (:dmosedale, :dmose)]

Build from the tip of Sunday, Feb 27 at around 7:30 PM.

--enable-x11-shm
--enable-optimize
--disable-debug
CFLAGS="-g -pipe"
CXXFLAGS="-g -pipe"

Stack trace follows; the URLs for the redirect are contained therein...

(gdb) where full
#0  nsHTTPChannel::Redirect (this=0x8a23038, 
    aNewLocation=0x8828e50
"ftp://ftp.adobe.com/pub/adobe/acrobatreader/unix/4.x/", aResult=0xbffff684)
    at /home/dmose/s/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp:1299
	httpChannel = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}
	rv = 0
	newURI = {<nsCOMPtr_base> = {mRawPtr = 0x8a09e00}, <No data fields>}
	channel = {<nsCOMPtr_base> = {mRawPtr = 0x8852218}, <No data fields>}
	serv = {<nsCOMPtr_base> = {mRawPtr = 0x8144bc8}, <No data fields>}
	newref = {mBuf = 0x0, mBufOwner = 1, 
  _vptr. = 0x4011a9b4 <nsXPIDLCString virtual table>}
	newurl = {<nsCOMPtr_base> = {mRawPtr = 0x8a09e00}, <No data fields>}
	securityManager = {<nsCOMPtr_base> = {
    mRawPtr = 0x8208740}, <No data fields>}
	referrer = {
  mBuf = 0x87fd1d8 "http://freshmeat.net/appindex/1998/12/17/913939507.html", 
  mBufOwner = 1, _vptr. = 0x4011a9b4 <nsXPIDLCString virtual table>}
#1  0x4049de06 in nsHTTPChannel::ProcessRedirection (this=0x8a23038, 
    aStatusCode=302)
    at /home/dmose/s/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp:1838
	channel = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}
	aStatusCode = 1
	rv = 0
---Type <return> to continue, or q <return> to quit---
	location = {
  mBuf = 0x8828e50 "ftp://ftp.adobe.com/pub/adobe/acrobatreader/unix/4.x/", 
  mBufOwner = 1, _vptr. = 0x4011a9b4 <nsXPIDLCString virtual table>}
#2  0x4049dc87 in nsHTTPChannel::ProcessStatusCode (this=0x8a23038)
    at /home/dmose/s/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp:1760
	rv = 0
	statusCode = 302
	statusClass = 0
	pEngine = (nsAuthEngine *) 0x850b16c
	listener = {<nsCOMPtr_base> = {mRawPtr = 0x890fe40}, <No data fields>}
#3  0x4049d996 in nsHTTPChannel::FinishedResponseHeaders (this=0x8a23038)
    at /home/dmose/s/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp:1650
	this = (nsHTTPChannel *) 0x8a23038
	rv = 0
#4  0x4049fbb4 in nsHTTPResponseListener::FinishedResponseHeaders (
    this=0x87fcac0)
    at
/home/dmose/s/mozilla/netwerk/protocol/http/src/nsHTTPResponseListener.cpp:515
	this = (nsHTTPResponseListener *) 0x87fcac0
	rv = 0
#5  0x4049f689 in nsHTTPResponseListener::OnDataAvailable (this=0x87fcac0, 
    channel=0x8808e94, context=0x8a23038, i_pStream=0x88fc740, 
    i_SourceOffset=0, i_Length=211)
---Type <return> to continue, or q <return> to quit---
    at
/home/dmose/s/mozilla/netwerk/protocol/http/src/nsHTTPResponseListener.cpp:163
	i_Length = 0
	rv = 0
	actualBytesRead = 2
	bufferInStream = {<nsCOMPtr_base> = {
    mRawPtr = 0x88fc740}, <No data fields>}
#6  0x4044fa03 in nsOnDataAvailableEvent::HandleEvent (this=0x415015b0)
    at /home/dmose/s/mozilla/netwerk/base/src/nsAsyncStreamListener.cpp:373
	this = (nsOnDataAvailableEvent *) 0x0
#7  0x4044f340 in nsStreamListenerEvent::HandlePLEvent (aEvent=0x415015d8)
    at /home/dmose/s/mozilla/netwerk/base/src/nsAsyncStreamListener.cpp:97
	ev = (nsStreamListenerEvent *) 0x415015b0
	rv = 0
#8  0x40100373 in PL_HandleEvent (self=0x415015d8)
    at /home/dmose/s/mozilla/xpcom/threads/plevent.c:526
	self = (PLEvent *) 0x415015d8
	result = (void *) 0x81443e8
#9  0x40100303 in PL_ProcessPendingEvents (self=0x81443e8)
    at /home/dmose/s/mozilla/xpcom/threads/plevent.c:487
	event = (PLEvent *) 0x0
	self = (PLEventQueue *) 0x81443e8
	count = 5
---Type <return> to continue, or q <return> to quit---
#10 0x40100ed8 in nsEventQueueImpl::ProcessPendingEvents (this=0x81443c0)
    at /home/dmose/s/mozilla/xpcom/threads/nsEventQueue.cpp:298
	this = (nsEventQueueImpl *) 0x81443c0
	correctThread = 0
#11 0x41309daf in event_processor_callback (data=0x81443c0, source=9, 
    condition=GDK_INPUT_READ)
    at /home/dmose/s/mozilla/widget/src/gtk/nsAppShell.cpp:141
	data = 0x0
#12 0x41309b7d in our_gdk_io_invoke (source=0x822bc68, condition=G_IO_IN, 
    data=0x8207db8) at /home/dmose/s/mozilla/widget/src/gtk/nsAppShell.cpp:54
	data = 0x8207db8
#13 0x408cc52a in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0
No symbol table info available.
#14 0x408cdbe6 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
No symbol table info available.
#15 0x408ce1a1 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
No symbol table info available.
#16 0x408ce341 in g_main_run () from /usr/lib/libglib-1.2.so.0
No symbol table info available.
#17 0x407f65f9 in gtk_main () from /usr/lib/libgtk-1.2.so.0
No symbol table info available.
#18 0x4130a26a in nsAppShell::Run (this=0x8151948)
    at /home/dmose/s/mozilla/widget/src/gtk/nsAppShell.cpp:304
---Type <return> to continue, or q <return> to quit---
	this = (nsAppShell *) 0x8151948
#19 0x40fa7092 in nsAppShellService::Run (this=0x81441c0)
    at /home/dmose/s/mozilla/xpfe/appshell/src/nsAppShellService.cpp:399
	this = (nsAppShellService *) 0x0
#20 0x804b0ec in main1 (argc=1, argv=0xbffffa74, splashScreen=0x0)
    at /home/dmose/s/mozilla/xpfe/bootstrap/nsAppRunner.cpp:763
	rv = 0
	needAutoreg = 0
	cmdLineArgs = {<nsCOMPtr_base> = {
    mRawPtr = 0x8144060}, <No data fields>}
	appShell = {<nsCOMPtr_base> = {mRawPtr = 0x81441c0}, <No data fields>}
	profileMgr = {<nsCOMPtr_base> = {
    mRawPtr = 0x81e8670}, <No data fields>}
	currentProfileStr = {mBuf = 0x81f4ca0 "mozProfile", mBufOwner = 1, 
  _vptr. = 0x4011a9b4 <nsXPIDLCString virtual table>}
	expired = 0
	timeBomb = {<nsCOMPtr_base> = {mRawPtr = 0x81f4fa0}, <No data fields>}
	walletService = {<nsCOMPtr_base> = {
    mRawPtr = 0x822ba20}, <No data fields>}
#21 0x804b41c in main (argc=1, argv=0xbffffa74)
    at /home/dmose/s/mozilla/xpfe/bootstrap/nsAppRunner.cpp:883
	rv = 0
	splash = (nsISplashScreen *) 0x0
---Type <return> to continue, or q <return> to quit---
	dosplash = 0
	result = 134545248
	clipService = {<nsCOMPtr_base> = {
    mRawPtr = 0x401e17e0}, <No data fields>}
(gdb)

Comment 1

[Warren Harris]

I see http://freshmeat.net/appindex/1998/12/17/913939507.html and
ftp://ftp.adobe.com/pub/adobe/acrobatreader/unix/4.x/

Dan: Can you give us better steps to reproduce this?

Comment 2

[Dan Mosedale (:dmosedale, :dmose)]

* Go to the first URL (the freshmeat.net one).  
* Halfway down the page, there is a link to the labeled with the name of the 
second URL (the adobe.com one).
* Click the second link.
* Boom.

Note that although the second link is labeled with the text
"ftp://ftp.adobe.com/pub/adobe/acrobatreader/unix/4.x/" the HREF is actually 
http://apps.freshmeat.net/download/913939507/ which is a redirect to the
adobe.com URL.

Comment 3

[leger]

Putting on PDT+ for beta1.  Hot.  We would hold beta for this.  Please supply an 
ETA for fix date in Status Whiteboard.

Comment 4

[Norris Boyd]

Attachment: proposed patch

Comment 5

[Norris Boyd]

In the code below, "channel" ends up being a ftp channel rather than a http 
channel. 

      nsCOMPtr<nsIHTTPChannel> httpChannel = do_QueryInterface(channel);
      httpChannel->SetRequestHeader(nsHTTPAtoms::Referer, referrer);

adding a simple check appears to fix the problem--the ftp page is loaded.

Can someone review my patch?

Comment 6

[Gagan]

the referrer is added in http channel. if we are reaching as far as norris 
suggests we are, then something messed up early on... 

Comment 7

[Gagan]

updating eta...

Comment 8

[Gagan]

norris: I have checked in the patch on your behalf. thanks. 

Comment 9

[Kathleen :Brade]

With the commercial Mac bits from this afternoon, I went to the page in the url 
field above and found the link labeled ftp://ftp.adobe.com/pub/adobe/
acrobatreader/unix/4.x/.  Mousing over the link shows the url dmose included 
(http://apps.freshmeat.net/download/913939507/).  Clicking on this link took me 
to that url which is a list of a bunch of compressed files (and text files).  I 
did not crash.

Comment 10

[Dan Mosedale (:dmosedale, :dmose)]

Works for me, too. 

Comment 11

[Tom Everingham]

verified:
Linux 2000030913
NT 2000030909
Mac 2000030910