80928 - about:pics crashes the browser - Trunk [@ nsDocShell::DoURILoad]

Status: VERIFIED WORKSFORME

(Core :: Networking, defect)

Description

[ckritzer (gone)]

Ooooookay.  So on a whim, I typed 'about:pics' into the URL field, hit 
ENTER and the build crashed without so much as a wimper.  Weirdness.

Mitch, I think this might be yours [technically], but I'm not 100% sure.  As 
usually, if any of your IMF team be caught or...

Oh, sorry, wrong line.

Uh, if I got the component wrong, please correct.  Thanks!

Comment 1

[ckritzer (gone)]

Whoops! 

The builds I used to test were:
-MacOS91 2001-05-14-04-trunk
-Win98SE 2001-05-14-06-trunk
-LinRH62 2001-05-14-05-trunk

And no, I didn't use any of those builds to file this bug... ;-)

Comment 2

[ckritzer (gone)]

Okay, it looks like about:license also crashes the browser.  I'm going to 
see if I can dig up the old 'about:*' list from 4.x and see if all the about: urls 
which don't exist in the current browser behave this way...

Comment 3

[ckritzer (gone)]

Wow.  Even about:ckritzer crashes it.

Well, since it's so reproducible, I'll add a talkback report when I can get at 
the server.

Comment 4

[Boris Zbarsky [:bzbarsky]]

This is a networking bug:

#0  0x40da8500 in nsDocShell::DoURILoad (this=0x84f0938, aURI=0x861bd90, 
    aReferrerURI=0x0, aOwner=0x84dd308, aLoadCmd=0, aPostData=0x0, aHeadersData=0x0)
    at nsDocShell.cpp:3913
#1  0x40da7c74 in nsDocShell::InternalLoad (this=0x84f0938, aURI=0x861bd90, 
    aReferrer=0x0, aOwner=0x0, aInheritOwner=1, aStopActiveDoc=0, 
    aWindowTarget=0xbfffd3fc, aPostData=0x0, aHeadersData=0x0, aLoadType=1,
aSHEntry=0x0)
    at nsDocShell.cpp:3816
#2  0x40d9792a in nsDocShell::LoadURI (this=0x84f0938, aURI=0x861bd90,
aLoadInfo=0x0, 
    aLoadFlags=0) at nsDocShell.cpp:529
#3  0x40d9f393 in nsDocShell::LoadURI (this=0x84f0938, aURI=0x861a868, aLoadFlags=0)
    at nsDocShell.cpp:1978
#4  0x4013ea65 in XPTC_InvokeByIndex (that=0x84f0948, methodIndex=8, paramCount=2, 
    params=0xbfffd85c) at xptcinvoke_unixish_x86.cpp:138

(gdb) frame 0
#0  0x40da8500 in nsDocShell::DoURILoad (this=0x84f0938, aURI=0x861bd90, 
    aReferrerURI=0x0, aOwner=0x84dd308, aLoadCmd=0, aPostData=0x0, aHeadersData=0x0)
    at nsDocShell.cpp:3913
3913        channel->SetOriginalURI(aURI);
(gdb) p channel
$2 = {mRawPtr = 0x0}

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: full stack

Comment 6

[Boris Zbarsky [:bzbarsky]]

perhaps we should check for success of the NS_OpenURI?

Comment 7

[Alexey Chernyak]

Win2K 2001051504
Talkback ID: TB30475990Q

Comment 8

[Boris Zbarsky [:bzbarsky]]

*** Bug 80984 has been marked as a duplicate of this bug. ***

Comment 9

[Jay Patel [:jay]]

This crash *was* showing up in Talkback topcrash reports in large numbers 
(under the docshell.dll and nsDocShell::DoURILoad stack signatures)...but the 
latest entries show this crashing with build 2001051710. adding topcrash keyword 
and Trunk [@ nsDocShell::DoURILoad] for tracking.  

If any new crashes show up in Talkback, I will update the bug.  Has anyone been 
able to reproduce this crash with recent builds? It might have been fixed 
recently.

Comment 10

[benc]

mass move, v2.
qa to me.

Comment 11

[Jaime Rodriguez, Jr.]

CKritzer - Are you able to reproduce this in the current builds?

Comment 12

[ckritzer (gone)]

Jaime: Nope.  Not today, apparently.

Comment 13

[ckritzer (gone)]

Marking VERIFIED FIXED on:
-MacOS91 2001-05-23-08-trunk
-Win98SE 2001-05-23-09-trunk
-LinRH62 2001-05-23-08-trunk