91281 - Crash when loading this url

Status: RESOLVED DUPLICATE of bug 91197

(Core :: XPCOM, defect)

Description

[Marc Loiselle]

The page loads partially then mozilla exits with segmentation fault.

Crash happens evertime.
Build id 2001071806 on linux

Comment 1

[Chase Tingley]

Confirmed 2001071806 Linux.  I had to reload once before it crashed.

Comment 2

[Boris Zbarsky [:bzbarsky]]

OK...  I loaded the page fine with a 2001-07-17 cvs build.  Then hit reload...
watched the webshells get destroyed, then it crashed:

###!!! ASSERTION: trouble: no buffer!: 'buffer', file nsAFlatString.cpp, line 82

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (runnable)]
nsBufferHandle<char>::DataEnd (this=0x0) at ../../dist/include/nsBufferHandle.h:97
97            const CharT*  DataEnd() const                { return mDataEnd; }

#0  nsBufferHandle<char>::DataEnd (this=0x0) at
../../dist/include/nsBufferHandle.h:97
#1  0x4022c20a in nsAFlatCString::GetReadableFragment (this=0x8930970, 
    aFragment=@0xbffff038, aRequest=kLastFragment, aOffset=0) at
nsAFlatString.cpp:84
#2  0x4022f29b in nsACString::EndReading (this=0x8930970, aResult=@0xbffff038)
    at ../../dist/include/nsAString.h:700
#3  0x4022e75c in nsACString::do_AppendFromReadable (this=0xbffff144, 
    aReadable=@0x8930970) at nsAString.cpp:784
#4  0x4022e588 in nsACString::AppendFromReadable (this=0xbffff144,
aReadable=@0x8930970)
    at nsAString.cpp:750

(gdb) frame 0
#0  nsBufferHandle<char>::DataEnd (this=0x0) at
../../dist/include/nsBufferHandle.h:97
97            const CharT*  DataEnd() const                         { return
mDataEnd; }
(gdb) p mDataEnd
Cannot access memory at address 0x4

(gdb) frame 1
#1  0x4022c20a in nsAFlatCString::GetReadableFragment (this=0x8930970, 
    aFragment=@0xbffff038, aRequest=kLastFragment, aOffset=0) at
nsAFlatString.cpp:84
84                  aFragment.mEnd = buffer->DataEnd();
(gdb) p aFragment
$1 = (nsReadableFragment<char> &) @0xbffff038: {mStart = 0x0, mEnd = 0x0, 
  mFragmentIdentifier = 0x0}
(gdb) p buffer
$2 = (nsBufferHandle<char> *) 0x0

Over to strings....

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Full stack

Comment 4

[basic]

dup of bug 91197 ?

Comment 5

[Boris Zbarsky [:bzbarsky]]

So it is.  :)

*** This bug has been marked as a duplicate of 91197 ***