102936 - crashes on redirect Trunk [@nsHttpChannel::ProcessResponse]

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Crashes at nsHttpChannel::ProcessResponse started with build 2001-10-01-21 and
continued in build 2001-10-02-06.  A number of user comments mention redirects.

 nsHttpChannel::ProcessResponse	[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 486]
	 nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 2266]
	 nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 126]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 457]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1307]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1624]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1642]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x17d08 (0x77e97d08)

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Related to the fix for bug 94004?

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Talkback shows the crash is because mCacheEntry is null on line 485. 
(GetTransport should be at offset 0x38 in the vtable.):

6084aec1 8b08             mov     ecx,[eax]              <=== CRASH HERE, eax=0
6084aec3 ff5138           call    dword ptr [ecx+0x38]
6084aec6 8bd8             mov     ebx,eax
6084aec8 f7c300000080     test    ebx,0x80000000
6084aece 7522             jnz     6084aef2

Comment 3

[neeti]

darin

Comment 4

[Darin Fisher]

i c the problem.. patch-in-hand

Comment 5

[Darin Fisher]

Attachment: v1.0 should fix the problem

Comment 6

[Darin Fisher]

this crash corresponds to a cacheable redirect sent with 'cache-control: no-store'

the patch simply adds a null check for mCacheEntry... when working on bug 94004,
i forgot that InitCacheEntry could succeed without there actually being a cache
entry.

Comment 7

[Gagan]

Comment on attachment 51907 [details] [diff] [review]
v1.0 should fix the problem

r=gagan

Comment 8

[Scott MacGregor]

Comment on attachment 51907 [details] [diff] [review]
v1.0 should fix the problem

sr=mscott

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 51907 [details] [diff] [review]
v1.0 should fix the problem

a=dbaron

Comment 10

[Darin Fisher]

fixed-on-trunk

Comment 11

[Christian Reis]

*** Bug 103026 has been marked as a duplicate of this bug. ***

Comment 12

[Matthias Versen [:Matti]]

*** Bug 103105 has been marked as a duplicate of this bug. ***

Comment 13

[Darin Fisher]

*** Bug 103075 has been marked as a duplicate of this bug. ***

Comment 14

[Boris Zbarsky [:bzbarsky]]

*** Bug 103191 has been marked as a duplicate of this bug. ***

Comment 15

[Boris Zbarsky [:bzbarsky]]

*** Bug 103100 has been marked as a duplicate of this bug. ***

Comment 16

[Asa Dotzler [:asa]]

*** Bug 103131 has been marked as a duplicate of this bug. ***

Comment 17

[Matthias Versen [:Matti]]

*** Bug 103525 has been marked as a duplicate of this bug. ***

Comment 18

[Tom Everingham]

verified - not showing up in talkback anymore

Comment 19

[Ashley Bischoff (blog at handcoding.com)]

*** Bug 110654 has been marked as a duplicate of this bug. ***