105507 - M095, Trunk Access violation, crash on saving a redirected link [@ nsStreamXferOp::OnStartRequest]

Status: VERIFIED FIXED

(Core Graveyard :: File Handling, defect, P1)

Description

[greer]

I was able to reproduce a crash with M095 on WindowsNT using some user comments.

     (36725554) URL: www.kde.apps or something like that
     (36725554) Comments: I tried to download a small rpm file called "lookout"

Steps to reproduce:
1) go to http://apps.kde.com (enter a search for 'lookout' in the search form,
that should get you where you need to be)
2) Click on "version 1.1"
3) Scroll to the download table
4) Click on the rpm download (bottom selection)
5) Save it to disk.
If you don't crash there,
6) repeat 4 & 5 and Click "yes" to overwrite. You should crash by now.

Note: If I simply click on the downlaod link I sometimes get a RealPlayer
interface in the table where the downloads were previously. If that happens
Shift + Click seems to crash it.

Here's the stack I got:

nsStreamXferOp::OnStartRequest
[d:\builds\seamonkey\mozilla\xpfe\components\xfer\src\nsStreamXferOp.cpp, line
289]
nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line
2291]
nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line
126]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]


Talkback is also showing this stack (depending on the Xfer):

         nsStreamXferOp::OnStartRequest
[d:\builds\seamonkey\mozilla\xpfe\components\xfer\src\nsStreamXferOp.cpp  line 289]
         nsFTPChannel::OnStartRequest  
[d:\builds\seamonkey\mozilla\netwerk\protocol\ftp\src\nsFTPChannel.cpp  line 637]
         nsOnStartRequestEvent0::HandleEvent   
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp  line 228]
         nsStreamListenerEvent0::HandlePLEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp  line 122]
         PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c 
line 591]
         PL_ProcessPendingEvents       
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
         _md_EventReceiverProc 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
         USER32.dll + 0x3c076 (0x77d7c076)
         USER32.dll + 0x3c076 (0x77d7c076)
         _except_handler3()
         kernel32.dll + 0x3bb86 (0x77e9bb86)        
nsStreamXferOp::OnStartRequest
[d:\builds\seamonkey\mozilla\xpfe\components\xfer\src\nsStreamXferOp.cpp  line 289]
         
Other comments:

M094 (14 incidents total):       
(36523422) Windows 98  4.10 build 67766446       i had right clicked on
"download pdf" and said "save to disk " selected a location  hit ok and let it
go to the background. I then hit back in my browser (taking me to
http://www.microchip.com/10/lit/pline/picmicro/families/16f87x/index.htm). I was
(36482349) Linux 2.4.9   trying to download an RPM from ftp.caldera.com
(36487045) Linux 2.4.0-4GB       trying to download slashdot2.0.0 src from
sourceforge (i think)
(36747788) Linux 2.4.9   attempting to save tar.gz file
M095 (20 incidents total):       
(36722903) Windows NT  5.0 build 2195    tried to download a textfile which was
not available anymore  i got the message that the location is not valid anymore
and i clicked on OK-> GPF
(36725554) Windows 98  4.90 build 73010104       I tried to download a small rpm
file called "lookout"
(36763664) Windows NT  5.0 build 2195    Trying to save an image.
Trunk (15 incidents total): 
(36484314) Windows NT  5.0 build 2195    saving a file to disk
(36576099) Windows NT  5.0 build 2195    shift-clicked a download link on mp3.com
(36819172) Windows 98  4.10 build 67766222       lotsa windows
(36833389) Windows NT  5.0 build 2195    I was saving a image from dvdtalk.com
(36700754) Linux 2.4.4-4GB       trying to download a file
(36748004) Linux 2.4.2-2         I was saving some jpeg images from a web
site.There seems to be some bad race condition.When I did shift-leftButton 
sometimes it would  properlysave the jpeg.  Sometimes it would save the html
page!I removed the files  and tried again.

Comment 1

[[e-mail] (gone - use [e-mail] instead)]

I have a 100% repro testcase ;-)

http://artists.mp3s.com/artists/284/delirious1.html

Under the song titled "America", context-click on Download (3.2MB) and choose
'Save link as'.

Comment 2

[sairuh (rarely reading bugmail)]

->law/file handling

Comment 3

[Jay Patel [:jay]]

*** Bug 107210 has been marked as a duplicate of this bug. ***

Comment 4

[Jay Patel [:jay]]

This crash has been happening consistently with every MozillaTrunk build since
this bug was reported...here are some more user comments and urls:

(37293905)
URL:
http://www.slunecnice.cz/redir.php3?x=qagare3eneezqa8a7aeagadwawnw3373ezqaqaqaqagaweaerewead
(37293905)
Comments: saving a redirected URL...
(37332002)
URL: www.limewire.org
(37332002)
Comments: strange limewire download-links... when just clicking them. the
browser would render a blank page  prompting an action for application/zip. on
save as.. it wouldnt open a file dialogue  though. on rightclicking and
selecting save as... and choosing a
(37332002)
Comments:  filename in the following dialogue  mozilla (0.9.5) crashed.
(37062663)
URL: www.mysql.com
(37062663)
Comments: Trying to download a file and the same filename  but with zero bytes
length  allready exist in my PC 
(37350641)
URL: http://www.chriscampbell.org/links.html
(37350641)
Comments: This URL is my home page.  The domain (hosted by gandi.net) is simply
a redirect to my real ISP account (www.mindspring.com/~c_campbell_2000/)In
Netscape 4.08  it normally just bounces over to the ISP.In Mozilla  I first get
a "302 Found" page 
     (37350641)	Comments:  perhaps very briefly  and then I get the ISP page.  This time  I
caught it (hit "Stop") so I could examine the page source -- I wanted to see if
gandi.net was using a META redirect (bad) instead of a http-redirect (good).On
the "302 Found" page  when
     (37350641)	Comments:  I went to View Source  it gave me a progress popup  then a
problem-communicating popup (I forget the exact words).  After I hit OK  it crashed.

Comment 5

[Peter Trudelle]

->097

Comment 6

[Peter Trudelle]

pulling back in to 096/P1, since this may be happening in Gecko too.

Comment 7

[Jay Patel [:jay]]

making a few changes to the summary.
sairuh:  please don't put anything inside the [] brackets in the summary..we use
that format for our Talkback reporting...anything extra inside the [] brackets
can  mess things up. thanks!

Comment 8

[Bill Law]

Attachment: Patch to handle redirections (and other error conditions) better.

Comment 9

[Paul Chen]

Comment on attachment 56277 [details] [diff] [review]
Patch to handle redirections (and other error conditions) better.

r=pchen

Comment 10

[Bradley Baetz (:bbaetz)]

*** Bug 107956 has been marked as a duplicate of this bug. ***

Comment 11

[David Hyatt]

sr=hyatt

Comment 12

[Bill Law]

fixed

Comment 13

[sairuh (rarely reading bugmail)]

vrfy fixed w/stephend's testcase, using commercial verif bits.

linux [rh6.2] - 2001.11.06.12
winNT - 2001.11.06.03
macOS 10.1 - 2001.11.06.08