107089 - crash due to huge size passed to Alloc [@ nsMultiMixedConv::OnDataAvailable]

Status: RESOLVED INCOMPLETE

(Core :: Networking, defect)

Description

[rbs]

While surfing here and there with a tip of trunk, I crashed because
in OnDataAvailable(), the size of bufAmt was huge in the call of:
       rv = BufferData(cursor + (bufLen - bufAmt), bufAmt);

I am going to attach a graphical stack trace to illustrate the problem.
Maybe there are some code paths that cause these variable no to be initialized
properly.

Comment 1

[rbs]

Attachment: image - stack trace

Comment 2

[Darin Fisher]

rbs: what page were you visiting when this happened?  and on what day did you
pull mozilla?

Comment 3

[rbs]

The build was my own build - "a tip of the trunk" at the time I filed the bug
(2001-10-26).

Sorry, I have lost track of what I was doing. I remember at some stage to have
navigated between bugs in bugzilla, including the "most duplicates" which are
referenced at the bottom right of the bugzilla's font page. But I am afraid, I
can't remember if that was the last set of operations that I was doing. I
captured the whole stack screenshot in the hope that it might be of better help
in this context.

Comment 4

[Darin Fisher]

ok... well, i've not heard other reports of this problem. it might be possible
that something was wrong with your build, but that's likely just wishful
thinking ;-)  please let me know if you encounter this problem again.  thanks!

-> future, for now.

Comment 5

[rbs]

Maybe related to the just fixed bug 94734 and its duplicate bug 159619, but I am
not sure.

Comment 6

[WD]

Possibly related: bug 167784

Comment 7

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 8

[Darin Fisher]

-> default owner

Comment 9

[Jesse Ruderman on Windows]

If Darin couldn't figure it out, it's INCO.