107355 - crash in ftp directory viewer accessing subdirectory

Status: VERIFIED FIXED

(Core Graveyard :: Networking: FTP, defect)

Description

[Leston Buell]

Mozilla consistently crashes on me when i do the following:

1. Go to <ftp://ftp.linux.ucla.edu/redhat>.
2. Click on "Up to higher level directory".
3. When parent directory has loaded, click on any subdirectroy, 
   such as "mandrake".

I couldn't reproduce the problem on another ftp server i tried.

Here's a TalkBack id: TB37344427H. I'll attach this presently.

I'm using Linux trunk build 2001-10-28-21.

Comment 1

[Leston Buell]

Attachment: talkback TB3734666W

Comment 2

[Andreas Otte]

The reason maybe my checkin to ftp urlparsing (bug 84242). I also saw a crash at
some point but was unable to reproduce it. Maybe the bugfix exposed (or
introduced) some uninitialized variable or something else. Who can help reading
the talkback report?

Comment 3

[Ashley Bischoff (blog at handcoding.com)]

WFM 2001102903 on Win2k. 

CC: [e-mail], for talkback retrieval, please (TB37344427H)

Comment 4

[[e-mail] (gone - use [e-mail] instead)]

Incident ID 37344427
Stack Signature libpthread.so.0 + 0x7c37 (0x401e3c37) c2976e09
Bug ID
Trigger Time 2001-10-29 07:18:54
Email Address
URL visited
User Comments Clicked on subdirectory in directory viewer.
Build ID 2001102821
Product ID MozillaTrunk
Platform ID LinuxIntel
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
libpthread.so.0 + 0x7c37 (0x401e3c37)
libc.so.6 + 0x7fd4d (0x40522d4d)
PR_Free()
nsMemoryImpl::Free()
nsMemory::Free()
Deallocate()
_._t20nsSharedBufferHandle1Zc
nsFtpState::~nsFtpState()
nsFtpState::Release()
nsFTPChannel::~nsFTPChannel()
nsFTPChannel::Release()
XPCJSRuntime::GCCallback()
DOMGCCallback()
js_GC()
js_ForceGC()
JS_GC()
nsJSContext::GC()
GlobalWindowImpl::SetNewDocument()
DocumentViewerImpl::Init()
nsDocShell::SetupNewViewer()
nsWebShell::SetupNewViewer()
nsDocShell::Embed()
nsWebShell::Embed()
nsDocShell::CreateContentViewer()
nsDSURIContentListener::DoContent()
nsDocumentOpenInfo::DispatchContent()
nsDocumentOpenInfo::OnStartRequest()
nsFTPChannel::OnStartRequest()
nsFTPDirListingConv::OnStartRequest()
nsStreamListenerTee::OnStartRequest()
DataRequestForwarder::DelayedOnStartRequest()
DataRequestForwarder::OnDataAvailable()
nsOnDataAvailableEvent::HandleEvent()
nsARequestObserverEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0x1001e (0x4037301e)
libglib-1.2.so.0 + 0x117f3 (0x403747f3)
libglib-1.2.so.0 + 0x11dd9 (0x40374dd9)
libglib-1.2.so.0 + 0x11f8c (0x40374f8c)
libgtk-1.2.so.0 + 0x94803 (0x40289803)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1c177 (0x404bf177) 

Comment 5

[sairuh (rarely reading bugmail)]

->bradley

Comment 6

[Bradley Baetz (:bbaetz)]

Got it - mPath.Adopt doesn't copy (and .Assign crashes..).

Doh!

Trying a fix now.

Comment 7

[Bradley Baetz (:bbaetz)]

Attachment: patch

Comment 8

[Doug Turner (:dougt)]

Comment on attachment 55616 [details] [diff] [review]
patch

fine

Comment 9

[Scott Collins]

Comment on attachment 55616 [details] [diff] [review]
patch

sr=scc

Comment 10

[Bradley Baetz (:bbaetz)]

checked in.

Comment 11

[Bradley Baetz (:bbaetz)]

*** Bug 107698 has been marked as a duplicate of this bug. ***

Comment 12

[benc]

VERIFIED: rc1, win98.