107945 - http 'Location: http://...' plus 'Content-type: text-plain' crashes Linux (others?)

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect)

Description

[John Morrison]

The continuous page load test, running under tinderbox on btek (Linux) started
crashing this afternoon sometime. [The logs claim that it was timing out, but
I grabbed a copy of the build and tried to run the test and it was crashing at
either the beginning or end of a test, when I do a HTTP redirect].

The headers for the redirect are something like:

HTTP/1.1 302 Found
Date: Wed, 31 Oct 2001 17:18:47 GMT
Server: Apache/1.3.12 (Unix)
Location: http://cowtools.mcom.com/page-loader/echo.pl?id=...,etc.,etc.
Connection: close
Content-Type: text/plain


After looking through the checkins (and taking a guess that the two late
afternoon successes were a fluke), I came to the checkin for bug 102737, which
changed the handling of "empty text/plain" documents, and thought, Hmmm, maybe
I should force that 'text/plain' to be 'text/html'.  That apparently fixed the
crash on btek. (Yay!)

You might want to back out that checkin as the above type of simple redirect
is fairly common. This may be causing quite a few crashes, but maybe I'm wrong,
and this isn't a widespread crash.

Testcase at http://cowtools/bugs/crash-redirect.html, which has a link to 
http://cowtools/page-loader/crash-redirect.pl and crashes about 3 out of 
4 tries on Linux (and one time it just hung). However, it doesn't seem to
crash my windows build (just finished now).

Comment 1

[Boris Zbarsky [:bzbarsky]]

This looks like a possible dup of bug 107994...  can we get a stack here?

Comment 2

[Andreas M. "Clarence" Schneider]

As I mentioned in bug 102737, this is caused by not calling nsScanner::Append().
A workaround is to call Append() with an empty string, but the actual bug must
be somewhere in the scanner.

Just a guess: In nsParser::Tokenize() nsScanner->RewindToMark() is called and
there mMarkPosition is probably undefinded (missing |if (mSlidingBuffer)|).

Comment 3

[Darin Fisher]

confirming... i'm seeing this too using the 2001103121 linux commercial bits.

Comment 4

[Andreas M. "Clarence" Schneider]

Filed bug 108067 and added a patch that fixes this without backing out
bug 102737.

Comment 5

[rpotts (gone)]

This is no longer an issue since the patch attached to bug #102737 (which caused
this regression) has been backed out.

Therefore i'm closing this bug out.

Comment 6

[benc]

->HTTP

Comment 7

[benc]

V/fixed, rpotts.

mozilla should own cowtools now, so if this were still a problem, there would be
lots of attention.