122792 - Mozilla crashes when logging into iTools in nsPluginHostImpl::PostURL

Status: VERIFIED DUPLICATE of bug 123791

(Core Graveyard :: Plug-ins, defect, P1)

Description

[Prachi Gauriar]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:0.9.8+)
Gecko/20020131
BuildID:    2002103103

When trying to log into Apple's iTools site (and thus load the iTools plugin),
Mozilla crashes.

Reproducible: Always
Steps to Reproduce:
1. Visit link above.
2. Try to log in with valid user name and password

Actual Results:  Mozilla crashes

Expected Results:  iTools page should load up, with the plugin working.

Here's the CrashReporter log:

Date/Time:  2002-01-31 10:43:16 -0600
OS Version: 10.1.2 (Build 5P48)
Host:       enigma

Command:    Mozilla
PID:        349

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x6aa82698

Thread 0 Crashed:
 #0   0x0054ca64 in SubBlock_construct
 #1   0x0054c834 in Block_subBlock
 #2   0x0054cf10 in allocate_from_var_pools
 #3   0x0054d674 in _pool_alloc
 #4   0x0054d990 in malloc
 #5   0x004fe2b0 in PR_Malloc
 #6   0x0060a9b0 in nsMemoryImpl::Alloc(unsigned long)
 #7   0x00628910 in nsMemory::Alloc(unsigned long)
 #8   0x0062ed48 in nsStr::Alloc(nsStr &, unsigned int)
 #9   0x0062ee88 in nsStr::Realloc(nsStr &, unsigned int)
 #10  0x0062bfec in nsStr::EnsureCapacity(nsStr &, unsigned int)
 #11  0x0062c0e4 in nsStr::GrowCapacity(nsStr &, unsigned int)
 #12  0x0062c338 in nsStr::StrAppend(nsStr &, nsStr const &, unsigned int, int)
 #13  0x006345dc in nsString::AppendWithConversion(char const *, int)
 #14  0x00634490 in nsString::AssignWithConversion(char const *)
 #15  0x02b594a4 in 0x2b594a4
 #16  0x0290a58c in PostURL__16nsPluginHostImplFP11nsISupportsPCcUiPCciPCcP23nsIPl
 #17  0x028fefd8 in posturlnotify
 #18  0x04360508 in 0x4360508
 #19  0x0435f5e8 in 0x435f5e8
 #20  0x0435e0b8 in 0x435e0b8
 #21  0x0435dae8 in 0x435dae8
 #22  0x0435cde0 in 0x435cde0
 #23  0x0435f9d0 in 0x435f9d0
 #24  0x043607b0 in 0x43607b0
 #25  0x028fbf2c in ns4xPluginStreamListener::CleanUpStream(short)
 #26  0x028fca74 in OnStopBinding__24ns4xPluginStreamListenerFP19nsIPluginStreamIn
 #27  0x02907f9c in OnStopRequest__26nsPluginStreamListenerPeerFP10nsIRequestP11ns
 #28  0x01ee5164 in OnStopRequest__19nsStreamListenerTeeFP10nsIRequestP11nsISuppor
 #29  0x01ef8cc4 in nsHttpChannel::OnStopRequest(nsIRequest *, nsISupports *,
unsigned int)
 #30  0x01eeb1f0 in nsOnStopRequestEvent::HandleEvent(void)
 #31  0x01eea600 in nsARequestObserverEvent::HandlePLEvent(PLEvent *)
 #32  0x005f62c0 in PL_HandleEvent
 #33  0x005f612c in PL_ProcessPendingEvents
 #34  0x0059c5cc in nsEventQueueImpl::ProcessPendingEvents(void)
 #35  0x020baa3c in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void)
 #36  0x020ba800 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &)
 #37  0x0210bb14 in Repeater::DoRepeaters(EventRecord const &)
 #38  0x020ce718 in nsMacMessagePump::DispatchEvent(int, EventRecord *)
 #39  0x020ce2f0 in nsMacMessagePump::DoMessagePump(void)
 #40  0x020cdc2c in nsAppShell::Run(void)
 #41  0x02082e3c in nsAppShellService::Run(void)
 #42  0x004c8ba4 in main1(int, char **, nsISupports *)
 #43  0x004c967c in main

Thread 1:
 #0   0x7000497c in syscall
 #1   0x70557600 in BSD_waitevent
 #2   0x70554b80 in CarbonSelectThreadFunc
 #3   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x705593ec in CarbonOperationThreadFunc
 #3   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x70283ea4 in TSWaitOnConditionTimedRelative
 #3   0x7027d748 in TSWaitOnSemaphoreCommon
 #4   0x702c2078 in TimerThread
 #5   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x70250ab0 in TSWaitOnCondition
 #3   0x7027d730 in TSWaitOnSemaphoreCommon
 #4   0x70243d14 in AsyncFileThread
 #5   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7055b884 in CarbonInetOperThreadFunc
 #3   0x7002054c in _pthread_body

PPC Thread State:
  srr0: 0x0054ca64 srr1: 0x0000f030                vrsave: 0x00000000
   xer: 0x00000020   lr: 0x0054cb18  ctr: 0x0054d970   mq: 0x00000000
    r0: 0x666f6df6   r1: 0xbfffe150   r2: 0x000e9000   r3: 0x0438b8a8
    r4: 0x666f6df0   r5: 0x093c2f52   r6: 0x00000001   r7: 0x00000001
    r8: 0x00000000   r9: 0x00000000  r10: 0x00000000  r11: 0x80003710
   r12: 0x000ea9a0  r13: 0x00000000  r14: 0x00000000  r15: 0x00000000
   r16: 0x00000000  r17: 0x00000000  r18: 0x0437c1d0  r19: 0x02cd438c
   r20: 0x001119f0  r21: 0x0427fd72  r22: 0x00111b78  r23: 0x02d49c8c
   r24: 0x02d4b3c0  r25: 0x0438b798  r26: 0x00000110  r27: 0x093c2f52
   r28: 0x0438b8a8  r29: 0x666f6f00  r30: 0x00000001  r31: 0x00000000

**********

Comment 1

[shrirang khanzode]

*** Bug 122801 has been marked as a duplicate of this bug. ***

Comment 2

[Simon Fraser [no longer active]]

CC some plugins people.

Comment 3

[Peter Lubczynski]

The crash could possibly related to Serge's recent checkin for
NPN_PostURL[Notify] in bug 115308.

Note: There is also bug 117349 about not being able to log into iTools too, but
I think this crash is new.

Comment 4

[serge (gone)]

hmm, memory corruption...
is this OS X only?

Comment 5

[Chris Petersen]

I tried this under Mac OS 9.2.2 with the Jan 30th build (2002-01-30-08). Logging
in the iTools account doesn't seem to function. After typing in
username/password and clicking enter button , the url address isn't loading. The
throbber continues to animate but page doesn't load.

Comment 6

[Peter Lubczynski]

This is only on OSX Carbon builds. Mine just finished but I neglected the fact
that this bug needs PSM in order to reproduce. I'm rebuilding with that flag
enabled now.

Comment 7

[Peter Lubczynski]

It crashes here:

2233 nsresult rv = mContext->GetContainer(getter_AddRefs(container));
2234 NS_ENSURE_TRUE(container,NS_ERROR_FAILURE);
2235 nsCOMPtr<nsILinkHandler> lh = do_QueryInterface(container);
2236 NS_ENSURE_TRUE(lh, NS_ERROR_FAILURE);
2237
2238 nsAutoString uniurl; uniurl.AssignWithConversion(aURL);  <-------------
2239 nsAutoString unitarget; unitarget.AssignWithConversion(aTarget);
2240 nsAutoString fullurl;
2241
2242 nsCOMPtr<nsIURI> baseURL;
2243 nsCOMPtr<nsIDocument> doc;
2244 rv = GetDocument(getter_AddRefs(doc));
2245 if (NS_SUCCEEDED(rv) && doc) {

But I'm not quite sure why. aURL looks okay in the debugger.

Comment 8

[Peter Lubczynski]

There might be some currption happening with the nsIStringInputStream as I saw
that destructor in one of the crash stacks. Still trying to track it down....

Comment 9

[serge (gone)]

Peter, I would mark it as a dup of #123791,
I'm 99% present sure the cause is the same.

Comment 10

[Peter Lubczynski]

Yup, the patch from bug 123791 fixes the crash. Thanks Serge!

*** This bug has been marked as a duplicate of 123791 ***

Comment 11

[Peter Lubczynski]

*** Bug 117349 has been marked as a duplicate of this bug. ***

Comment 12

[shrirang khanzode]

verif dup, also verified that I can now log onto itools site without a crash,
used 0225 trunk on OS X.