126311 - subsequent file downloads and helper app access result in crash

Status: VERIFIED DUPLICATE of bug 73308

(Core Graveyard :: File Handling, defect)

Description

[sairuh (rarely reading bugmail)]

found using 2002.02.18 comm bits on win2k, linux rh7.2 and mac 10.1.2.

1. go to the above url, which has some nice tests for downloading via http and ftp.
2. click on a link to download --either ftp or http:-- save it to disk.
3. when that's done, dismiss progress dlg [if needed], then click on another
link to download.

results: app will crash.

unfortunately, while this is reproducible, my trace info varies...

linux talkback #3074262:

libc.so.6 + 0x80e9f (0x40541e9f)
libc.so.6 + 0x80bf4 (0x40541bf4)
PR_Free()
nsMemoryImpl::Free()
nsMemory::Free()
nsCStringKey::~nsCStringKey()
DeleteBFSEntry()
_hashEnumerateRemove__FP11PLHashEntryiPv()
PL_HashTableEnumerateEntries()
nsHashtable::Reset()
nsObjectHashtable::Reset()
nsObjectHashtable::~nsObjectHashtable()
nsStreamConverterService::FindConverter()
nsStreamConverterService::AsyncConvertData()
nsDocumentOpenInfo::RetargetOutput()
nsDocumentOpenInfo::DispatchContent()
nsDocumentOpenInfo::OnStartRequest()
nsHttpChannel::ProcessNormal()
nsHttpChannel::ProcessResponse()
nsHttpChannel::OnStartRequest()
nsOnStartRequestEvent::HandleEvent()
nsARequestObserverEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0xff9e (0x40394f9e)
libglib-1.2.so.0 + 0x11773 (0x40396773)
libglib-1.2.so.0 + 0x11d39 (0x40396d39)
libglib-1.2.so.0 + 0x11eec (0x40396eec)
libgtk-1.2.so.0 + 0x94333 (0x402b2333)
nsAppShell::Run()
nsAppShellService::Run()
netscape-bin + 0x7e89 (0x0804fe89)
netscape-bin + 0x86d7 (0x080506d7)
libc.so.6 + 0x1c507 (0x404dd507) 

linux talkback #3074065:

DeleteBFSEntry()
_hashEnumerateRemove__FP11PLHashEntryiPv()
PL_HashTableEnumerateEntries()
nsHashtable::Reset()
nsObjectHashtable::Reset()
nsObjectHashtable::~nsObjectHashtable()
nsStreamConverterService::FindConverter()
nsStreamConverterService::AsyncConvertData()
nsDocumentOpenInfo::RetargetOutput()
nsDocumentOpenInfo::DispatchContent()
nsDocumentOpenInfo::OnStartRequest()
nsFTPChannel::OnStartRequest()
DataRequestForwarder::DelayedOnStartRequest()
DataRequestForwarder::OnStopRequest()
nsOnStopRequestEvent::HandleEvent()
nsARequestObserverEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0xff9e (0x40394f9e)
libglib-1.2.so.0 + 0x11773 (0x40396773)
libglib-1.2.so.0 + 0x11d39 (0x40396d39)
libglib-1.2.so.0 + 0x11eec (0x40396eec)
libgtk-1.2.so.0 + 0x94333 (0x402b2333)
nsAppShell::Run()
nsAppShellService::Run()
netscape-bin + 0x7e89 (0x0804fe89)
netscape-bin + 0x86d7 (0x080506d7)
libc.so.6 + 0x1c507 (0x404dd507)

Comment 1

[sairuh (rarely reading bugmail)]

...and here are some mac os x crash reports:

Date/Time:  2002-02-18 16:51:17 -0800
OS Version: 10.1.2 (Build 5P48)

Command:    Netscape 6
PID:        312

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xfffffff0

Thread 0 Crashed:
 #0   0x0054d414 in allocate_from_fixed_pools
 #1   0x000ee384 in 0xee384
 #2   0x0054d66c in _pool_alloc
 #3   0x0054d990 in malloc
 #4   0x0054dae0 in nw(unsigned long, std::nothrow_t const &)
 #5   0x0054db44 in nw(unsigned long)
 #6   0x020c0d0c in DependentAtomKey::Clone( const(void))
 #7   0x0057a040 in nsHashtable::Put(nsHashKey *, void *)
 #8   0x020c14a0 in AppendRuleToTable__8RuleHashFR11nsHashtableP7nsIAtomP15nsICSSS
 #9   0x020c1828 in RuleHash::AppendRule(nsICSSStyleRule *)
 #10  0x020cc71c in BuildHashEnum(nsISupports *, void *)
 #11  0x0057efa4 in nsSupportsArray::EnumerateBackwards(int (*)(nsISupports *,
void *), void *)
 #12  0x020ccf88 in CSSRuleProcessor::GetRuleCascade(nsIPresContext *, nsIAtom *)
 #13  0x020cc41c in RulesMatching__16CSSRuleProcessorFP23PseudoRuleProcessorDataP7
 #14  0x020661cc in EnumPseudoRulesMatching(nsISupports *, void *)
 #15  0x0057eed4 in nsSupportsArray::EnumerateForwards(int (*)(nsISupports *,
void *), void *)
 #16  0x02065b4c in FileRules__12StyleSetImplFPFP11nsISupportsPv_iP17RuleProcessor
 #17  0x02066314 in ResolvePseudoStyleFor__12StyleSetImplFP14nsIPresContextP10nsIC
 #18  0x02878648 in ResolvePseudoStyleWithComparator__13nsPresContextFP10nsIConten
 #19  0x02878510 in ResolvePseudoStyleContextFor__13nsPresContextFP10nsIContentP7n
 #20  0x0294ea30 in 0x294ea30
 #21  0x0206706c in ConstructRootFrame__12StyleSetImplFP14nsIPresContextP10nsICont
 #22  0x028815f4 in 0x28815f4
 #23  0x022cd458 in nsXULDocument::StartLayout(void)
 #24  0x022d3434 in nsXULDocument::ResumeWalk(void)
 #25  0x022d85e4 in nsXULDocument::CachedChromeStreamListener::OnStopRequest( ( *))
 #26  0x02010fd8 in OnStopRequest__18nsDocumentOpenInfoFP10nsIRequestP11nsISupport
 #27  0x01f1a270 in nsCachedChromeChannel::HandleStopLoadEvent(PLEvent *)
 #28  0x005f5e20 in PL_HandleEvent
 #29  0x005f5c8c in PL_ProcessPendingEvents
 #30  0x0059af6c in nsEventQueueImpl::ProcessPendingEvents(void)
 #31  0x0059b014 in nsEventQueueImpl::ProcessPendingEvents(void)
 #32  0x0059b014 in nsEventQueueImpl::ProcessPendingEvents(void)
 #33  0x0059b014 in nsEventQueueImpl::ProcessPendingEvents(void)
 #34  0x0059b014 in nsEventQueueImpl::ProcessPendingEvents(void)
 #35  0x0059b014 in nsEventQueueImpl::ProcessPendingEvents(void)
 #36  0x025bcabc in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void)
 #37  0x025bc880 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &)
 #38  0x02605b14 in Repeater::DoRepeaters(EventRecord const &)
 #39  0x025d0938 in nsMacMessagePump::DispatchEvent(int, EventRecord *)
 #40  0x025d0510 in nsMacMessagePump::DoMessagePump(void)
 #41  0x025cfe8c in nsAppShell::Run(void)
 #42  0x02584d4c in nsAppShellService::Run(void)
 #43  0x004c8ba4 in main1(int, char **, nsISupports *)
 #44  0x004c967c in main

Thread 1:
 #0   0x7000497c in syscall
 #1   0x70557600 in BSD_waitevent
 #2   0x70554b80 in CarbonSelectThreadFunc
 #3   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x705593ec in CarbonOperationThreadFunc
 #3   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x70283ea4 in TSWaitOnConditionTimedRelative
 #3   0x7027d748 in TSWaitOnSemaphoreCommon
 #4   0x702c2078 in TimerThread
 #5   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x70250ab0 in TSWaitOnCondition
 #3   0x7027d730 in TSWaitOnSemaphoreCommon
 #4   0x70243d14 in AsyncFileThread
 #5   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7055b884 in CarbonInetOperThreadFunc
 #3   0x7002054c in _pthread_body

Thread 6:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body

PPC Thread State:
  srr0: 0x0054d414 srr1: 0x0000f030                vrsave: 0x00000000
   xer: 0x20000008   lr: 0x0054d66c  ctr: 0x0054db30   mq: 0x00000000
    r0: 0xffffffec   r1: 0xbfffe440   r2: 0x000e9000   r3: 0x03a40d60
    r4: 0x0000000c   r5: 0xffffffec   r6: 0x9e370000   r7: 0x00000001
    r8: 0xbfffe66c   r9: 0x00000001  r10: 0x00653b78  r11: 0x00653b68
   r12: 0x000ea9c8  r13: 0x00000000  r14: 0x00000000  r15: 0x00000000
   r16: 0x00000000  r17: 0x00000000  r18: 0x00000000  r19: 0x00000000
   r20: 0x00000000  r21: 0x02a528d8  r22: 0x02aec518  r23: 0x04161d20
   r24: 0x03d82980  r25: 0x03d82980  r26: 0x00558454  r27: 0x00000004
   r28: 0x000ee384  r29: 0x040c0ad0  r30: 0x000ee390  r31: 0x00000001

**********

Date/Time:  2002-02-18 16:54:25 -0800
OS Version: 10.1.2 (Build 5P48)

Command:    Netscape 6
PID:        318

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
 #0   0x00653940 in 0x653940
 #1   0x005bf480 in XPTC_InvokeByIndex
 #2   0x01c8459c in 0x1c8459c
 #3   0x01c8ac54 in XPC_WN_GetterSetter(JSContext *, JSObject *, unsigned int,
long *, long *)
 #4   0x01c065ec in js_Invoke
 #5   0x01c06890 in js_InternalInvoke
 #6   0x01c1a5a8 in js_GetProperty
 #7   0x01c0d50c in 0x1c0d50c
 #8   0x01c06ae0 in js_Execute
 #9   0x01be79bc in JS_EvaluateUCScriptForPrincipals
 #10  0x026fb028 in nsJSContext::EvaluateString(nsAString const &, void *,
nsIPrincipal *, char const *)
 #11  0x0270f764 in GlobalWindowImpl::RunTimeout(nsTimeoutImpl *)
 #12  0x02710200 in GlobalWindowImpl::TimerCallback(nsITimer *, void *)
 #13  0x0062b4f0 in nsTimerImpl::Process(void)
 #14  0x0062b5b4 in handleMyEvent(MyEventType *)
 #15  0x005f5e20 in PL_HandleEvent
 #16  0x005f5c8c in PL_ProcessPendingEvents
 #17  0x0059af6c in nsEventQueueImpl::ProcessPendingEvents(void)
 #18  0x025bcabc in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void)
 #19  0x025bc880 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &)
 #20  0x02605b14 in Repeater::DoRepeaters(EventRecord const &)
 #21  0x025d0938 in nsMacMessagePump::DispatchEvent(int, EventRecord *)
 #22  0x025d0510 in nsMacMessagePump::DoMessagePump(void)
 #23  0x025cfe8c in nsAppShell::Run(void)
 #24  0x02584d4c in nsAppShellService::Run(void)
 #25  0x004c8ba4 in main1(int, char **, nsISupports *)
 #26  0x004c967c in main

Thread 1:
 #0   0x7000497c in syscall
 #1   0x70557600 in BSD_waitevent
 #2   0x70554b80 in CarbonSelectThreadFunc
 #3   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x705593ec in CarbonOperationThreadFunc
 #3   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x70283ea4 in TSWaitOnConditionTimedRelative
 #3   0x7027d748 in TSWaitOnSemaphoreCommon
 #4   0x702c2078 in TimerThread
 #5   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x70250ab0 in TSWaitOnCondition
 #3   0x7027d730 in TSWaitOnSemaphoreCommon
 #4   0x70243d14 in AsyncFileThread
 #5   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7055b884 in CarbonInetOperThreadFunc
 #3   0x7002054c in _pthread_body

Thread 6:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body

Thread 7:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x70283ea4 in TSWaitOnConditionTimedRelative
 #4   0x70270138 in MPWaitOnQueue
 #5   0x70777cd8 in TNodeSyncTask::SyncTaskProc(void *)
 #6   0x702831a8 in PrivateMPEntryPoint
 #7   0x7002054c in _pthread_body

PPC Thread State:
  srr0: 0x00653940 srr1: 0x0000f030                vrsave: 0x00000000
   xer: 0x00000018   lr: 0x005bf58c  ctr: 0x005bf470   mq: 0x00000000
    r0: 0xbfffe8a0   r1: 0xbfffe6e0   r2: 0x00101000   r3: 0x02bb9db0
    r4: 0xbfffe8a0   r5: 0xbfffe790   r6: 0x00040003   r7: 0x70241f98
    r8: 0x70252a10   r9: 0x00000000  r10: 0x7fffffff  r11: 0x02376e58
   r12: 0x00000000  r13: 0x01d92d20  r14: 0x02bb9db0  r15: 0x00000004
   r16: 0x01dce550  r17: 0x00000000  r18: 0x00000001  r19: 0x00000001
   r20: 0xbfffea48  r21: 0xbfffe8a0  r22: 0x00000000  r23: 0x00000000
   r24: 0xbfffe8a0  r25: 0x00000000  r26: 0x00000000  r27: 0x00000001
   r28: 0x02b26060  r29: 0x00000012  r30: 0x03b2116c  r31: 0xbfffe700

Comment 2

[sairuh (rarely reading bugmail)]

here's a talkback for win2k for the most recent time this crash occurred for me,
talkback #3074915:

0xffffffff
nsXPCComponents::GetInterfaces
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpccomponents.cpp, line 1579]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2000]
XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1299]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 834]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 925]
js_GetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2451]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2635]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 850]
nsXPCWrappedJSClass::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 1203]
nsXPCWrappedJS::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 430]
PrepareAndDispatch
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 117]
SharedStub
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 139]
nsComponentManagerImpl::CreateInstanceByContractID
[d:\builds\seamonkey\mozilla\xpcom\components\nsComponentManager.cpp, line 1861]
nsComponentManager::CreateInstance
[d:\builds\seamonkey\mozilla\xpcom\components\nsComponentManagerObsolete.cpp,
line 115]
nsCreateInstanceByContractID::operator()
[d:\builds\seamonkey\mozilla\xpcom\components\nsComponentManager.cpp, line 152]
nsCOMPtr_base::assign_from_helper
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 81]
nsExternalAppHandler::OnStartRequest
[d:\builds\seamonkey\mozilla\uriloader\exthandler\nsExternalHelperAppService.cpp,
line 1039]
nsDocumentOpenInfo::OnStartRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 229]
nsHttpChannel::ProcessNormal
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 586]
nsHttpChannel::ProcessResponse
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 556]
nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2458]
nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 162]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
SETUPAPI.DLL + 0x30c24 (0x778b0c24) 

Comment 3

[Olivier Cahagne]

*** Bug 126382 has been marked as a duplicate of this bug. ***

Comment 4

[Olivier Cahagne]

*** Bug 126402 has been marked as a duplicate of this bug. ***

Comment 5

[Bradley Baetz (:bbaetz)]

*** Bug 126441 has been marked as a duplicate of this bug. ***

Comment 6

[sairuh (rarely reading bugmail)]

looking at linux commercial bits, this regressed sometime btwn the 2002.02.17.21
[works fine] and 2002.02.18.06 [broken] builds.

Comment 7

[Boris Zbarsky [:bzbarsky]]

http://bonsai.mozilla.org/cvsquery.cgi?module=MozillaTinderboxAll&date=explicit&mindate=1014004020&maxdate=1014055000
-- checkins in that range

Comment 8

[Bill Law]

I was getting an assertion (followed by a crash if I proceeded on), in 
nsStreamConverterService (approximately the same call stacks as in the first 
two reports in this bug).

I backed out the changes that were made there (for bug 73308) and the problem 
went away.

I don't know about the Mac call stack discrepancy.  Maybe this results in 
random memory getting stomped so the problem may not crop up till later.

Can somebody else try backing off those changes and seeing if it solves the 
problem for them (especially on Linux).

Here's the script to apply (in mozilla/netwerk/streamconv/src:
  cvs up -j 1.14 -j 1.13 nsStreamConverterService.h
  cvs up -j 1.53 -j 1.52 nsStreamConverterService.cpp

Comment 9

[Peter Trudelle]

nsbeta1+ per Nav triage team, cc badami to back out his checkin.

Comment 10

[Bill Law]

Brian Rynder replicated what I saw on his Linux build.  The problem goes away 
after backing out the patch for bug 73308.

Reassigning to Vinay Badami.

Comment 11

[R.K.Aa.]

possible dup: bug 126448
also: people on irc now observe crashes on second launch of helper apps like
xmms (for mpegurls) etc. Same bug?

Comment 12

[Bill Law]

I think second launch of helper apps is basically the same scenario (only 
difference is that the downloaded file doesn't get renamed/copied at the end).  
Bug 126448 could be the same thing.

Comment 13

[Bradley Baetz (:bbaetz)]

*** Bug 126741 has been marked as a duplicate of this bug. ***

Comment 14

[sairuh (rarely reading bugmail)]

*** Bug 126448 has been marked as a duplicate of this bug. ***

Comment 15

[sairuh (rarely reading bugmail)]

i agree with rkaa and bill, so i dup'd bug 126448 and clarified summary here.

Comment 16

[sairuh (rarely reading bugmail)]

...and tested with 2002.02.21.0x comm bits: can no longer repro this problem.
shall i mark this fixed or wfm?

Comment 17

[zeekiorage]

Once if the download dialog-box has been dismissed the subsequent attepmts to 
click on the download URL or attempts to close the browser window result in a 
crash.


Correct Steps to reporduce the bug.
1. Browse to any site.
2. Find a link to download some file like .zip or .exe or other downloadable 
files.
3. Click on a link to download the file.
4. When you get the save dialog select 'Cancel' from it.
5a. Close the browser window. (Results in crash)
OR
5b. Click on the download link again. (Results in crash)

Comment 18

[Vinay Badami]

*** This bug has been marked as a duplicate of 73308 ***

Comment 19

[Olivier Cahagne]

*** Bug 127482 has been marked as a duplicate of this bug. ***

Comment 20

[sairuh (rarely reading bugmail)]

vrfy dup