Closed Bug 1737485 Opened 3 years ago Closed 2 years ago

In a debug build, displaying the second news message crashes on MOZ_DIAGNOSTIC_ASSERT(!(channelLoadFlags & nsIChannel::LOAD_REPLACE));

Categories

(MailNews Core :: Networking: NNTP, defect)

defect

Tracking

(thunderbird_esr91 wontfix, thunderbird_esr102 fixed, thunderbird102 affected)

RESOLVED FIXED
103 Branch
Tracking Status
thunderbird_esr91 --- wontfix
thunderbird_esr102 --- fixed
thunderbird102 --- affected

People

(Reporter: rachel, Assigned: rnons)

Details

(Whiteboard: [TM:102.0.1optimistic])

Attachments

(2 files)

Attached file nntp-crash.txt

+++ This bug was initially created as a clone of Bug #1734361 +++

Crash is here:
https://searchfox.org/mozilla-central/rev/8b56462cbd9ad0b642e7feebda1974abfa25f48b/netwerk/base/nsNetUtil.cpp#289
See enclosed stack trace.

The comment says: This check is trying to catch protocol handlers that still try to set the LOAD_REPLACE flag. However, the there is no use of LOAD_REPLACE in C-C code:
https://searchfox.org/comm-central/search?q=LOAD_REPLACE&path=&case=false&regexp=false

The assert was added in bug 1319111, so it's weird that it triggers now. A little hard to work on news issues if every second message crashes.

Bug 1707550 probably makes this a non-issue.

(In reply to Magnus Melin [:mkmelin] from comment #1)

Bug 1707550 probably makes this a non-issue.

Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX

For the record, the problem persists after implementing the NNTP protocol in JS. The crash stack is the same as already attached, originating from

xul.dll!nsNntpService::GetMessageFromUrl(nsIURI * aUrl, nsIMsgWindow * aMsgWindow, nsISupports * aDisplayConsumer) Line 299	C++
xul.dll!nsNntpService::DisplayMessage(const nsTSubstring<char> & aMessageURI, nsISupports * aDisplayConsumer, nsIMsgWindow * aMsgWindow, nsIUrlListener * aUrlListener, bool aAutodetectCharset, nsIURI * * aURL) Line 275	C++

which is code in the remaining TB C++ backend. WONTFIX is really inappropriate since processing is running into a MOZ_ASSERT() in the Mozilla network code, so the TB backend does something that is not supported by the Mozilla platform and might be discontinued in due course.

Removing the MOZ_ASSERT() from the Mozilla platform code fixes the crash, but the debug output then indicates that there is still something wrong which may break more in the future:

[Parent 5604, Main Thread] ###!!! ASSERTION: Overwriting an existing document channel!: '(loadFlags & nsIChannel::LOAD_REPLACE) || !(mDocumentRequest.get())', file c:/mozilla-source/mozilla-central/uriloader/base/nsDocLoader.cpp:469

See here for a related comment.

Flags: needinfo?(benc)

I wonder if there is an openly accessible newsgroup server for testing purposes?
Believe it or not, ever since mozilla newsgroup was decommissioned, I have not used newsgroup access.
When I tried to see if there are still newservers available, I could not find them.

TIA

OK, I figured that news.mozilla.org is still available.
When I tried to load a message, I got a segmentation error. Something is wrong.

Thread 1 "thunderbird" received signal SIGSEGV, Segmentation fault.
nsHtml5StreamParser::OnStopRequest (this=<optimized out>, aRequest=aRequest@entry=0x0, 
    status=status@entry=nsresult::NS_OK)
    at /NEW-SSD/NREF-COMM-CENTRAL/mozilla/parser/html/nsHtml5StreamParser.cpp:1404
1404	  MOZ_ASSERT(mRequest == aRequest, "Got Stop on wrong stream.");
js/src/gdb/mozilla/asmjs.py: Allowing WasmTrapHandler to run.

Program /NEW-SSD/moz-obj-dir/objdir-tb3/dist/bin/thunderbird (pid = 96094) received signal 11.

JS stack printed is as follows.

(gdb) js
0 _readFromServer/</client.onDone(status = "0") ["resource:///modules/NntpChannel.jsm":302:23]
1 _actionDone() ["resource:///modules/NntpClient.jsm":751:9]
2 _actionArticleResponse/<() ["resource:///modules/NntpClient.jsm":606:13]
3 read(data = """", lineCallback = [function], doneCallback = [function]) ["resource:///modules/LineReader.jsm":55:6]
    this = [object Object]
4 _actionArticleResponse((destructured parameter) = "[object Object]") ["resource:///modules/NntpClient.jsm":591:21]
5 _onData(event = "[object TCPSocketEvent]") ["resource:///modules/NntpClient.jsm":155:9]


For real world newsgroups you can create a free account at www.eternal-september.org.

Crashed at nsHtml5StreamParser::OnStopRequest

MOZ_ASSERT(mRequest == aRequest, "Got Stop on wrong stream.");

Assignee: nobody → remotenonsense
Status: RESOLVED → REOPENED
Ever confirmed: true
Flags: needinfo?(benc)
Resolution: WONTFIX → ---
Target Milestone: --- → 103 Branch

Pushed by mkmelin@iki.fi:
https://hg.mozilla.org/comm-central/rev/bbacea91869f
Fix crashing when reading news article in debug build. r=mkmelin

Status: REOPENED → RESOLVED
Closed: 2 years ago2 years ago
Resolution: --- → FIXED

Comment on attachment 9281890 [details]
Bug 1737485 - Fix crashing when reading news article in debug build. r=mkmelin

[Approval Request Comment]
Regression caused by (bug #):
User impact if declined: Possible crash or other wonkiness
Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky): looks low risk

Attachment #9281890 - Flags: approval-comm-esr102?

optimistically approving for TB102.0.1 - assuming it will pass beta over the next several days

Whiteboard: [TM:102.0.1optimistic]

Comment on attachment 9281890 [details]
Bug 1737485 - Fix crashing when reading news article in debug build. r=mkmelin

[Triage Comment]
Looks like flag was set incorrectly? In any case, this is in 102.0.1, so setting approval+.

Attachment #9281890 - Flags: approval-comm-esr102? → approval-comm-esr102+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: