189933 - crash when downloading newsgroup list

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Tomi Leppikangas]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3b) Gecko/20030120
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3b) Gecko/20030120

With new profile, wen adding news server, mozilla crashed when downloading
newsgroup list.

Reproducible: Always

Steps to Reproduce:
1. Create new profile
2. create new newsgoup account
3. wait when mozilla downloads newsgroup list

Actual Results:  
mozilla crashes when downloading newsgroup list

Expected Results:  
newsgroup list should downdload so that user can subscribe to groups

Talkback crash IDs: TB16435131M TB16434381W

Comment 1

[[e-mail] (gone - use [e-mail] instead)]

Trigger Reason  	SIGSEGV: Segmentation Fault: (signal 11)

That's the complete stack.

Comment 2

[Tomi Leppikangas]

here is backtrace from my own build:

#0  0x420b4c81 in nanosleep () from /lib/i686/libc.so.6
#1  0x420b4b01 in sleep () from /lib/i686/libc.so.6
#2  0x0807216c in ah_crap_handler (signum=11)
    at ../../../xpfe/bootstrap/nsSigHandlers.cpp:145
#3  0x4165b5a5 in nsProfileLock::FatalSignalHandler (signo=11, 
    info=0xbfffc0b8, context=0xbfffc138)
    at ../../../profile/src/nsProfileAccess.cpp:1776
#4  0x4012ff93 in pthread_sighandler_rt () from /lib/i686/libpthread.so.0
#5  <signal handler called>
#6  0x42c829b1 in nsNNTPProtocol::ReadNewsList (this=0x8d8fdf8, 
    inputStream=0x8ccc6b4, length=0)
    at ../../../../mailnews/news/src/nsNNTPProtocol.cpp:3191
#7  0x42c899e5 in nsNNTPProtocol::ProcessProtocolState (this=0x8d8fdf8, 
    url=0x0, inputStream=0x8ccc6b4, sourceOffset=0, length=0)
    at ../../../../mailnews/news/src/nsNNTPProtocol.cpp:5105
#8  0x42c8347e in nsNNTPProtocol::TimerCallback (this=0x8d8fdf8)
    at ../../../../mailnews/news/src/nsNNTPProtocol.cpp:3339
#9  0x42c83421 in nsNNTPProtocol::Notify (this=0x8d8fdf8, timer=0x8ec6c38)
    at ../../../../mailnews/news/src/nsNNTPProtocol.cpp:3332
#10 0x40532b5b in nsTimerImpl::Fire (this=0x8ec6c38)
    at ../../../xpcom/threads/nsTimerImpl.cpp:385
#11 0x40532d3b in handleTimerEvent (event=0x42d005a8)
    at ../../../xpcom/threads/nsTimerImpl.cpp:447

(gdb) list ../../../../mailnews/news/src/nsNNTPProtocol.cpp:3191
3186      
3187      /* End of list? */
3188      if (line[0]=='.' && line[1]=='\0')
3189      {
3190        PRBool listpnames=PR_FALSE;
3191 --->   rv = m_nntpServer->QueryExtension("LISTPNAMES",&listpnames);
3192        if (NS_SUCCEEDED(rv) && listpnames)
3193          m_nextState = NNTP_LIST_PRETTY_NAMES;
3194        else
3195          m_nextState = DISPLAY_NEWSGROUPS;

(gdb) print m_nntpServer
$1 = {mRawPtr = 0x0}

Comment 3

[(not reading, please use [e-mail] instead)]

Attachment: patch

I'm not sure how you are getting into this state, but this should fix the
crash.

is this a public news server, so that I can try?

Comment 4

[(not reading, please use [e-mail] instead)]

accepting

Comment 5

[(not reading, please use [e-mail] instead)]

I've checked in the patch, but I fear if you are getting to this code without a 
m_nntpServer, other bad things have (or will) happen.

Tomi, can you send me email directly (to [e-mail]) about the 
server? 

Comment 6

[Tomi Leppikangas]

I did some more testing with nightlys:

2003-01-16-08-trunk works
2003-01-17-08-trunk works
2003-01-18-13-trunk crash

So something between builds 2003-01-17-08 and 2003-01-18-13 broke this.
There is darin's landing for bug 176919 "async streams" in that time.

Comment 7

[Tomi Leppikangas]

Attachment: nntplog after crash (2003-01-18-21-trunk) gzipped

Comment 8

[Olivier Cahagne]

cc'ing darin.

Comment 9

[Tomi Leppikangas]

This seems to be fixed in todays build. I guess it's fix for bug 189689.

Comment 10

[Darin Fisher]

yeah, maybe this was due to some corruption in the incoming stream.  seth's
patch might be a good safety measure in case a server sends garbage.

Comment 11

[(not reading, please use [e-mail] instead)]

if the reporter isn't seeing the crash anymore, I'll just mark this fixed since
the bulletproofing was checked in.

I expect other bad things to happen if m_nntpServer was null, even if we don't
crash.

reporter, are you seeing any other weirdness?

Comment 12

[Tomi Leppikangas]

Sometimes i get hang when reading news, i think thats bug 189718,
no crash at startup anymore.

Marking this as verified.