20464 - browser crashes on data: URLs

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[Mark Wilkinson]

The browser crashes when loading a document which contains data: URLs, such as
the one given above. Apparently this worked at one point. The first bit of the
stack backtrace is:

Program received signal SIGSEGV, Segmentation fault.
0xec3a9798 in nsDataChannel::AsyncRead (this=0x52c0a8, startPosition=0,
    readCount=-1, ctxt=0x0, aListener=0x50f7ec) at nsDataChannel.cpp:306
306         NS_RELEASE(eventQ);
(gdb) where
#0  0xec3a9798 in nsDataChannel::AsyncRead (this=0x52c0a8, startPosition=0,
    readCount=-1, ctxt=0x0, aListener=0x50f7ec) at nsDataChannel.cpp:306
#1  0xee281124 in nsUnicharStreamLoader::Init (this=0x50f7e8, aURL=0x4d2e70,
    observer=0x536f38, aGroup=0x9dfc0, notificationCallbacks=0x0,
    loadAttributes=0) at nsUnicharStreamLoader.cpp:65
#2  0xecb44268 in NS_NewUnicharStreamLoader (result=0xefffd2fc, uri=0x4d2e70,
    observer=0x536f38, loadGroup=0x9dfc0, notificationCallbacks=0x0,
    loadAttributes=0) at ../../../../dist/include/nsNetUtil.h:242
#3  0xec932664 in CSSLoaderImpl::LoadSheet (this=0x6972b0, aKey=@0xefffd3a0,
    aData=0x536f38) at nsCSSLoader.cpp:1101


The code around
http://lxr.mozilla.org/seamonkey/source/netwerk/protocol/data/src/nsDataChannel.cpp#306
looks wrong to me: eventQ is never initialised, so I'm not surprised it dumps
core. Removing line 306 fixes things for me, but generates new warnings when
running the browser, so I think there may be other problems.

Comment 1

[Judson Valeski]

I have a fix for this. awaiting open tree.

Comment 2

[Judson Valeski]

fix checked in 12/2/99 2:03pm pac time.

Comment 3

[leger]

Bulk move of all Networking-Core (to be deleted component) bugs to new
Networking component.

Comment 4

[leger]

Adding crash keyword

Comment 5

[Tom Everingham]

verif.

Comment 6

[Mark Wilkinson]

linking to meta bug for the data URL