Closed Bug 210119 Opened 21 years ago Closed 21 years ago

Browser crashes when opening URL

Categories

(Core :: Networking: HTTP, defect, P1)

x86
All
defect

Tracking

()

RESOLVED FIXED
mozilla1.5alpha

People

(Reporter: robertlaferla, Assigned: darin.moz)

References

()

Details

(Keywords: crash, Whiteboard: TB21221032H)

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030620
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030620

Nightly build 2003062004 browser crashes when opening this url:
 
http://realtytimes.com/rtnews/rtapages/20020426_realist.htm


Reproducible: Always

Steps to Reproduce:
1. Open http://realtytimes.com/rtnews/rtapages/20020426_realist.htm
2.
3.

Actual Results:  
Crash


Expected Results:  
Opened page.
confirming with a 1 day old win2k build

AddNullTerminator(nsStr & {...}) line 350
nsStrPrivate::EnsureCapacity(nsStr & {...}, unsigned int 4294967294) line 127 +
6 bytes
nsStrPrivate::GrowCapacity(nsStr & {...}, unsigned int 4294967294) line 153 + 10
bytes
nsCString::SetCapacity(nsCString * const 0x00000000, unsigned int 4294967294)
line 174 + 10 bytes
nsString::SetLength(nsString * const 0x00000000, unsigned int 4294967294) line 172
nsACString::UncheckedAssignFromReadable(nsACString * const 0x00000000, const
nsACString & {...}) line 793
nsACString::do_AssignFromReadable(nsACString * const 0x00000000, const
nsACString & {...}) line 763
nsHttpHeaderArray::SetHeader(nsHttpHeaderArray * const 0x00000000, nsHttpAtom
{...}, const nsACString & {...}, int 1) line 53 + 35 bytes
nsHttpHeaderArray::ParseHeaderLine(nsHttpHeaderArray * const 0x00000000, char *
0x01229a6c `string', nsHttpAtom * 0x0174fdf0, char * * 0x0174fdfc) line 181
nsHttpResponseHead::ParseHeaderLine(nsHttpResponseHead * const 0x00000000, char
* 0x02196829) line 192
nsHttpTransaction::ParseLine(nsHttpTransaction * const 0x00000000, char *
0x02196820) line 552 + 5 bytes
nsHttpTransaction::ParseLineSegment(nsHttpTransaction * const 0x00000000, char *
0x02345070, unsigned int 17) line 568
nsHttpTransaction::ParseHead(nsHttpTransaction * const 0x00000000, char *
0x02344f0c, unsigned int 376, unsigned int * 0x0174fe68) line 651
nsHttpTransaction::ProcessData(nsHttpTransaction * const 0x00000000, char *
0x02344f0c, unsigned int 376, unsigned int * 0x00000176) line 834
nsHttpTransaction::WritePipeSegment(nsIOutputStream * 0x026d133c, void *
0x022446f0, char * 0x02344f0c, unsigned int 0, unsigned int 4096, unsigned int *
0x0174fea8) line 403 + 13 bytes
nsPipeOutputStream::WriteSegments(nsPipeOutputStream * const 0x02344f0c,
unsigned int (nsIOutputStream *, void *, char *, unsigned int, unsigned int,
unsigned int *)* 0x0120d3da nsHttpTransaction::WritePipeSegment(nsIOutputStream
*, void *, char *, unsigned int, unsigned int, unsigned int *), void *
0x022446f0, unsigned int 4096, unsigned int * 0x00001000) line 1062
nsHttpTransaction::WriteSegments(nsHttpTransaction * const 0x00000000,
nsAHttpSegmentWriter * 0x0273a814, unsigned int 4096, unsigned int * 0x0174fef4)
line 421 + 26 bytes
nsHttpConnection::OnSocketReadable(nsHttpConnection * const 0x00000000) line 619
nsHttpConnection::OnInputStreamReady(nsHttpConnection * const 0x0273a818,
nsIAsyncInputStream * 0x023d55ac) line 717
nsSocketInputStream::OnSocketReady(nsSocketInputStream * const 0x00000000,
unsigned int 18993848) line 188
NECKO! const  nsHttpConnection::`vftable'{for `nsAHttpSegmentWriter'} address
0x0121d2c8
nsHttpConnection::`scalar deleting destructor'(nsHttpConnection * const
0x00000000, unsigned int 18931679) address 0x0120ad8b
nsHttpTransaction::QueryInterface() address 0x0120dfd5
f18b5600()
Assignee: general → darin
Status: UNCONFIRMED → NEW
Component: Browser-General → Networking: HTTP
Ever confirmed: true
Keywords: crash
QA Contact: general → httpqa
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030617
This is WFM on Windows 2000 using 2003061708 nightly.  Is this a regression
since 6/17?
probably a regression from my patch for bug 208845.
Blocks: 208845
Status: NEW → ASSIGNED
Priority: -- → P1
Target Milestone: --- → mozilla1.5alpha
Bug also occurs in 2003-06-20-08 trunk Linux    (Talkback: TB21221032H)
OS: Windows 2000 → All
Whiteboard: TB21221032H
Attached patch v1 patchSplinter Review
site sends the header "Pragma:	\r\n"... net_RFindCharNotInSet didn't have
proper bounds checks for searching an empty string.  the patch is pretty
straightforward.
Attachment #126270 - Flags: superreview?(alecf)
Attachment #126270 - Flags: review?(dougt)
Blocks: 210111
Blocks: 210334
*** Bug 210334 has been marked as a duplicate of this bug. ***
Comment on attachment 126270 [details] [diff] [review]
v1 patch

sr=bzbarsky
Attachment #126270 - Flags: superreview?(alecf) → superreview+
*** Bug 210111 has been marked as a duplicate of this bug. ***
Comment on attachment 126270 [details] [diff] [review]
v1 patch

r=caillon
Attachment #126270 - Flags: review?(dougt) → review+
fixed-on-trunk
Status: ASSIGNED → RESOLVED
Closed: 21 years ago
Resolution: --- → FIXED
*** Bug 210495 has been marked as a duplicate of this bug. ***
This bug probably was related to bug 209979.
*** Bug 210296 has been marked as a duplicate of this bug. ***
*** Bug 210455 has been marked as a duplicate of this bug. ***
*** Bug 210047 has been marked as a duplicate of this bug. ***
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: