249548 - FF10PR1 crashes when jumping from HTTPS website to another HTTPS website [@ MSVCRT.DLL - nsStorageInputStream::Read ]

Status: RESOLVED DUPLICATE of bug 207846

(Core :: XPCOM, defect)

Description

[Mateusz]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1

go to https://www.pekao24.pl/ then paste or type again the same adress and press
enter. Browser 0.9.0 and 0.9.1 crashes. Also the same when jumping to some other
SSL pages.

Reproducible: Always
Steps to Reproduce:
1. goto https://www.pekao24.pl/
2. paste or type again the same or another url to a https website
3. press enter

Actual Results:  
crash. see accidents:
TB210956Z, TB210915Q, TB210906M, TB204046X, TB203738E, TB203737H, TB203736M

Expected Results:  
open requested page

TB210956Z, TB210915Q, TB210906M, TB204046X, TB203738E, TB203737H, TB203736M

Comment 1

[Hermann Schwab]

confirming with Mozilla Suite 1.6, 1.7, current nightly.
After loading of the page starts, click GO button again, to iniate a crash.
Sometimes onl DocWatson came up, was freezing while doing his job, or after job
was done, so I had to manually reset the computer. Sometimes also Talkback came up.

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7) Gecko/20040616
TB213955Y, TB213774K, TB213697W  from 1.8a2, 1.7, 1.6, don´t know the order
I´ve tested with two other https: sites, didn´t see the bug.
Seems to be specific to this URL.

Comment 2

[Hermann Schwab]

didn´t find talkbacks mentioned here, so I looked for the URL:
Result: 16 talkbacks found, youngest 203446.
All of them 1.7 based, 11 Firefox win32, 4 Mozilla win32, 1 Mozilla Linux
2.4.22-10mdk

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=61678
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=190256

the others crashed on MSVCRT.DLL:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=91772

Comment 3

[Adam Hauner]

TB203738:
MSVCRT.DLL + 0x109b3 (0x780109b3)
nsStorageInputStream::Read 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStorageStream.cpp,
line 408]
nsCacheEntryDescriptor::nsInputStreamWrapper::Read 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp,
line 528]
nsStreamCopierIB::ConsumeInputBuffer 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp,
line 488]
nsStreamCopierOB::DoCopy 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp,
line 547]
nsAStreamCopier::Process 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp,
line 321]
nsAStreamCopier::HandleContinuationEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp,
line 393]

Bug 207846 has same signature, but different stack.
Marking as NEW per Hermann's repro.
-> XPCOM ?

Comment 4

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a2) Gecko/20040629

I downloaded a local copy using right-click 'Save Link Target as' 'Webpage, HTML
only'. I added <base href="https://www.pekao24.pl"> and the local file loaded
fine. I could treload while it was loading, no crash. I could go to the english
version using a link in the local file, and reloading that, I crashed.
Had a lot of crashes today in MSVCRT.dll with this bug, but talkback didn´t start.

https://www.pekao24.pl/ClientLogonUK.html

Comment 5

[Mateusz]

Bug also crashes browser if you open new window and then another SSL page

Comment 6

[Nathan Strom]

I think I ran into this one, specifically re: the situation in comment 5 -- I
was checking my gmail, opened a link to
"https://secure.newegg.com/app/Logon.asp?loginType=OrderStatus" in a new window,
logged into the newegg site, and as soon as it got to the order status page,
crashed with MSVCRT.DLL + 0x109b3 (0x780109b3) signature.

Talkback ID is TB610577Z

Using:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3
Windows 2000 Professional Workstation

Comment 7

[Adam Hauner]

TB610577Z has similar stack as in comment #3

Darin, isn't this bug related to cache?

Comment 8

[Jay Patel [:jay]]

This is a major topcrash for Firefox 1.0 PR1.  Adding topcrash+ and request for
blocking aviary1.0 and 1.7.x.  Users are crashing trying to do secure
transactions at https websites (banks, shopping carts, etc).

Here is a snapshot of the latest Talkback data for FF10PR1:
Count   Offset    Real Signature
[ 169   msvcrt.dll + 0x36fa3 (0x77c46fa3) 90fb4afc - nsStorageInputStream::Read ]
[ 118   msvcrt.dll + 0x32f43 (0x77c42f43) db7f1ba0 - nsStorageInputStream::Read ]
 
     Crash date range: 16-SEP-04 to 26-SEP-04
     Min/Max Seconds since last crash: 31 - 672410
     Min/Max Runtime: 93 - 769726
 
     Count   Platform List 
     286   Windows XP [Windows NT 5.1 build 2600] 
     1   Windows 2K [Windows NT 5.0 build 2195] 
 
     Count   Build Id List 
     287   2004091322
 
     No of Unique Users       259
 
 Stack trace(Frame) 

	 msvcrt.dll + 0x36fa3 (0x77c46fa3)  
	 nsStorageInputStream::Read
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpcom/io/nsStorageStream.cpp
 line 408] 
	 nsCacheEntryDescriptor::nsInputStreamWrapper::Read
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp
 line 528] 
	 nsStreamCopierOB::FillOutputBuffer
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp
 line 531] 
	 nsStreamCopierOB::DoCopy
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp
 line 547] 
	 nsAStreamCopier::Process
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp
 line 321] 
	 nsAStreamCopier::HandleContinuationEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp
 line 393]  
 
     (986987)	URL:
http://www.tigerdirect.com/applications/searchtools/search.asp?mnf=961&cat=28
     (986560)	Comments: Accessing a secure web site
     (985592)	Comments: Using tabs in my home page  every time I go "home" it
reloads redundant pages.
     (985365)	Comments: browsing to company intranet hosted w/MS Small biz
server 2003
     (984937)	URL: Virginmobileusa.com
     (984937)	Comments: Browsing my cell phone information when the firefox box
showed up.
     (983278)	Comments: on the internet looking for inline skates
     (983027)	URL: www.willhill.com
     (983027)	Comments: Logging in to the site via a user name and password. I
had previously asked Firefox to remember the password  but had entered the wrong
one. When I tried again with the correct password Firefox crashed.
     (982959)	URL: www.willhill.com
     (982959)	Comments: Logging in to the site via a user name and password. I
had previously asked Firefox to remember the password  but had entered the wrong
one. When I tried again with the correct password Firefox crashed.
     (982315)	URL: www.s2ki.com
     (982315)	Comments: Opening a new page within the forum.
     (980486)	Comments: Everytime I go to a secure site to get personal
information is when it tell me its shutting down.
     (978270)	URL: salary.com
     (976174)	URL:
https://osap.gov.on.ca/CGI-BIN/LANSAWEB?WEBEVENT+L087DC2613C6781564887496+OSP+ENG
     (976174)	Comments: Burning a CD in background with Nero Express
     (972115)	Comments: I was browsing TigerDirect.com and clicked on this link
   
http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=21620&CatId=576
     (970671)	URL: https://www.tigerdirect.ca/cgisec/orderTrack.asp
     (968542)	URL: www.cobraserv.com
     (968283)	Comments: browsing a SSL site
     (968249)	Comments: customizing
     (967077)	URL: Logging into Overture.com
     (967077)	Comments: Logging into Pay Per Click Engine
     (966965)	URL: bankofthejames.com
     (966965)	Comments: accessing bankofthejames.com
     (965679)	Comments: I WAS USING BROWSER TO ACCESS MY CHECKING ACCOUNT ON LINE.
     (960862)	Comments: Paying bill in https protocol. Receipt received. Other
tab was querying www.qantas.com site.
     (960312)	Comments: going onto pimpwar.com
     (959703)	URL: https://www.tigerdirect.com/cgisec/OrderStatus.asp
     (957239)	URL: https://mds.bussvc.wisc.edu/swap/home.asp
     (957239)	Comments: Viewing thumbnails of a product.
     (955878)	URL:
http://www.tigerdirect.com/applications/category/category_slc.asp?CatId=89
     (955878)	Comments: Selecting a Manufacturer. Plextor to be specific
     (953654)	URL: ubt.com
     (953124)	Comments: surfing on tigerdirect
     (952760)	URL: www.salliemae.com

For more comments, just go to
http://talkback-public.mozilla.org/reports/admin/firefox/smart-analysis.win and
look for "nsStorageInputStream::Read".

Comment 9

[Jay Patel [:jay]]

Dup of bug 207846.

*** This bug has been marked as a duplicate of 207846 ***

Comment 10

[Christian :Biesinger (don't email me, ping me on IRC)]

clearing blocking nominations, then. (patch is already checked in on both branches)