264100 - FF10PR1 crash [@ nsAString::Append]

Status: VERIFIED WORKSFORME

(Core :: Networking, defect)

Description

[Jay Patel [:jay]]

This crash has creeped up to the top of the Firefox 1.0 PR1 topcrash list. 
Seems as if users are crashing doing all kinds of things and the stack is pretty
short, but maybe someone can figure out what's going on.  Here's some recent
Talkback data from PR1:

Count   Offset    Real Signature
[ 507   nsAString::Append 2e968548 - nsAString::Append ]
 
     Crash date range: 02-OCT-04 to 07-OCT-04
     Min/Max Seconds since last crash: 7 - 1235175
     Min/Max Runtime: 150 - 1641229
 
     Count   Platform List 
     448   Windows XP [Windows NT 5.1 build 2600] 
     54   Windows 2K [Windows NT 5.0 build 2195] 
     5   Windows XP [Windows NT 5.2 build 3790] 
 
     Count   Build Id List 
     507   2004091322
 
     No of Unique Users       422
 
 Stack trace(Frame) 

	 nsAString::Append
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpcom/string/src/nsTAString.cpp
 line 282] 
	 NavigatorImpl::GetAppVersion
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp
 line 5982] 
	 nsInputStreamPump::OnStateStop
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp
 line 499]  
 
     (1168390)	URL: www.smh.com.au
     (1167446)	URL: www.nre.at/OnPreis/nre.asp
     (1167316)	URL: http://www.heise.de/ct/treiber/m.shtml
     (1165910)	URL: http://www.tomshardware.com
     (1165580)	URL: www.livejournal.com/userinfo.bml?user=vyviane
     (1165580)	Comments: Simply clicked a link within the above website.
     (1165494)	Comments: checking aol e-mail account
     (1165258)	URL: http://www.tomshardware.com
     (1164976)	URL: http://www.tomshardware.com
     (1164541)	URL: http://www.myspace.com
     (1164398)	URL: http://www.myspace.com
     (1163854)	URL: www.paypal.com
     (1163123)	URL: www.incubus-online-view.com
     (1162631)	URL: formclot.net
     (1162631)	Comments: opening a link!  
     (1161666)	URL: www.web.de
     (1160374)	URL: a lot (25+) open tabs  links from suse.de linuxtoday.com
spiegel.de and faz.net
     (1160155)	URL: www.haaretz.com
     (1159742)	URL: http://graphics.tomshardware.com/index.html
     (1159742)	Comments: I had opened www.tomshardware.com in a new tab and
selected a link on that page. I then went to switch to another tab while the
link I selected loaded. This Feedback Agent then loaded up along with a Windows
firefox.exe error message.
     (1158600)	URL: www.tomshardware.com
     (1158600)	Comments: Reading  but kept getting gay macromedia flash window
ads  that jumped over the page when scrolling down.
     (1157593)	URL: http://prohardver.index.hu/
     (1157357)	URL: aol.com?
     (1156984)	Comments: opening lots of tabs in rapid succession (livejournal
user profiles)
     (1156648)	URL:
http://news.com.com/Nokia+makes+inroads+into+Land+Rover/2100-1039_3-5399018.html?tag=st_lh
     (1155594)	URL: www.web.de
     (1153936)	URL: http://www.nvu.com/
     (1152610)	Comments: Clicking a "new post" link on a phpBB forum
     (1152566)	Comments: Clicked on a link call HMMMM in http//despair.com and
it crashed while loading.
     (1152390)	URL: www.pro4um.com
     (1151583)	URL: www.yahoo.com
     (1151583)	Comments: A message popped up saying that the browser was closing.
     (1151190)	URL: www.aol.com
     (1151190)	Comments: wrtting email on an aol account (using firefox to send
email from [e-mail] via www.aol.com
     (1151057)	URL: www.aol.com
     (1151057)	Comments: A friend of mine wanted to open here AOL webmail
account.  She is out with the dog  so i can`t ask here what happened exactly ...
but who needs AOL anyway :D
     (1150491)	URL: http://audiofind.ru/
     (1150491)	Comments: Going to a page off the main menu
     (1148148)	URL: www.collegehumor.com
     (1147679)	URL: http://www.heise.de/newsticker/meldung/mail/51070
     (1147635)	URL: http://www.heise.de/newsticker/meldung/mail/51070
     (1147109)	URL: www.heise.de
     (1146727)	Comments: Open Azureus
     (1145807)	URL: finance.yahoo.com
     (1143878)	URL: http://www.thenoiseboard.com
     (1143629)	URL: www.google.com
     (1143629)	Comments: Middle button clicked on one of their "ad-links" on the
right side of a search results page. 
     (1142143)	URL: www.newegg.com
     (1140696)	URL: forum.giga de
     (1139472)	URL: http://www.godlikesoft.de.vu/
     (1139072)	Comments: Opening an URL in a new window
     (1136873)	URL: http://www.stargateatlantis.com/
     (1136873)	Comments: Went to Message board and start scrolling with the
Mouse Wheel.  Then it crashed???
     (1136281)	URL: www.myspace.com/shine
     (1135723)	URL: http://www.mica.edu/life/resources_campus_live_on.cfm
     (1134041)	URL: www.google.com
     (1134041)	Comments: clicking on a link
     (1133621)	URL: www.heise.de
     (1133499)	URL: www.heise.de
     (1132419)	Comments: Trying to change the name server records for a domain I
own through namesecure.com.
     (1131810)	URL: http://www.gamestar.de/index
     (1131810)	Comments: i selected the adress out of the adress input field (I
am there often) and the browser crashed
     (1131683)	Comments: I just clicked the sexktop icon to start firefox. I
then clicked in the url box before the start page hade displayed. 
     (1131478)	URL: www.microsoft.com
     (1131111)	Comments: I was surfing on the net on www.focus.de and opened a
pop-up with pictures
http://focus.msn.de/hps/fol/article/article.htm?id=8988&interface=slide  When
trying to go back in the pictures gallery Firefox crashed.    
     (1130706)	URL: www.dishnetwork.com
     (1130226)	URL: http://www.pbnation.com
     (1130226)	Comments: Clicked on a link and it started loading up all the
pictures in the thread and it just shut down.
     (1130142)	URL: vefpostur.internet.is
     (1130142)	Comments: sameshitaslasttime
     (1130131)	URL: vefpostur.internet.is
     (1130131)	Comments: selecting inbound message from inbox on webmail account
     (1129749)	URL: fnac.es
     (1129281)	URL: heise.de
     (1128542)	Comments: oopening a sub page/pop-up?
     (1128539)	Comments: If I click on a link often the browser shuts down. My
start page is www.spiegel.de and I go often to links of these site.  This error
occur with Firefox 0.92  0.93 and now with 1.0.
     (1127976)	Comments: Yesterday  I want to Tab-browser.  
     (1127813)	URL: http://www.heise.de/newsticker/meldung/51458
     (1127631)	URL: http://www.heise.de/ct/treiber/m.shtml
     (1127631)	Comments: firefox crashed while loading the page above
     (1126801)	Comments: Hit back button
     (1125903)	Comments: search server
     (1124819)	Comments: Highlighting Text
     (1123819)	URL: http://www.realestate.com.au/
     (1123819)	Comments: Browsing properties.
     (1122051)	URL: www.gopednation.com
     (1121777)	URL: www.tomshardware.com
     (1121777)	Comments: opening a link from a news story
     (1118754)	URL: www.post.ch
     (1118754)	Comments: typed the url in
     (1118550)	URL: //fileforum.betanews.com/detail.php3?fid=1071850942
     (1118427)	Comments: address bar search
     (1118121)	Comments: No idea  I was in a meeting  it was just sitting there.
     (1117355)	URL: www.gmx.de
     (1117355)	Comments: i was shutting down my e-mail account.   +  inspite of
my P4 3 2 Ghz firefox seems to have difficulties in starting up from time to time 
     (1117339)	URL: www.xanga.com
     (1117339)	Comments: trying to look art someones xanga ENTRY that has music
     (1117169)	URL: heise.de
     (1116869)	URL: xanga.com
     (1116869)	Comments: navigating the site
     (1116046)	URL: www.web.de
     (1115079)	Comments: reading email
     (1114376)	URL: www.yahoo.com
     (1114376)	Comments: checking my email at yahoo
     (1114112)	URL: freeware.acehtml.com/
     (1114112)	Comments: clicked on this link from within google  and then the
crash ocurred.
     (1113839)	Comments: ok...update  it also seems to crash anytime I try to
backup a few sites.
     (1113604)	URL: http.elections wisconsin     I'm guessing at it.
     (1111690)	Comments: browsing the web
     (1111195)	Comments: i was on the internet.. (logical isnt it?)  seemed i
found an url it couldnt see..
     (1111145)	Comments: trying to log on to the internet @ msn.com
     (1110534)	Comments: nothing
     (1110090)	URL: householdappliances.kelkoo.co.uk/ctl..... sometehing!
     (1110090)	Comments: look at fridges and freezers @kelkoo...
     (1110016)	URL: http://www.wikipedia.org/
     (1109999)	URL: http://www.wikipedia.org/
     (1109910)	URL: http://www.wikipedia.org/
     (1109902)	URL: http://www.wikipedia.org/
     (1109866)	URL: www.tomshardware.com
     (1109272)	Comments: Occurred when opening multiple (~50) tabs froma 
bookmarked folder
     (1109145)	URL: www.tomshardware.com
     (1108541)	URL: http://www.heise.de
     (1108503)	URL: http://www.heise.de/newsticker/
     (1108503)	Comments: opening two links from the above page in new tabs using
middle mouse button  I could not reproduce the problem by loading the same page
and opening the links again
     (1108056)	URL: www.love.com
     (1108005)	URL: www.love.com
     (1108005)	Comments: navigating the website
     (1107677)	URL: www.hoyts.com.au
     (1107664)	URL: www.swzone.it
     (1107571)	URL: http://animelostvalley.foros.st
     (1107539)	URL: http://animelostvalley.foros.st
     (1107441)	URL: gmx.net
     (1107441)	Comments: same procedure. this firefox-version is shit...
     (1107399)	URL: gmx.net
     (1107399)	Comments: i want to lock out
     (1107188)	URL: www.ifilm.com
     (1105962)	Comments: Was looking at a page on salon.com  hit ctr-t for a new
tab  crash happened.
     (1105336)	Comments: I was reading my e-mails at netscape.com
     (1105286)	Comments: searching for flights on expedia.com
     (1105081)	Comments: Visting subscription page to maximonline.com
     (1104759)	URL: http://www.tomshardware.com
     (1104377)	URL: www.aol.com
     (1103817)	Comments: Getting real player
     (1101571)	Comments: launched firefox
     (1099962)	Comments: browsing factoty five web page
     (1098300)	URL: staple.com
     (1097386)	URL: www.badassbuddy.com
     (1097286)	URL: http://www.spiegel.de/netzwelt/technologie/0 1518
grossbild-343901-317988 00.html
     (1097224)	URL: www.badassbuddy.com
     (1097224)	Comments: i was lookin at buddy icons for AIM when a message came
up sayin that an error has occured so the program will need to shut down.
     (1096917)	URL: http://www.xanga.com/home.aspx?user=silverbloodytears
     (1096917)	Comments: Loading the webpage
     (1096552)	Comments: SHIT!I WAS GONNA MAKE MY FRIENJD A WEBSITE BUT SOME
CRAP SCREWED IT UP!SHITFUCK!
     (1096213)	URL: http://www.wikipedia.org/
     (1095644)	URL: adobe.com
     (1095644)	Comments: registering adobe Photoshop Album 2.0 Starter Edition
     (1095403)	URL: http://www.chip.de/artikel/c_artikel_10806646.html
     (1095403)	Comments: The mainwindow closed. No errors  no other problems.
     (1095335)	URL: games.yahoo.com/ch
     (1093166)	URL: spiegel.de
     (1093027)	URL: www.web.de
     (1093027)	Comments: Tryed to login
     (1092369)	URL: http://www.herold.at/
     (1092369)	Comments: clicked a link
     (1092341)	Comments: sdfsgas
     (1092152)	Comments: Downloading an AVI trailer for half life 2
     (1092003)	Comments: opening an Acrobat/pdf file for reading
     (1091259)	Comments: I was starting the browser  going to checking msn.com
for hotmail.
     (1090608)	URL: http://www.arstechnica.com
     (1090475)	URL: securityfocus.com
     (1088798)	URL: www.minijuegos.com
     (1087706)	URL: http://miarroba.com/servicios/caretos.php?pag=9&ord=fecha
     (1087163)	URL: www.heise.de
     (1087163)	Comments: go to www.heise.de (typing the adress)
     (1086829)	URL: http://freeware.aceftp.com/
     (1086829)	Comments: Not sure what the URL was because I had just clicked on
the link but I believe it's the one I listed.  I was searching for a freeware
ftp program and had selected a link to the AceFTP website.
     (1086738)	Comments: www.tomshardware.com
     (1083883)	URL: http://www.kicker.de
     (1083883)	Comments: Nothing special  very few progs running in background 
I was just trying to follow the link " mehr Bundesliga".    Regards  Alexander
     (1083670)	URL: http://www.mica.edu/life/resources_campus_live_on.cfm
     (1083597)	Comments: center-clicking yahoo news stories from my.yahoo.com to
open in new tabs. never crashed that way before.
     (1083244)	URL: www.gmx.de
     (1082824)	URL: gmx.net
     (1082824)	Comments: ?open pages in tabs
     (1082238)	URL: www.gamestar.de
     (1078758)	Comments: Starting Firefox
     (1077263)	Comments: trying to go to www.deathring.us

Comment 1

[Benjamin Smedberg]

darin, this looks like your kind of thing... it appears we're calling methods on
NavigatorImpl from networking threads, is that normal?

Comment 2

[Darin Fisher]

the stack is not helpful (bogus in fact), but i'll put this on my list to
investigate.

Comment 3

[Robin Knapp]

maybe you can take a look at the bug I posted yesterday. I'm not sure this helps.
I get many crashes with "nsInputStreamPump::OnStateStop" at the bottom of the
shot stack.

see bug 264091

Comment 4

[Benjamin Smedberg]

I'm not sure the stack is bogus, I rather think it's not. It looks like memory
corruption of nsInputStreamPump->mListener so that it points to nsIDOMNavigator
instead of nsIStreamListener. The vtable methods match up so that 

nsIStreamListener.onDataAvailable is the third vtable method
 [get] nsIDOMNavigator.appVersion is the third vtable method

So basically, we need to find the memory corruption. Any guesses?

Comment 5

[Benjamin Smedberg]

*** Bug 264091 has been marked as a duplicate of this bug. ***

Comment 6

[Christian :Biesinger (don't email me, ping me on IRC)]

bug 241947 and bug 257639 seem similar (OnStateStop is also involved)

Comment 7

[Jay Patel [:jay]]

Don't see anymore of these crashes since Firefox 1.0 PR1.  Marking wfm.

Comment 8

[benc]

V, per jay.