287956 - Crash shortly after program start [@nsProtocolProxyService::PruneProxyInfo]

Status: RESOLVED FIXED

(Core :: Networking, defect, P1)

Description

[Joe McCabe]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050326
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050326

Immediately following startup Thunderbird begins checking for new mail and
performaing virus scan. Within thirty seconds the program throws core with a
Signal 11.

Reproducible: Always

Steps to Reproduce:




Stack trace coming.

Looks like this is happening in libnecko.so.

Comment 1

[Joe McCabe]

Attachment: Stack trace

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

http://lxr.mozilla.org/seamonkey/source/netwerk/base/src/nsProtocolProxyService.cpp#1320
1323         for (nsProxyInfo *iter = head; iter; iter = iter->mNext, last = iter) {
1324             if (iter->Type() == kProxyType_HTTP) {
1325                 // reject!
1326                 if (last)
1327                     last->mNext = iter->mNext;
1328                 else
1329                     head = iter->mNext;
1330                 iter->mNext = nsnull;
1331                 NS_RELEASE(iter);
1332             }
1333         }

So, this NS_RELEASE will set iter to null, and that will make the for loop
dereference a null pointer... something's not quite right here...

I think this code wants to continue the loop with iter pointing to what used to
be iter->mNext.

Comment 3

[Christian :Biesinger (don't email me, ping me on IRC)]

seems to me like this loop should look more like the other loop in this function.

caused by bug 282442

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

*** Bug 288037 has been marked as a duplicate of this bug. ***

Comment 5

[Darin Fisher]

I'm working on a patch.

Comment 6

[Darin Fisher]

Attachment: v1 patch

Comment 7

[Darin Fisher]

Attachment: additions to test_protocolproxyservice.js for this case

Comment 8

[Darin Fisher]

fixed-on-trunk