Closed Bug 308018 Opened 19 years ago Closed 19 years ago

crash after trying to download non-existing file via FTP [@nsFTPChannel::GetFTPEventSink]

Categories

(Core Graveyard :: Networking: FTP, defect, P1)

defect

Tracking

(Not tracked)

VERIFIED FIXED
mozilla1.8beta5

People

(Reporter: baffclan, Assigned: Biesinger)

References

()

Details

(Keywords: crash, regression, verified1.8)

Crash Data

Attachments

(1 file)

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050911 SeaMonkey/1.1a Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050911 SeaMonkey/1.1a SeaMonkey cresh, download file via FTP SeaMonkey/2005091105-trunk/WinXP Reproducible: Always Steps to Reproduce: 1. http://vcl.vaio.sony.co.jp/download/SP-010362-00.html 2. go page bottom 3. click Readme.txt link 4. open error dialog, and a clash Stack Signature : nsFTPChannel::GetFTPEventSink bcaeedc5 Readme.txt file: TB9240884Y rprogram file : TB9240586Z, TB9240407Y
reproduce with Firefox/2005091006-turnk/WinXP TB9241281W ftp://ftp.vaio.sony.co.jp/pub/vaio/download/SP-0010362-00/Readme.txt error is 550
Assignee: general → dougt
Component: General → Networking: FTP
Product: Mozilla Application Suite → Core
QA Contact: general → benc
Version: unspecified → Trunk
Summary: SeaMonkey cresh, download file via FTP → SeaMonkey crash, download file via FTP
###!!! ASSERTION: null control connection: 'mControlConnection', file ../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp, line 2510 Break: at file ../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp, line 2510 ###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../../../dist/include/xpcom/nsAutoPtr.h, line 1041 Break: at file ../../../../dist/include/xpcom/nsAutoPtr.h, line 1041
Does not happen in seamonkey trunk 2005090909, but happens in seamonkey 2005091010 (mac). Caused by bug 293350?
Severity: normal → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash
OS: Windows XP → All
Hardware: PC → All
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsFTPChannel%3A%3AGetFTPEventSink nsFTPChannel::GetFTPEventSink [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFTPChannel.cpp, line 357] nsFtpState::SendFTPCommand [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp, line 2521] nsFtpState::DataConnectionEstablished [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp, line 2493] nsFTPChannel::OnStatus [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFTPChannel.cpp, line 564] DataRequestForwarder::OnTransportStatus [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp, line 392] nsTransportStatusEvent::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsTransportUtils.cpp, line 124] 0x778b0c24 0x000d000a
Summary: SeaMonkey crash, download file via FTP → SeaMonkey crash, download file via FTP [@nsFTPChannel::GetFTPEventSink]
Summary: SeaMonkey crash, download file via FTP [@nsFTPChannel::GetFTPEventSink] → crash after trying to download non-existing file via FTP [@nsFTPChannel::GetFTPEventSink]
-> my regression apparently.
Assignee: dougt → darin
Target Milestone: --- → mozilla1.8beta5
Hmm.. I cannot reproduce this using a Firefox debug build under Linux.
There's also nothing obvious in the code to indicate why this crash would be happening. It looks like everything is properly null checked, and yet I see that we have a NULL pointer assertion. Hrm :(
>###!!! ASSERTION: null control connection: 'mControlConnection', file >../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp, >line 2510 This assertion seems to have existed even before bug 293350
OK, so, the transport event sink gets an NS_NET_STATUS_CONNECTED_TO event. this is asynchronous (well, comes from another thread presumably). StopProcessing is called before this crash: #0 nsFtpState::StopProcessing (this=0xa48e8f8) at ../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp:2389 #1 0x02d78949 in nsFtpState::Process (this=0xa48e8f8) at ../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp:743 #2 0x02d79749 in nsFtpState::OnDataAvailable (this=0xa48e8f8, request=0xa48f4a8, aContext=0x0, aInStream=0xa48f20c, aOffset=329, aCount=33) at ../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp:572 This is in the FTP_ERROR case. StopProcessing nulls out the channel, so it's gone later on.
Attached patch patchSplinter Review
OK... I think this is a correct patch: If we no longer have a channel, we were stopped, and thus don't care about our data connection.
Assignee: darin → cbiesinger
Status: NEW → ASSIGNED
Attachment #195795 - Flags: superreview?(darin)
Attachment #195795 - Flags: review?(darin)
Keywords: regression
Priority: -- → P1
Comment on attachment 195795 [details] [diff] [review] patch r+sr=darin
Attachment #195795 - Flags: superreview?(darin)
Attachment #195795 - Flags: superreview+
Attachment #195795 - Flags: review?(darin)
Attachment #195795 - Flags: review+
(this patch also fixes the mControlConnection assertion) Checking in netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp; /cvsroot/mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp,v <-- nsFtpConnectionThread.cpp new revision: 1.298; previous revision: 1.297 done
Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
cannot reproduce with SeaMonkey/2005061306-trunk/WinXP Thanks for fixing this. -> v.
Status: RESOLVED → VERIFIED
*** Bug 308559 has been marked as a duplicate of this bug. ***
fixed1.8 as part of the commit for bug 293350
Keywords: fixed1.8
v.fixed on branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20050928 Firefox/1.4, no crashes trying to download from various ftp urls in this bug...got 550 errors and clicked ok.
Keywords: fixed1.8verified1.8
*** Bug 318068 has been marked as a duplicate of this bug. ***
Crash Signature: [@nsFTPChannel::GetFTPEventSink]
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: