308018 - crash after trying to download non-existing file via FTP [@nsFTPChannel::GetFTPEventSink]

Status: VERIFIED FIXED

(Core Graveyard :: Networking: FTP, defect, P1)

Description

[baffclan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050911 SeaMonkey/1.1a
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050911 SeaMonkey/1.1a

SeaMonkey cresh, download file via FTP
SeaMonkey/2005091105-trunk/WinXP

Reproducible: Always

Steps to Reproduce:
1. http://vcl.vaio.sony.co.jp/download/SP-010362-00.html
2. go page bottom
3. click Readme.txt link
4. open error dialog, and a clash



Stack Signature : nsFTPChannel::GetFTPEventSink bcaeedc5

Readme.txt file:
TB9240884Y

rprogram file :
TB9240586Z, TB9240407Y

Comment 1

[baffclan]

reproduce with Firefox/2005091006-turnk/WinXP
TB9241281W

ftp://ftp.vaio.sony.co.jp/pub/vaio/download/SP-0010362-00/Readme.txt
error is 550

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

###!!! ASSERTION: null control connection: 'mControlConnection', file
../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp,
line 2510
Break: at file
../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp,
line 2510
###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().:
'mRawPtr != 0', file ../../../../dist/include/xpcom/nsAutoPtr.h, line 1041
Break: at file ../../../../dist/include/xpcom/nsAutoPtr.h, line 1041

Comment 3

[Stefan [:stefanh]]

Does not happen in seamonkey trunk 2005090909, but happens in seamonkey
2005091010 (mac). Caused by bug 293350?

Comment 4

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050910 SeaMonkey/1.1a
Build ID: 2005091005

clicked on ftp://ftp.vaio.sony.co.jp/pub/vaio/download/SP-0010362-00/Readme.txt,
crash, Talkback ID: TB9242777H

Checkins for Bug 293350:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-09-09+17%3A19&maxdate=2005-09-09+17%3A20&cvsroot=%2Fcvsroot

Comment 5

[Hermann Schwab]

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsFTPChannel%3A%3AGetFTPEventSink

nsFTPChannel::GetFTPEventSink 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFTPChannel.cpp,
line 357]
nsFtpState::SendFTPCommand 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp,
line 2521]
nsFtpState::DataConnectionEstablished 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp,
line 2493]
nsFTPChannel::OnStatus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFTPChannel.cpp,
line 564]
DataRequestForwarder::OnTransportStatus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp,
line 392]
nsTransportStatusEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsTransportUtils.cpp,
line 124]
0x778b0c24
0x000d000a

Comment 6

[Hermann Schwab]

working, file exists:
http://mozilla.osuosl.org/pub/mozilla.org/firefox/releases/1.5b1/KEY
ftp://mozilla.osuosl.org/pub/mozilla.org/firefox/releases/1.5b1/KEY
working, gives 404 as file doesn't exist:
http://mozilla.osuosl.org/pub/mozilla.org/firefox/releases/1.5b1/KEY.txt

crashing, gives 550: Failed to change directory
ftp://mozilla.osuosl.org/pub/mozilla.org/firefox/releases/1.5b1/KEY.txt

Firefox crashes after I click OK on the 550 Alert.

Comment 7

[Darin Fisher]

-> my regression apparently.

Comment 8

[Darin Fisher]

Hmm.. I cannot reproduce this using a Firefox debug build under Linux.

Comment 9

[Darin Fisher]

There's also nothing obvious in the code to indicate why this crash would be
happening.  It looks like everything is properly null checked, and yet I see
that we have a NULL pointer assertion.  Hrm :(

Comment 10

[Christian :Biesinger (don't email me, ping me on IRC)]

>###!!! ASSERTION: null control connection: 'mControlConnection', file
>../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp,
>line 2510

This assertion seems to have existed even before bug 293350

Comment 11

[Christian :Biesinger (don't email me, ping me on IRC)]

OK, so, the transport event sink gets an NS_NET_STATUS_CONNECTED_TO event. this
is asynchronous (well, comes from another thread presumably).

StopProcessing is called before this crash:
#0  nsFtpState::StopProcessing (this=0xa48e8f8)
    at
../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp:2389
#1  0x02d78949 in nsFtpState::Process (this=0xa48e8f8)
    at
../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp:743
#2  0x02d79749 in nsFtpState::OnDataAvailable (this=0xa48e8f8,
request=0xa48f4a8, aContext=0x0, aInStream=0xa48f20c,
    aOffset=329, aCount=33) at
../../../../../../mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp:572

This is in the FTP_ERROR case.

StopProcessing nulls out the channel, so it's gone later on.

Comment 12

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: patch

OK... I think this is a correct patch: If we no longer have a channel, we were
stopped, and thus don't care about our data connection.

Comment 13

[Darin Fisher]

Comment on attachment 195795 [details] [diff] [review]
patch

r+sr=darin

Comment 14

[Christian :Biesinger (don't email me, ping me on IRC)]

(this patch also fixes the mControlConnection assertion)

Checking in netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp;
/cvsroot/mozilla/netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp,v  <-- 
nsFtpConnectionThread.cpp
new revision: 1.298; previous revision: 1.297
done

Comment 15

[baffclan]

cannot reproduce with SeaMonkey/2005061306-trunk/WinXP
Thanks for fixing this.

-> v.

Comment 16

[Josh Birnbaum]

*** Bug 308559 has been marked as a duplicate of this bug. ***

Comment 17

[Darin Fisher]

fixed1.8 as part of the commit for bug 293350

Comment 18

[Jay Patel [:jay]]

v.fixed on branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5)
Gecko/20050928 Firefox/1.4, no crashes trying to download from various ftp urls
in this bug...got 550 errors and clicked ok.

Comment 19

[Darin Fisher]

*** Bug 318068 has been marked as a duplicate of this bug. ***