35208 - Crash in MSVCRT.DLL going to http://www.firstmatter.com/hotlinks.asp

Status: VERIFIED DUPLICATE of bug 34743

(Core :: Networking, defect, P3)

Description

[Alan S. Jones]

Running Windows 95 4-8-00 Mozilla build.

Going to http://www.firstmatter.com/hotlinks.asp I crash imdeaditly in 
MSVCRT.DLL


MOZILLA caused an invalid page fault in
module MSVCRT.DLL at 014f:7800153f.
Registers:
EAX=000014bd CS=014f EIP=7800153f EFLGS=00010206
EBX=0068f9f0 SS=0157 ESP=0068f8d8 EBP=0068f8e0
ECX=0000052f DS=0157 ESI=00000000 FS=1987
EDX=00000001 ES=0157 EDI=023f0e78 GS=0000
Bytes at CS:EIP:
f3 a5 ff 24 95 30 21 00 78 8b c7 ba 03 00 00 00 
Stack dump:
02a09b00 000014bd 0068f8fc 60cba80d 023f0e78 00000000 000014bd 02c13d84 01513a00 
0068f920 605e40b3 02a09b00 023f0e78 000014bd 0068f9f0 02c13d84 


OUTPUT FROM -console
=============================
****** number of sceens 1
WEBSHELL+ = 1
 I am inside the initialize
 Hey : You are in QFA Startup
(QFA)Talkback loaded Ok.
WEBSHELL+ = 2
assuming d&d is off for Navigator
WEBSHELL+ = 3
Setting content window
in SetSecurityButton
WEBSHELL+ = 4
Pressed mDragStartPx=165
Pressed mDragStartPx=174
Document http://www.mozilla.org/mozorg.html loaded successfully
Document: Done (11.7 secs)
has multiple monitor apis is 0
WEBSHELL+ = 5
DV_E_CLIPFORMAT
S_OK
S_OK
->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Read Clipboard from memory
Error loading URL http://www.firstmatter.com/hotlinks.asp
Document: Done (3.57 secs)
================================

Comment 1

[Alan S. Jones]

I posted a talkback report on this bug, but forgot to get the talkback ID to 
post here.  I think you all can still dig it up by my bugzilla account 
[e-mail].  In the report I included this bug number and URL.

Comment 2

[Alan S. Jones]

Not sure if there is any relation to bug 14772 or not.

Comment 3

[Alan S. Jones]

Never mind, don't think related to bug 14772, sorry

Comment 4

[Uriel]

Reproduced on Windows2000Pro Rc2; Buid ID: 2000040808
I get the same crash in other pages of www.firstmatter.com
but not in the main page,
for example I get a crash in:
http://www.firstmatter.com/shop/reading/default.asp
http://www.firstmatter.com/contacts.asp

All the files that get a crash are .ASP files, y downloaded some and loaded them
from the Hard Disk as HTML files and dont get a crash. The problem may be
related with the HTTP headers sent by the server, but I'm not sure...

Comment 5

[Alan S. Jones]

Got some nice netscape people to pull my stack trace from my talkback report.

35208: 
Call Stack:    (Signature = MSVCRT.DLL + 0x153f (0x7800153f) 63fde467) 
  
  MSVCRT.DLL + 0x153f (0x7800153f) 
  
  
  nsByteArrayInputStream::Read 
                                          
[d:\builds\seamonkey\mozilla\xpcom\io\nsByteArrayInputStream.cpp, line 73] 
  
  InterceptStreamListener::Read 
                                          
[d:\builds\seamonkey\mozilla\netwerk\cache\mgr\nsCachedNetData.cpp, line 1142] 
  
  nsParser::OnDataAvailable 
                                          
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1566] 
  
  nsDocumentOpenInfo::OnDataAvailable 
                                          
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 271] 
  
  InterceptStreamListener::OnDataAvailable 
                                          
[d:\builds\seamonkey\mozilla\netwerk\cache\mgr\nsCachedNetData.cpp, line 1129] 
  
  nsHTTPChunkConv::OnDataAvailable 
                                          
[d:\builds\seamonkey\mozilla\netwerk\streamconv\converters\nsHTTPChunkConv.cpp, 
line 197] 
  
  nsHTTPServerListener::OnDataAvailable 
                                          
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p, line 427] 
  
  nsOnDataAvailableEvent::HandleEvent 
                                          
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
412] 
  
  nsStreamListenerEvent::HandlePLEvent 
                                          
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
106] 
  
  PL_HandleEvent 
                                          
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 564] 
  
  _md_EventReceiverProc 
                                          
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1020] 
  
  KERNEL32.DLL + 0x3663 (0xbff73663) 
  
  
  KERNEL32.DLL + 0x228e0 (0xbff928e0) 
  
  
  0x00688bdc 

Comment 6

[Gagan]

looks like cache.

Comment 7

[davidm]

Can anyone reproduce this under nt/linux/mac? I can't using the builds from 4/
10/00. I looked at the code and I am not sure how it can be crashing since we 
seem to check for null points, and the math seems to be correct for avoiding 
buffer overruns. The use of _ for member variables seems wrong to me but I would 
imagine if that was causing crashes we would be seeing them all over the place.

Comment 8

[Warren Harris]

Looks like a dup of bug 34743.

Comment 9

[davidm]

*** This bug has been marked as a duplicate of 34743 ***

Comment 10

[Tom Everingham]

verifying dupe of 34743