39607 - Crash if you save multiple logins for same site

Status: VERIFIED FIXED

(SeaMonkey :: Passwords & Permissions, defect, P3)

Description

[Stephen P. Morse]

-Go to a site requiring http authentication.
-Popup dialog appears asking for username and password
-Enter any arbitrary username and password and check the save button.
-Press OK
-Exit and reenter browser

-Go back to same site
-Popup dialog appears with prefilled username and password
-Change the username, check the save button, and press OK
-Exit and reenter browser

-Go back to same site
-Assertion failure occurs with stacktrace shown below
-Resume from assertion
-Crash with stacktrace shown below

Expected results: Instead of the assertion failure, a dialog to select the 
appropriate username is supposed to appear.

Note: this bug could be better demonstrated by using a site that presents a 
login in the site's content (i.e., a server-generated log-in form).  
Unfortuantely I cannot demonstrate that due to bug 39430.


STACKTRACE AT TIME OF ASSERTION FAILURE

NTDLL! 77f76274()
nsDebug::Assertion(const char * 0x02972e64 
??_C@_0DJ@KMGL@You?5can?8t?5dereference?5a?5NULL?5nsC@, const char * 0x02972ea8 
??_C@_0N@NHHF@mRawPtr?5?$CB?$DN?50?$AA@, const char * 0x02972eb8 
??_C@_0CB@MCGB@?4?4?2?4?4?2?4?4?2dist?2include?2nsCOMPtr?4h@, int 623) line 242 
+ 13 bytes
nsDebug::PreCondition(const char * 0x02972e64 
??_C@_0DJ@KMGL@You?5can?8t?5dereference?5a?5NULL?5nsC@, const char * 0x02972ea8 
??_C@_0N@NHHF@mRawPtr?5?$CB?$DN?50?$AA@, const char * 0x02972eb8 
??_C@_0CB@MCGB@?4?4?2?4?4?2?4?4?2dist?2include?2nsCOMPtr?4h@, int 623) line 337 
+ 21 bytes
nsCOMPtr<nsIPrompt>::operator->() line 623 + 34 bytes
si_SelectDialog(const unsigned short * 0x038a6f70, unsigned short * * 
0x038a0b70, int * 0x0012f0c0) line 139 + 34 bytes
si_GetUser(const char * 0x0012f5bc, int 0, nsAutoString {"\=username=\"}) line 
985 + 25 bytes
si_RestoreOldSignonDataFromBrowser(const char * 0x0012f5bc, int 0, nsAutoString 
& {""}, nsAutoString & {""}) line 2163 + 45 bytes
SINGSIGN_PromptUsernameAndPassword(const unsigned short * 0x00000000, const 
unsigned short * 0x038a5370, unsigned short * * 0x0012f908, unsigned short * * 
0x0012f8f8, const char * 0x0012f5bc, nsIPrompt * 0x02e8b7d0, int * 0x0012f7c4, 
int 0) line 2227 + 25 bytes
nsSingleSignOnPrompt::PromptUsernameAndPassword(nsSingleSignOnPrompt * const 
0x02e8cfa0, const unsigned short * 0x00000000, const unsigned short * 
0x038a5370, const unsigned short * 0x0012f878, int 0, unsigned short * * 
0x0012f908, unsigned short * * 0x0012f8f8, int * 0x0012f7c4) line 448 + 51 bytes
nsHTTPChannel::Authenticate(const char * 0x038a54a0, int 0) line 1844 + 83 bytes
nsHTTPChannel::ProcessAuthentication(int 401) line 2237 + 31 bytes
nsHTTPChannel::ProcessStatusCode() line 2059 + 12 bytes
nsHTTPChannel::FinishedResponseHeaders() line 1950 + 8 bytes
nsHTTPServerListener::FinishedResponseHeaders() line 1063 + 11 bytes
nsHTTPServerListener::OnDataAvailable(nsHTTPServerListener * const 0x038a25e0, 
nsIChannel * 0x038a0514, nsISupports * 0x038a23a0, nsIInputStream * 0x038a5c5c, 
unsigned int 0, unsigned int 0) line 405 + 8 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x038a2780) 
line 406 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x038a2100) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x038a2100) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010f69d0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0d340458, unsigned int 49424, unsigned int 0, 
long 17787344) line 1030 + 9 bytes
USER32! 77e71268()
010f69d0()

STACKTRACE AT TIME OF CRASH

si_SelectDialog(const unsigned short * 0x038a6f70, unsigned short * * 
0x038a0b70, int * 0x0012f0c0) line 139 + 40 bytes
si_GetUser(const char * 0x0012f5bc, int 0, nsAutoString {"\=username=\"}) line 
985 + 25 bytes
si_RestoreOldSignonDataFromBrowser(const char * 0x0012f5bc, int 0, nsAutoString 
& {""}, nsAutoString & {""}) line 2163 + 45 bytes
SINGSIGN_PromptUsernameAndPassword(const unsigned short * 0x00000000, const 
unsigned short * 0x038a5370, unsigned short * * 0x0012f908, unsigned short * * 
0x0012f8f8, const char * 0x0012f5bc, nsIPrompt * 0x02e8b7d0, int * 0x0012f7c4, 
int 0) line 2227 + 25 bytes
nsSingleSignOnPrompt::PromptUsernameAndPassword(nsSingleSignOnPrompt * const 
0x02e8cfa0, const unsigned short * 0x00000000, const unsigned short * 
0x038a5370, const unsigned short * 0x0012f878, int 0, unsigned short * * 
0x0012f908, unsigned short * * 0x0012f8f8, int * 0x0012f7c4) line 448 + 51 bytes
nsHTTPChannel::Authenticate(const char * 0x038a54a0, int 0) line 1844 + 83 bytes
nsHTTPChannel::ProcessAuthentication(int 401) line 2237 + 31 bytes
nsHTTPChannel::ProcessStatusCode() line 2059 + 12 bytes
nsHTTPChannel::FinishedResponseHeaders() line 1950 + 8 bytes
nsHTTPServerListener::FinishedResponseHeaders() line 1063 + 11 bytes
nsHTTPServerListener::OnDataAvailable(nsHTTPServerListener * const 0x038a25e0, 
nsIChannel * 0x038a0514, nsISupports * 0x038a23a0, nsIInputStream * 0x038a5c5c, 
unsigned int 0, unsigned int 0) line 405 + 8 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x038a2780) 
line 406 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x038a2100) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x038a2100) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010f69d0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0d340458, unsigned int 49424, unsigned int 0, 
long 17787344) line 1030 + 9 bytes
USER32! 77e71268()
010f69

Comment 1

[Stephen P. Morse]

Note: this is a regression caused by the extensive modifications that warren 
made to the single-signon module and their use of dialogs.  The problem is 
probably in the call to the select-user dialog.

Comment 2

[leger]

Adding crash keyword

Comment 3

[sairuh (rarely reading bugmail)]

*** Bug 39750 has been marked as a duplicate of this bug. ***

Comment 4

[Stephen P. Morse]

Fix checked in.  Change was in singsign.cpp.

Comment 5

[Blake Ross]

would be happy to verify, but the URL given is obviously nscp internal and at 
the moment I can't find an url requiring http auth.  sairuh/anyone got a public 
one?

Comment 6

[Blake Ross]

OK, found an auth URL - http://www.huwig.de/docs/

I did notice that such dialogs as the auth one and the select user one remained 
open after closing the browser (this already reported?)  Other than that, 
however, it all seemed to work fine on 53108 win2k/win me

vrfy

Comment 7

[Dagfinn I. Mannsåker]

i'm seeing this again on 2000122208/linux... It draws the dialog box for
selecting, and then segfaults. on the console I see:

selectDialogOnLoad
message: Select a username to be entered on this form.
title: Select User
setting string 214943
setting string 214943
/home/ilmari/package/run-mozilla.sh: line 72:  2772 Segmentation fault
$prog ${1+"$@"}

Comment 8

[Stephen P. Morse]

This was fixed but it looks like there might be a recent regression that is now 
causing this symptom again.  Look at bug 63034 which is a dup of this 
one.