44562 - Links and bookmarks to bugzilla queries broken

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[Alec Flett]

I'm only seeing this on linux today, but I've seen it on windows in the past..

basically, it seems like links to bugzilla qeries don't seem to work. a
perfectly good example is the smoketest blockers link on tinderbox. My theory is
that this has something to do with a race condition and multipart/related (at
least I think that's the mime type) that bugzilla uses ti display it's "please
stand by" page while it does it's query.

Comment 1

[Alec Flett]

oh, another thing that makes me think it's a race condition is that if I load
the same bookmark/link multiple times, I get different amounts of the page
loading each time.. though never more than the first 20% or so..

Comment 2

[Alec Flett]

ok, one MORE think I noticed, thanks to purify:

(might be unrelated, and it is only one byte at the end of an array, but you 
never know - I do find it interesting that it's in the multipart/mixed code)

            [E] ABR: Array bounds read in 
nsMultiMixedConv::OnDataAvailable(nsIChannel *,nsISupports *,nsIInputStream 
*,UINT,UINT) {1 occurrence}
                Reading 1 byte from 0x09c0051b (1 byte at 0x09c0051b illegal)
                Address 0x09c0051b is 1 byte past the end of a 19 byte block at 
0x09c00508
                Address 0x09c0051b points to a malloc'd block in heap 0x03180000
                Thread ID: 0x854
                Error location
                nsMultiMixedConv::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsMultiMixedConv.cpp:121]
                    PRInt8 tokenLinefeed = 1;
                    while ( (token = FindToken(cursor, bufLen)) ) {
                
             =>         if (*(token+mTokenLen+1) == '-') {
                            // This was the last delimiter so we can stop 
processing
                            bufLen = token - cursor;
                            rv = SendData(cursor, bufLen);
                nsDocumentOpenInfo::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsURILoader.cpp:249]
                nsHTTPFinalListener::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPResponseListener.cpp:1228]
                InterceptStreamListener::OnDataAvailable(nsIChannel 
*,nsISupports *,nsIInputStream *,UINT,UINT) [nsCachedNetData.cpp:1164]
                nsHTTPChunkConv::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPChunkConv.cpp:210]
                nsHTTPServerListener::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPResponseListener.cpp:554]
                nsOnDataAvailableEvent::HandleEvent(void) 
[nsAsyncStreamListener.cpp:401]
                nsStreamListenerEvent::HandlePLEvent(PLEvent *) 
[nsAsyncStreamListener.cpp:97]
                md_EventReceiverProc [plevent.c:1032]
                SetTimer       [user32.dll]
                Allocation location
                malloc         [dbgheap.c:129]
                PR_Malloc      [prmem.c:38]
                nsMemoryImpl::Alloc(UINT) [nsMemoryImpl.cpp:104]
                nsDocumentOpenInfo::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsURILoader.cpp:249]
                nsHTTPFinalListener::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPResponseListener.cpp:1228]
                InterceptStreamListener::OnDataAvailable(nsIChannel 
*,nsISupports *,nsIInputStream *,UINT,UINT) [nsCachedNetData.cpp:1164]
                nsHTTPChunkConv::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPChunkConv.cpp:210]
                nsHTTPServerListener::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPResponseListener.cpp:554]
                nsOnDataAvailableEvent::HandleEvent(void) 
[nsAsyncStreamListener.cpp:401]
                nsStreamListenerEvent::HandlePLEvent(PLEvent *) 
[nsAsyncStreamListener.cpp:97]
            [E] ABR: Array bounds read in nsMultiMixedConv::PushOverLine(char 
*&,UINT&) {1 occurrence}
                Reading 1 byte from 0x09c0051b (1 byte at 0x09c0051b illegal)
                Address 0x09c0051b is 1 byte past the end of a 19 byte block at 
0x09c00508
                Address 0x09c0051b points to a malloc'd block in heap 0x03180000
                Thread ID: 0x854
                Error location
                nsMultiMixedConv::PushOverLine(char *&,UINT&) 
[nsMultiMixedConv.cpp:433]
                nsMultiMixedConv::PushOverLine(char *&aPtr, PRUint32 &aLen) {
                    PRInt8 chars = 0;
                    if (*aPtr == CR || *aPtr == LF) {
             =>         if (aPtr[1] == LF)
                            chars++;
                        chars++;
                        }
                nsMultiMixedConv::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsMultiMixedConv.cpp:141]
                nsDocumentOpenInfo::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsURILoader.cpp:249]
                nsHTTPFinalListener::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPResponseListener.cpp:1228]
                InterceptStreamListener::OnDataAvailable(nsIChannel 
*,nsISupports *,nsIInputStream *,UINT,UINT) [nsCachedNetData.cpp:1164]
                nsHTTPChunkConv::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPChunkConv.cpp:210]
                nsHTTPServerListener::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPResponseListener.cpp:554]
                nsOnDataAvailableEvent::HandleEvent(void) 
[nsAsyncStreamListener.cpp:401]
                nsStreamListenerEvent::HandlePLEvent(PLEvent *) 
[nsAsyncStreamListener.cpp:97]
                md_EventReceiverProc [plevent.c:1032]
            Allocation location
                malloc         [dbgheap.c:129]
                PR_Malloc      [prmem.c:38]
                nsMemoryImpl::Alloc(UINT) [nsMemoryImpl.cpp:104]
                nsDocumentOpenInfo::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsURILoader.cpp:249]
                nsHTTPFinalListener::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPResponseListener.cpp:1228]
                InterceptStreamListener::OnDataAvailable(nsIChannel 
*,nsISupports *,nsIInputStream *,UINT,UINT) [nsCachedNetData.cpp:1164]
                nsHTTPChunkConv::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPChunkConv.cpp:210]
                nsHTTPServerListener::OnDataAvailable(nsIChannel *,nsISupports 
*,nsIInputStream *,UINT,UINT) [nsHTTPResponseListener.cpp:554]
                nsOnDataAvailableEvent::HandleEvent(void) 
[nsAsyncStreamListener.cpp:401]
                nsStreamListenerEvent::HandlePLEvent(PLEvent *) 
[nsAsyncStreamListener.cpp:97]

Comment 3

[Asa Dotzler [:asa]]

reassigning to just gagan per dawn's request (two owners doesn't work)

Comment 4

[Alec Flett]

Trying to use the browser, I'm finding I can't look at my bug lists due to these
bugs, and I have to go back to 4.x.. guess that makes this a dogfood bug too.

Comment 5

[Jay Patel [:jay]]

Putting on [dogfood+][nsbeta2+] radar. 

Comment 6

[Gagan]

ruslan checked in a fix for this. pls. confirm this with a newer build. 

Comment 7

[Gagan]

ah! meant to give this to ruslan. 

Comment 8

[ruslan]

Yes. This is fixed.

Comment 9

[Tom Everingham]

tested with own and tinderbox links

verified:
Linux 2000071008
WinNT 2000071008