62752 - Back button crashes browser

Status: VERIFIED WORKSFORME

(Core :: DOM: Navigation, defect, P3)

Description

[Jeffrey Baker]

Use the back button, crash the browser.  Tested on Linux 2000-12-13-06 SEA
Installer build.

Comment 1

[Jeffrey Baker]

Specifically:

Go to http://www.yahoo.com/, and click on one of the categories.  Click the Back
button.  The content area of the browser stops redrawing invalidated areas.
Click the Forward button.  The browser exits with a segmentation fault.

Clicking Back and Forward twice or three times on any site crashes the browser.

Comment 2

[Jeffrey Baker]

[e-mail] was gardening in history yesterday.  CCing him.

Comment 3

[Jeffrey Baker]

Weird.  I get the same symptoms from clicking the throbber once or twice or
thrice.  That's the very first smoketest.

Comment 4

[Jon Granrose]

I see this on my RH 6.2 box.  Go to yahoo, click News, click the back button,
crash.  If climate ever gets my talkback report, I'll paste the stack in here.

holding the tree for this one.

Comment 5

[Alec Flett]

I was working with global history, not session history, I doubt it's related..
but I'll at least try to get a stack trace now

Comment 6

[Jon Granrose]

stack trace from my talkback report is:
Distance()
nsScanner::RewindToMark()
nsParser::Tokenize()
nsParser::ResumeParse()
nsParser::OnStopRequest()
nsDocumentOpenInfo::OnStopRequest()
nsHTTPFinalListener::OnStopRequest()
nsHTTPChannel::ResponseCompleted()
nsHTTPCacheListener::OnStopRequest()
AsyncReadStreamAdaptor::OnStopRequest()
nsOnStopRequestEvent::HandleEvent()
nsStreamListenerEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0xe52a (0x4061f52a)
libglib-1.2.so.0 + 0xfbe6 (0x40620be6)
libglib-1.2.so.0 + 0x101a1 (0x406211a1)
libglib-1.2.so.0 + 0x10341 (0x40621341)
libgtk-1.2.so.0 + 0x8c209 (0x4054b209)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x181eb (0x402381eb) 

Comment 7

[harishd]

This could be related to Vidur's checkin.. I'll take a look into it
once my build is done.

Comment 8

[Radha on family leave (not reading bugmail)]

I can't reproduce the crash after playing with the back/forward buttons for 15
minutes in my NT box. Nor did I crash when using the throbber atleast5 times

Comment 9

[Jon Granrose]

try it on linux.

Comment 10

[Mike Kaply [:mkaply]]

*** Bug 62745 has been marked as a duplicate of this bug. ***

Comment 11

[Peter "jag" Annema]

Click the url in this bug, click a category, go back:

10:
###!!! Break: at file nsAlgorithm.h, line 77
###!!! ASSERTION: |copy_string| will never terminate: 'count_copied > 0', file
nsAlgorithm.h, line 77
goto 10

In an optimized build, this will crash you real fast.

Comment 12

[Jon Granrose]

I haven't been able to narrow this down yet. Sometimes it crashes when I click
Back, sometimes it doesn't refresh and becomes unusable.  Either way, it's a
blocker.  We need a plan of attack at the very least if we're going to open the
tree today.

Comment 13

[Peter "jag" Annema]

So I'm gonna venture a few guesses here...

|copy_string| in nsAlgorithm.h uses a PRInt32 for |count_copied|, while |write|
in nsCharSinkTraits (nsCharTraits.h) returns a PRUint32. This could result in a
possible overflow, which seems to be the case here, resulting in a negative
number and hence the assertion. Changing this to a PRUint32 causes the iterator
to try and go beyond the end of the string, confirming this suspiscion.

I've quickly glanced over the relevant code but haven't found anything which
sprung out as odd.

Comment 14

[Radha on family leave (not reading bugmail)]

Giving it to Harish who was the last person to actively work on this bug.

Comment 15

[Claudius Gayle]

for what it's worth I'm unable to repro this with RH6 and the 2000121308
build.

Comment 16

[harishd]

I'm not seeing this crash whatsoever!!!!!!  Should the tree be closed for 
something that cannot be reproduced easily???

Comment 17

[Peter "jag" Annema]

harishd: I can trigger this by going to www.yahoo.com, clicking on the auctions
link, then go back (alt-left or click the button) while the page is loading.

Comment 18

[Peter "jag" Annema]

Apparantly rpotts checked in some stuff to fix this around 3pm pst. It isn't
showing on the tinderbox, but it's there. We've opened the tree for now since
harishd couldn't reproduce it with that fix in, I'll see if I can confirm it
being gone when my build finishes (forgot to update xpcom and build that, so
gonna take a bit longer).

Comment 19

[Blake Ross]

downgrading unless still reproducible.

Comment 20

[Jeffrey Baker]

Looks fixed to me.  Linux 2000-12-14-11.

Comment 21

[Fabian Guisset]

*** Bug 62988 has been marked as a duplicate of this bug. ***

Comment 22

[Peter "jag" Annema]

Well, I don't crash any longer, so I guess it was fixed.

Marking WORKSFORME.

Comment 23

[Viswanath Ramachandran]

Nav triage team: we believe this works now. marking fixed. 

Comment 24

[sairuh (rarely reading bugmail)]

mass-verifying WorksForMe bugs which haven't changed since 2001.12.31.

set your search string in mail to "EmperorLondoMollari" to filter out these
messages.