63523 - Crash downloading news articles

Status: VERIFIED DUPLICATE of bug 63529

(MailNews Core :: Networking: NNTP, defect)

Description

[Stephen Moehle]

Mozilla is very reliably crashing when downloading news articles from
news.mozilla.org.  It always seems to happen on the second news group for which
articles are downloaded.  It also seems necessary to read at least one article
in the first group before downloading the second.  I created a new profile to no
avail: Mozilla still crashed.

To reproduce:
1) Download articles for a group on news.mozilla.org.
2) Read at leaast 1 article.
3) Download articles for another group.  Mozilla should crash at this point.

Talkback IDs: TB23391099G and TB23390978X

Tested with Mozilla 121505 on NT4.

Comment 1

[laurel]

From talkback incident 23391099:
 Call Stack:     (Signature = nsWebShell::OnStateChange 5662db11)
     nsWebShell::OnStateChange
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 907]
     nsDocLoaderImpl::FireOnStateChange
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 1279]
     nsDocLoaderImpl::doStopDocumentLoad
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 718]
     nsDocLoaderImpl::DocLoaderIsEmpty
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 623]
     nsDocLoaderImpl::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 557]
     nsLoadGroup::RemoveChannel
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 583]
     nsJARChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 709]
     nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 302]
     nsStreamListenerEvent::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 101]
     PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 577]
     PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 513]
     _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 1055]
<../images/spacer.gif>

From talkback 23390978:
 Call Stack:     (Signature = nsWebShell::OnStateChange c871a6b8)
     nsWebShell::OnStateChange
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 907]
     nsDocLoaderImpl::FireOnStateChange
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 1279]
     nsDocLoaderImpl::doStopDocumentLoad
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 718]
     nsDocLoaderImpl::DocLoaderIsEmpty
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 623]
     nsDocLoaderImpl::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 557]
     nsLoadGroup::RemoveChannel
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 583]
     nsNNTPProtocol::CleanupAfterRunningUrl
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 5215]
     nsNNTPProtocol::ProcessProtocolState
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 5183]
<../images/spacer.gif>

Comment 2

[[e-mail] (gone - use [e-mail] instead)]

Could you test on a new build please?  I noticed you're using a build from the
15th...I tried to reproduce but couldn't, I'm on Windows 2000.  What Service
Pack do you have on your machine?

Comment 3

[Stephen Moehle]

Sorry, I slipped when I typed the build number.  I am really using 122105.  I
have NT4 with service pack 6a.

Comment 4

[(not reading, please use [e-mail] instead)]

accepting.

alecf and I both see this.

Comment 5

[Blake Ross]

prob a dup of the nsWebShell::OnStateChange topcrash...

Comment 6

[[e-mail] (gone - use [e-mail] instead)]

I really this is a DUP of 63529, which is about crashing using a null pointer 
check in doQueryInterface.

*** This bug has been marked as a duplicate of 63529 ***

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

VERIFIED DUP.

Comment 8

[(not reading, please use [e-mail] instead)]

*** Bug 63583 has been marked as a duplicate of this bug. ***

Comment 9

[[e-mail] (gone - use [e-mail] instead)]

*** Bug 63645 has been marked as a duplicate of this bug. ***