652761 - ABORT: half open complete but no item: 'index != -1' with embedded src port 80000

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: testcase

1. http://www.radiofunn.ro/
2. nsHttpConnectionMgr::nsHalfOpenSocket::~nsHalfOpenSocket() [nsHttpConnectionMgr.cpp : 1225 + 0x20]

<Embed type="application/x-mplayer2" src="http://www.example.com:80000">

mac,linux,winxp mozilla-central

Comment 1

[Bob Clary [:bc] (inactive)]

bork! bork!

Comment 2

[Patrick McManus [:mcmanus]]

I'll investigate this first thing.

Comment 3

[Patrick McManus [:mcmanus]]

Attachment: fix out of range port v1

The problem, as you may have surmised, is due to the port 80,000 in the example and an early failure to create the transport object.

fix attached, complete with test case.

this bug is on aurora too, I'll need to go read some archived mail/posts to figure out what to do about that.

Comment 4

[Patrick McManus [:mcmanus]]

This is a trivial fix to an error path potential crash in the syn-retry FF5 feature - setting tracking flags to what I hope are appropriate values :)

Comment 5

[Johnny Stenback (:jst)]

Let us know when we have a patch ready for approval. We're likely to approve a reviewed patch here, but we won't be tracking this.

Comment 6

[Honza Bambas (:mayhemer)]

Comment on attachment 528310 [details] [diff] [review]
fix out of range port v1

I'd rather use RemoveElement and ignore its result here then.  It does the same but in more encapsulated way.  Also the code will be cleaner.

r=honzab with that.

Good catch.

Comment 7

[Patrick McManus [:mcmanus]]

Attachment: fix out of range port v2

update from review comment 6 - carry forward r=honzab

Comment 8

[Patrick McManus [:mcmanus]]

http://hg.mozilla.org/mozilla-central/rev/3723e9c3557e

Comment 9

[Patrick McManus [:mcmanus]]

http://hg.mozilla.org/mozilla-aurora/rev/c90cd210cad3