71146 - crash in nsSound::OnStreamComplete

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[cls]

This started after the tree opened this afternoon.  Whenver I log into the imap
server, the app crashes.  The stack trace shows it dying in
nsSound::OnStreamComplete doing a NULL check using strncmp.  Shouldn't that be
PL_strncmp (which has null args checks)?  And should OnStreamComplete be called
with a null arg?


(gdb) bt
#0  strncmp (s1=0x0, s2=0x2aff68c9 "RIFF", n=4)
    at ../sysdeps/generic/strncmp.c:42
#1  0x2afd48ad in nsSound::OnStreamComplete ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/components/libwidget_gtk.so
#2  0x2ab8b2b8 in XPTC_InvokeByIndex ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/libxpcom.so
#3  0x2ab7b340 in EventHandler ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/libxpcom.so
#4  0x2ab762dd in PL_HandleEvent ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/libxpcom.so
#5  0x2ab759a2 in PL_ProcessPendingEvents ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/libxpcom.so
#6  0x2ab76cdf in nsEventQueueImpl::ProcessPendingEvents ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/libxpcom.so
#7  0x2afc9509 in event_processor_callback ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/components/libwidget_gtk.so
#8  0x2afc930e in our_gdk_io_invoke ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/components/libwidget_gtk.so
#9  0x2b164aca in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0
#10 0x2b166186 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#11 0x2b166751 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#12 0x2b1668f1 in g_main_run () from /usr/lib/libglib-1.2.so.0
#13 0x2b08e5b9 in gtk_main () from /usr/lib/libgtk-1.2.so.0
---Type <return> to continue, or q <return> to quit---
#14 0x2afc95a2 in nsAppShell::Run ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/components/libwidget_gtk.so
#15 0x2ae603e8 in ?? ()
   from /usr/cls/moz/main/obj-opt-O3/dist/bin/components/libnsappshell.so
#16 0x804dc4d in main1 ()
#17 0x804e50f in main ()
#18 0x2ad239cb in __libc_start_main (main=0x804e428 <main>, argc=1, 
    argv=0x7ffff7e4, init=0x804a6f8 <_init>, fini=0x8053cf0 <_fini>, 
    rtld_fini=0x2aab5ea0, stack_end=0x7ffff7dc)
    at ../sysdeps/generic/libc-start.c:92
(gdb)

Comment 1

[cls]

-  if (strncmp(string, "RIFF", 4)) {
+  if (PL_strncmp(string, "RIFF", 4)) {

That tweak appears to have fixed the crash problem for me but I still don't
think OnStreamComplete should be called with an empty string.

Comment 2

[Syd Logan]

r=syd

Comment 3

[Asa Dotzler [:asa]]

*** Bug 71188 has been marked as a duplicate of this bug. ***

Comment 4

[Asa Dotzler [:asa]]

updating severity.  This is a smoketest blocker.  This does not crash today's
mac or win32 builds.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 71187 has been marked as a duplicate of this bug. ***

Comment 6

[Alec Flett]

sr=alecf

Comment 7

[Paul Chen]

cls's "tweak" checked into tree, marking fixed

Comment 8

[Paul Chen]

marking severity critical to get off smoketest blocker list

Comment 9

[Tracy Walker [:tracy]]

verified fixed on linux commercial build 2001-03-08-09-mtrunk