86121 - Loading nonexistent URL crashes Mozilla on Linux

Status: VERIFIED DUPLICATE of bug 85802

(Core :: Networking, defect)

Description

[Dan Rosen]

Attempting to load a nonexistent url, I crash (on Linux only -- this seems to be
fine on Windows) with a slightly odd stacktrace maybe pointing half at HTTP and
half at XPCOM:

(gdb) where
#0  chunk_alloc (ar_ptr=0x42e00010, nb=49) at malloc.c:2896
#1  0x4060528a in __libc_malloc (bytes=40) at malloc.c:2714
#2  0x4029f1de in PR_Malloc (size=40) at prmem.c:38
#3  0x40137dde in nsProxyObject::Post (this=0x8760340, methodIndex=4,
    methodInfo=0x81f5834, params=0xbf7ff840, interfaceInfo=0x80d8590) at
    nsProxyEvent.cpp:407
#4  0x4013a834 in nsProxyEventObject::CallMethod (this=0x88e5b48, methodIndex=4,
    info=0x81f5834, params=0xbf7ff840) at nsProxyEventObject.cpp:463
#5  0x4015342f in PrepareAndDispatch (self=0x88e5b48, methodIndex=4,
    args=0xbf7ff900) at xptcstubs_unixish_x86.cpp:80
#6  0x4015350d in nsXPTCStubBase::Stub4 (this=0x88e5b48) at
    ../../../../../../dist/include/xptcstubsdef.inc:6
#7  0x409495df in nsHttpConnection::OnStatus (this=0x875fce8, req=0x88e5180,
    ctx=0x0, status=2152398851, statusText=0xbf7ff964) at
    nsHttpConnection.cpp:602
#8  0x408ff885 in nsSocketTransport::OnStatus (this=0x8760118, req=0x88e5180,
    ctxt=0x0, message=2152398851) at nsSocketTransport.cpp:1793
#9  0x408ff909 in nsSocketTransport::OnStatus (this=0x8760118,
    message=2152398851) at nsSocketTransport.cpp:1807
#10 0x408fbed4 in nsSocketTransport::Process (this=0x8760118, aSelectFlags=0) at
    nsSocketTransport.cpp:461
#11 0x4090310f in nsSocketTransportService::ProcessWorkQ (this=0x81283a8) at
    nsSocketTransportService.cpp:243
#12 0x4090388f in nsSocketTransportService::Run (this=0x81283a8) at
    nsSocketTransportService.cpp:446
#13 0x40133f69 in nsThread::Main (arg=0x8128700) at nsThread.cpp:105
#14 0x402b8406 in _pt_root (arg=0x8128778) at ptthread.c:198
#15 0x402d9c8e in pthread_start_thread_event (arg=0xbf7ffc00) at manager.c:274

Not sure this is HTTP's problem, though, since the crash seems to be in:

  PLEvent *event = PR_NEW(PLEvent);

called from nsProxyObject (nsProxyEvent.cpp). CC'ing dougt.

Comment 1

[Dan Rosen]

One piece of info I overlooked:

###!!! ASSERTION: lookup deleted while on list: 'PR_CLIST_IS_EMPTY(this)', file
nsDnsService.cpp, line 540

Possibly related, maybe not...

By the way, this is with yesterday (14 June 2001) CVS tip build. I don't know if
this problem appears in the verif. builds from yesterday. To reproduce, just
start mozilla, load a bogus URL, and crash.

Comment 2

[Dan Rosen]

Just found Gordon's fix for this in yesterday afternoon's tinderbox log. Marking
dup.

*** This bug has been marked as a duplicate of 85802 ***

Comment 3

[Alex Stewart]

The stacks differ, but the summary is the same.  Unless someone wants to keep
this bug around for the stack trace, I'm marking this a verified dup of bug
85802 - Failed DNS lookup results in segfault.