Bug 641422

Summary: [abrt] thunderbird-3.1.4-1.fc14: raise: Process /usr/lib64/thunderbird-3.1/thunderbird-bin was killed by signal 11 (SIGSEGV) in #2 <signal handler called> No symbol table info available. #3 nsSSLThread::requestRecvMsgPeek()
Product: [Fedora] Fedora Reporter: Orion Poplawski <orion>
Component: thunderbirdAssignee: Gecko Maintainer <gecko-bugs-nobody>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 14CC: gecko-bugs-nobody, mcepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: abrt_hash:0a9b4f464b249d91656816f96110913a86785063
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-12-17 23:41:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
Part of the thread where crash happened none

Description Orion Poplawski 2010-10-08 16:57:09 UTC 
abrt version: 1.1.13
architecture: x86_64
Attached file: backtrace
cmdline: /usr/lib64/thunderbird-3.1/thunderbird-bin
component: thunderbird
crash_function: raise
executable: /usr/lib64/thunderbird-3.1/thunderbird-bin
kernel: 2.6.35.4-28.fc14.x86_64
package: thunderbird-3.1.4-1.fc14
rating: 4
reason: Process /usr/lib64/thunderbird-3.1/thunderbird-bin was killed by signal 11 (SIGSEGV)
release: Fedora release 14 (Laughlin)
time: 1286556319
uid: 1744

How to reproduce
-----
1. Started thunderbird and entered password
2. Closed welcome tab
3. Crashed while first connecting to server
Comment 1 Orion Poplawski 2010-10-08 16:57:10 UTC 
Created attachment 452382 [details]
File: backtrace
Comment 2 Orion Poplawski 2010-10-08 17:19:26 UTC 
#2  <signal handler called>
No symbol table info available.
#3  nsSSLThread::requestRecvMsgPeek (si=0x7ff51c7ea700, buf=0x7fffd591c07f, amount=1, flags=2, timeout=<value optimized out>) at /usr/include/bits/string3.h:52
        threadLock = {<nsAutoLockBase> = {<No data fields>}, mLock = 0x7ff51c4a71c0, mLocked = 1}
        realSSLFD = <value optimized out>
#4  0x00007ff525c91bad in PSMRecv (fd=0x7ff5223606a0, buf=<value optimized out>, amount=<value optimized out>, flags=2, timeout=<value optimized out>) at /usr/src/debug/thunderbird-3.1.4/comm-1.9.2/mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp:2078
        locker = {<No data fields>}
        socketInfo = <value optimized out>
#5  0x00007ff52777089a in nsSocketTransport::IsAlive (this=0x7ff51c88aba0, result=0x7fffd591c0e8) at /usr/src/debug/thunderbird-3.1.4/comm-1.9.2/mozilla/netwerk/base/src/nsSocketTransport2.cpp:1808
        fd = 0x7ff5223606a0
        c = 0 '\000'
        rval = <value optimized out>


Code:

          PRInt32 return_amount = NS_MIN(amount, si->mThreadData->mSSLResultRemainingBytes);
                                                                                
          memcpy(buf, si->mThreadData->mSSLRemainingReadResultData, return_amount);


(gdb) print amount
$2 = 1
(gdb) print si->mThreadData->mSSLResultRemainingBytes
$3 = 0
(gdb) print si->mThreadData->mSSLRemainingReadResultData
$1 = 0x0

There's your null pointer.
Comment 3 Orion Poplawski 2010-11-04 14:43:17 UTC 
*** Bug 649774 has been marked as a duplicate of this bug. ***
Comment 4 Matěj Cepl 2010-12-17 23:34:50 UTC 
Created attachment 469474 [details]
Part of the thread where crash happened
Comment 5 Matěj Cepl 2010-12-17 23:41:04 UTC 

*** This bug has been marked as a duplicate of bug 641104 ***