112144 - Attempt to reply to mail freezes entire Mozilla

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P3)

Description

[Jacob Hallén]

I have a mail that I have stored in a separate folder that locks up Mozilla when
I try to reply to it. The mail is in HTML format with an MS Word document attached.
When someone is assigned the bug, I'll send the file containing the folder by
email to the assignee.

Comment 1

[Karl Johan Kleist]

Jacob: Please include the "Build ID" in all bug reports. Thank you.

Comment 2

[Jacob Hallén]

Build ID is 2001112012.

The entry form reported that that information would automatically be included,
so I didn't put it in.

Comment 3

[Sheela Ravindran]

reporter,
Can you attach the message to the bug.  

Comment 4

[Jacob Hallén]

Attachment: Mail folder containing email with the problem

Comment 5

[Jacob Hallén]

Attachment: msf file for mail folder that contains mail with the problem

Comment 6

[Sheela Ravindran]

confirming this bug based on the email attachment in the bug. I did freeze while 
trying to reply to this message
commercial build: 2001-12-03-06 win98

Comment 7

[Jean-Francois Ducarroz]

We are stuck between nsDOMIterator::AppendList and nsHTMLEditor::IsEmptyNode.

here is the stack trace:

do_QueryReferent(nsIWeakReference * 0x055a2810, unsigned int * 0x00000000) line
88 + 16 bytes
nsEditor::GetPresShell(nsEditor * const 0x055c2880, nsIPresShell * * 0x0012e53c)
line 400 + 23 bytes
nsEditor::IsEditable(nsIDOMNode * 0x061bc578) line 3628 + 39 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc578, int * 0x0012e6c4, int
0x00000000, int 0x00000000, int 0x00000000) line 4751 + 20 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc5d8, int * 0x0012e7ac, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc698, int * 0x0012e894, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc6f8, int * 0x0012e97c, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc758, int * 0x0012ea64, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc7b8, int * 0x0012eb4c, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc938, int * 0x0012ec34, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc998, int * 0x0012ed1c, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bc9f8, int * 0x0012ee04, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsHTMLEditor::IsEmptyNode(nsIDOMNode * 0x061bca58, int * 0x0012ee64, int
0x00000000, int 0x00000000, int 0x00000000) line 4816 + 34 bytes
nsEmptyFunctor::operator()(nsIDOMNode * 0x061bca58) line 143 + 25 bytes
nsDOMIterator::AppendList(nsBoolDomIterFunctor & {...},
nsCOMPtr<nsISupportsArray> {...}) line 175 + 19 bytes
nsDOMIterator::MakeList(nsBoolDomIterFunctor & {...}, nsCOMPtr<nsISupportsArray>
* 0x0012ef5c) line 155 + 24 bytes
nsHTMLEditRules::AdjustSpecialBreaks(int 0x00000000) line 6055 + 25 bytes
nsHTMLEditRules::AfterEditInner(int 0x00000bc1, short 0x0001) line 390 + 10 bytes
nsHTMLEditRules::AfterEdit(nsHTMLEditRules * const 0x055c3424, int 0x00000bc1,
short 0x0001) line 332 + 20 bytes
nsHTMLEditor::EndOperation(nsHTMLEditor * const 0x055c2880) line 3689 + 62 bytes
nsAutoRules::~nsAutoRules() line 125
nsHTMLEditor::InsertAsCitedQuotation(nsHTMLEditor * const 0x055c291c, const
nsAString & {...}, const nsAString & {...}, int 0x00000001, const nsAString &
{...}, nsIDOMNode * * 0x0012f264) line 1672 + 16 bytes
nsHTMLEditorLog::InsertAsCitedQuotation(nsHTMLEditorLog * const 0x055c291c,
const nsAString & {...}, const nsAString & {...}, int 0x00000001, const
nsAString & {...}, nsIDOMNode * * 0x0012f264) line 444 + 29 bytes
nsEditorShell::InsertAsCitedQuotation(nsEditorShell * const 0x05337d00, const
unsigned short * 0x04ef81f8, const unsigned short * 0x056347d0, int 0x00000001,
const unsigned short * 0x045d0a54, nsIDOMNode * * 0x0012f264) line 2203 + 73 bytes
nsMsgCompose::ConvertAndLoadComposeWindow(nsMsgCompose * const 0x03f5ed40,
nsIEditorShell * 0x05337d00, nsString & {"hellohotels_reservation
wrote:<br><html>"}, nsString & {"<html>
<head>
<link rel="important stylesheet" href="chrome://messenger/skin/messageBody.css">
</head>
<body>
<br><hr width="9"}, nsString & ...) line 513 + 106 bytes
QuotingOutputStreamListener::OnStopRequest(QuotingOutputStreamListener * const
0x03f77c70, nsIRequest * 0x03f76ac4, nsISupports * 0x03f72c70, unsigned int
0x00000000) line 1986
nsStreamConverter::OnStopRequest(nsStreamConverter * const 0x03f794d0,
nsIRequest * 0x03f76ac4, nsISupports * 0x03f72c70, unsigned int 0x00000000) line
1059
nsMsgProtocol::OnStopRequest(nsMsgProtocol * const 0x03f76ac0, nsIRequest *
0x03f79b04, nsISupports * 0x03f72c70, unsigned int 0x00000000) line 299 + 88 bytes
nsMailboxProtocol::OnStopRequest(nsMailboxProtocol * const 0x03f76ac0,
nsIRequest * 0x03f79b04, nsISupports * 0x03f72c70, unsigned int 0x00000000) line 367
nsOnStopRequestEvent::HandleEvent() line 213
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x05633704) line 116
PL_HandleEvent(PLEvent * 0x05633704) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00504e50) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00410458, unsigned int 0x0000c0ca, unsigned int
0x00000000, long 0x00504e50) line 1071 + 9 bytes
USER32! 77e12e98()
USER32! 77e130e0()
USER32! 77e15824()
nsAppShellService::Run(nsAppShellService * const 0x0050ba70) line 303
main1(int 0x00000002, char * * 0x00484fb0, nsISupports * 0x00000000) line 1264 +
32 bytes
main(int 0x00000002, char * * 0x00484fb0) line 1594 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e

Comment 8

[Jean-Francois Ducarroz]

nominating nsbeta1. User should be able to reply to any message without hanging.

Comment 9

[Jean-Francois Ducarroz]

reassign to editor core.

Comment 10

[kinmoz]

Ick, what generated the HTML output in that mail message? Word? What version? It
contains 752 <font> and <strong> tags all nested to about 551 levels at the
deepest point. I wonder if we're blowing the stack as we recursively call
IsEmptyNode()?

Running on windows, loading the HTML into composer, causes it to chug away with
a stack similar to the one above, but then it looks like the thread eventually
dies or hangs in string code ... by die I mean that the thread just sits there
doing nothing. If I continue, and break in the debugger a few seconds/minutes
later, the thread is still sitting in the same string code, with the same
addresses on the stack. It's not an infinite loop either ... just stepping
(using F10 or F11 in VC) causes the program to continue.

Pushing this out to mozilla1.0.1 since the output is a bit extreme. We can
probably use the file for perf analysis later.

Comment 11

[Joe Francis]

reassigning to me.  likely a dup of 120000, but leaving seperate for now.  
setting 099 for now since i am actively working on 120000.

Comment 12

[Joe Francis]

oops, i meant 113691 instead of 120000.  Anyway, patch now attached in 113691.

Comment 13

[Kevin McCluskey (gone)]

Marking nsbeta1+

Comment 14

[Joe Francis]

fix landed on trunk

Comment 15

[sujay]

Jacob, is this fixed for you now? please verify....

Comment 16

[sujay]

Jacob, does this work for you now? please check...thanks.

Comment 17

[Jacob Hallén]

I only do release builds, so won't check until 0.9.9 is out. Sorry.

Comment 18

[sujay]

Olga, can you verify this when you get chance? see mail folder attachment
in the bug...thanks!

Comment 19

[Olga]

It is fine on Win2K after sending message with that cgi file and then Reply to
that message.

Comment 20

[sujay]

verifying per olga's comments...if still not fixed for anyone, please REOPEN.
thanks.