224313 - thunderbird crashes when clicking on mail/news accounts

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Frank Wein [:mcsmurf]]

first: i know this is the wrong component, but maybe some TB people can say
something to this bug before reassigning?
with current CVS trunk when i click on a news account (just mark it, dont need
to expand it), Thunderbird crashes. With Mozilla this doesn't happen.
stacktrace:
(gdb) bt
#0  nsCOMPtr<nsINodeInfo>::begin_assignment() (this=0x0) at nsCOMPtr.h:450
#1  0x411ffcee in XULContentSinkImpl::AddAttributes(unsigned short const**,
unsigned, nsXULPrototypeElement*) (this=0x879c3e8, aAttributes=0xbfffe7d0,
aAttrLen=0, aElement=0x87b7c08) at nsCOMPtr.h:714
#2  0x411ff010 in XULContentSinkImpl::OpenRoot(unsigned short const**, unsigned,
nsINodeInfo*) (this=0x879c3e8, aAttributes=0xbfffe7d0, aAttrLen=0,
aNodeInfo=0xbfffe6b4) at
/mozilla2/mozilla/content/xul/document/src/nsXULContentSink.cpp:1297
#3  0x411fd4ae in XULContentSinkImpl::HandleStartElement(unsigned short const*,
unsigned short const**, unsigned, int, unsigned) (this=0x879c3e8,
aName=0x4128babe, aAtts=0xbfffe7d0, aAttsCount=0, aIndex=-1, aLineNumber=0) at
nsCOMPtr.h:657
#4  0x411fe34f in XULContentSinkImpl::ReportError(unsigned short const*,
unsigned short const*) (this=0x879c3e8, aErrorText=0x87cb5f0,
aSourceText=0x87cb290) at nsBufferHandle.h:129
#5  0x40c4cd11 in nsExpatDriver::HandleError(char const*, unsigned, int)
(this=0x879fec8, aBuffer=0x87a1f70 "i", aLength=6054, aIsFinal=0) at nsString2.h:102
#6  0x40c4ce70 in nsExpatDriver::ParseBuffer(char const*, unsigned, int)
(this=0x879fec8, aBuffer=0x87a1f70 "i", aLength=6054, aIsFinal=0) at
/mozilla2/mozilla/htmlparser/src/nsExpatDriver.cpp:834
#7  0x40c4d099 in nsExpatDriver::ConsumeToken(nsScanner&, int&) (this=0x879fec8,
aScanner=@0x879d8d0, aFlushTokens=@0xbfffeb84) at nsStringIterator.h:89
#8  0x40c66223 in nsParser::Tokenize(int) (this=0x879c530, aIsFinalChunk=1) at
/mozilla2/mozilla/htmlparser/src/nsParser.cpp:2563
#9  0x40c644f8 in nsParser::ResumeParse(int, int, int) (this=0x879c530,
allowIteration=1, aIsFinalChunk=1, aCanInterrupt=1) at
/mozilla2/mozilla/htmlparser/src/nsParser.cpp:1764
#10 0x40c63851 in nsParser::ContinueParsing() (this=0x879c530) at
/mozilla2/mozilla/htmlparser/src/nsParser.cpp:1358
#11 0x41180ff0 in CSSLoaderImpl::SheetComplete(SheetLoadData*, int)
(this=0x879c478, aLoadData=0x879f448, aSucceeded=1) at nsCOMPtr.h:663
#12 0x41180fd7 in CSSLoaderImpl::SheetComplete(SheetLoadData*, int)
(this=0x879c478, aLoadData=0x87b2be8, aSucceeded=1) at
/mozilla2/mozilla/content/html/style/src/nsCSSLoader.cpp:1524
#13 0x41180fd7 in CSSLoaderImpl::SheetComplete(SheetLoadData*, int)
(this=0x879c478, aLoadData=0x87a5548, aSucceeded=1) at
/mozilla2/mozilla/content/html/style/src/nsCSSLoader.cpp:1524
#14 0x41180fd7 in CSSLoaderImpl::SheetComplete(SheetLoadData*, int)
(this=0x879c478, aLoadData=0x87b30b0, aSucceeded=1) at
/mozilla2/mozilla/content/html/style/src/nsCSSLoader.cpp:1524
#15 0x41180fd7 in CSSLoaderImpl::SheetComplete(SheetLoadData*, int)
(this=0x879c478, aLoadData=0x87b6f60, aSucceeded=1) at
/mozilla2/mozilla/content/html/style/src/nsCSSLoader.cpp:1524

Comment 1

[Frank Wein [:mcsmurf]]

-->sicking
backing out patch from bug 223470 resolved this problem

Comment 2

[Frederic Bezies]

Let's hope this bug will be fixed soon :)

/me hopes to contribute again with Thunderbird nightlies on mozillazine forums.

Comment 3

[Stephen Walker]

Thunderbird also crashes when a mail server is selected:

 	ntdll.dll!77f75a58() 	
 	xpcom.dll!nsDebugImpl::Break(const char * aFile=0x01ddc950, int
aLine=0x00000309)  Line 360	C++
 	xpcom.dll!nsDebugImpl::Assertion(const char * aStr=0x01ddc9a8, const char *
aExpr=0x01ddc994, const char * aFile=0x01ddc950, int aLine=0x00000309)  Line 276	C++
 	xpcom.dll!nsDebug::Assertion(const char * aStr=0x01ddc9a8, const char *
aExpr=0x01ddc994, const char * aFile=0x01ddc950, int aLine=0x00000309)  Line 109	C++
 	gklayout.dll!XULContentSinkImpl::HandleStartElement(const unsigned short *
aName=0x01ddcd3c, const unsigned short * * aAtts=0x0012eeb8, unsigned int
aAttsCount=0x00000001, int aIndex=0xffffffff, unsigned int
aLineNumber=0x00000000)  Line 777 + 0x2a	C++
 	gklayout.dll!XULContentSinkImpl::ReportError(const unsigned short *
aErrorText=0x0012ef9c, const unsigned short * aSourceText=0x03317c30)  Line
1087 + 0x3e	C++
 	gkparser.dll!nsExpatDriver::HandleError(const char * aBuffer=0x032db058,
unsigned int aLength=0x000017a6, int aIsFinal=0x00000000)  Line 815	C++
 	gkparser.dll!nsExpatDriver::ParseBuffer(const char * aBuffer=0x032db058,
unsigned int aLength=0x000017a6, int aIsFinal=0x00000000)  Line 835	C++
 	gkparser.dll!nsExpatDriver::ConsumeToken(nsScanner & aScanner={...}, int &
aFlushTokens=0x00000000)  Line 936 + 0x20	C++
 	gkparser.dll!nsParser::Tokenize(int aIsFinalChunk=0x00000001)  Line 2563 +
0x1a	C++
 	gkparser.dll!nsParser::ResumeParse(int allowIteration=0x00000001, int
aIsFinalChunk=0x00000001, int aCanInterrupt=0x00000001)  Line 1759 + 0x1b	C++
 	gkparser.dll!nsParser::ContinueParsing()  Line 1358 + 0x13	C++
 	gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x032dc920, int aSucceeded=0x00000001)  Line 1509	C++
 	gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x032eacc8, int aSucceeded=0x00000001)  Line 1527	C++
 	gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x032dcf78, int aSucceeded=0x00000001)  Line 1527	C++
 	gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x032ea7b0, int aSucceeded=0x00000001)  Line 1527	C++
 	gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x03300858, int aSucceeded=0x00000001)  Line 1527	C++
 	gklayout.dll!CSSLoaderImpl::ParseSheet(nsIUnicharInputStream *
aStream=0x032ef710, SheetLoadData * aLoadData=0x03300858, int &
aCompleted=0x00000001)  Line 1444	C++
 	gklayout.dll!SheetLoadData::OnStreamComplete(nsIUnicharStreamLoader *
aLoader=0x03300e88, nsISupports * aContext=0x00000000, unsigned int
aStatus=0x00000000, nsIUnicharInputStream * aDataStream=0x032ef710)  Line 793
+ 0x17	C++
 	necko.dll!nsUnicharStreamLoader::OnStopRequest(nsIRequest *
request=0x033010f0, nsISupports * ctxt=0x00000000, unsigned int
aStatus=0x00000000)  Line 196	C++
 	necko.dll!nsJARChannel::OnStopRequest(nsIRequest * req=0x033015b8, nsISupports
* ctx=0x00000000, unsigned int status=0x00000000)  Line 664	C++
 	necko.dll!nsInputStreamPump::OnStateStop()  Line 499	C++
 	necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *
stream=0x03301694)  Line 339 + 0xb	C++
 	xpcom.dll!nsInputStreamReadyEvent::EventHandler(PLEvent * plevent=0x033018a4)
 Line 117	C++
 	xpcom.dll!PL_HandleEvent(PLEvent * self=0x033018a4)  Line 671 + 0xa	C
 	xpcom.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x00a8bdb8)  Line 606
+ 0x9	C
 	xpcom.dll!_md_EventReceiverProc(HWND__ * hwnd=0x000c0272, unsigned int
uMsg=0x0000c0e7, unsigned int wParam=0x00000000, long lParam=0x00a8bdb8)  Line
1412 + 0x9	C
 	user32.dll!77d43a50() 	
 	user32.dll!77d43b1f() 	
 	user32.dll!77d43d79() 	
 	SHLWAPI.DLL!631af1ab() 	
 	user32.dll!77d43fd4() 	
 	user32.dll!77d43ddf() 	
 	gkwidget.dll!nsAppShell::Run()  Line 135	C++
 	appshell.dll!nsAppShellService::Run()  Line 484	C++
 	thunderbird.exe!main1(int argc=0x00000001, char * * argv=0x003779a0,
nsISupports * nativeApp=0x00ac3f80, const nsXREAppData & aAppData={...})  Line
1282 + 0x20	C++
 	thunderbird.exe!xre_main(int argc=0x00000001, char * * argv=0x003779a0, const
nsXREAppData & aAppData={...})  Line 1716 + 0x29	C++
 	thunderbird.exe!main(int argc=0x00000001, char * * argv=0x003779a0)  Line 51
+ 0x11	C++
 	thunderbird.exe!mainCRTStartup()  Line 398 + 0x11	C
 	kernel32.dll!77e814c7() 	
 	SHLWAPI.DLL!631af1ab() 

Comment 4

[Peter Van der Beken [:peterv]]

Just a small note: the patch in bug 223470 isn't sicking's, it's bz's.

Comment 5

[Peter Van der Beken [:peterv]]

I can't debug right now, but it looks like there's an error in one of the XUL
files. XULContentSinkImpl::ReportError is the handler that displays an error
page for errors in the XML structure of a XUL file. I have a patch that I'll
attach which might fix the crash.

Comment 6

[Peter Van der Beken [:peterv]]

Attachment: V1

It'd be great if someone could try this out and verify that it fixes the crash.

Comment 7

[Frederic Bezies]

I will try it :)

Answer is around 90 minutes.

/me hopes it will fix this *bip* bug.

Comment 8

[Frederic Bezies]

Half-fixed bug :

no more crash, but a xul error, saying

<"Label class="acctCentralText acctCentralLinkText"
value="&suscribeImapFolder.label;" onclick="Suscribe() ;/>

Arrow is pointing &suscribeImapFolder.label;

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 134629 [details] [diff] [review]
V1

sr=dbaron if you copy the

NS_PRECONDITION(aAttsCount % 2 == 0, "incorrect aAttsCount");

from nsXMLContentSink::HandleStartElement to
nsXULContentSink::HandleStartElement as well.

Comment 10

[Pierre Chanial]

I ran into this bug and applied the patch.
The xml error is now correctly reported.
peterv, thanks for the quick patch !!

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 134629 [details] [diff] [review]
V1

You ned to make a similar change to nsXMLContentSink, actually... Sorry about
missing this.  :(

Comment 12

[Scott MacGregor]

Attachment: fix for the xml and xul sink per boris's comment

I changed the 3rd argument to HandleStartElement from a 1 to a 2 for the
XMLContentSink.

Comment 13

[Scott MacGregor]

FYI, I checked in the change to nsXULContentSink because that patch has been
r'ed and sr'ed. I didn't want a set of daily builds tomorrow that crashed for
mailnews.

I did not check in the XML Content Sink part of the patch since no one besides
me has actually looked at that yet.

Leaving this bug open until the XML Content Sink change gets checked in.

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

sr=dbaron on the nsXMLContentSink part and the change I suggested in comment 9.

Comment 15

[Frederic Bezies]

FYI :)

I used attachment 134680 [details] [diff] [review] to patch nsXULContentSink.cpp upon a up-to-date cvs
trunk, and it works so far... Even if patch asks me to reverse patch on the
other file :)

I will post a build asap and post the link on mozillazine TB Build forum.

Comment 16

[Peter Van der Beken [:peterv]]

I checked in the patch for nsXMLContentSink (bonsai seems to have missed it
because I messed up the checkin but it's there, nsXMLContentSink.cpp rev 1.301).
dbaron: I don't know why you insist so much on that NS_PRECONDITION, it was
already in the patch that caused this bug ;-).
mscott: this does mean that Thunderbird has a XUL file with an XML error in it.