82991 - Crash copying many addresses between address books - N620 M096 [@ nsAddrDatabase::NotifyCardEntryChange ]

Status: VERIFIED WORKSFORME

(SeaMonkey :: MailNews: Address Book & Contacts, defect, P1)

Description

[Gareth King]

Steps to reproduce

Select a large number (e.g. 318) of addresses in one address book.
Attempt to drag and drop into another address book.
Crash.

Expect them to be copied.

Comment 1

[James Green]

What build id are you using?

Comment 2

[Gareth King]

Build ID: 2001052404

Comment 3

[Blake Ross]

Can you use talkback, reproduce the crash, and report the incident ID here 
please?

Comment 4

[Gareth King]

Talkback incident IDs for this bug:

TB30971845E
TB30996599M

Comment 5

[Ninoschka Baca]

Build 2001-05-31-04: WinMe

I think the problem is between 250 and 275 addresses. When I attempted to 
drag-n-drop 275 address an error occured in ADDRBOOK.DLL. Unfortunately Talkback 
is not working right now.

I tried a variety of scenarios:
1. Successful (no crash) with 70, 100, 150, and 200, and 250 addresses. 
2. Crash occurs with 275, 300 and 400 addresses. 

Comment 6

[Ninoschka Baca]

Additional Information: The original address book appears to have the same 
number of addresses before and after the crash so no data loss. The new address 
book has the majority of addresses (207 out of 275 attempted).

Marking nsbeta1 for someone to determine priority.

Comment 7

[scottputterman]

marking 0.9.2. Candice can you look at this and see what it would take to fix
this.  If it's not too bad I wouldn't mind arguing for 0.9.1

Here's the stack:

nsAddrDatabase::NotifyCardEntryChange
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrDatabase.cpp, line 335]
nsAddrDatabase::CreateNewCardAndAddToDB
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrDatabase.cpp, line 1661]
nsAbMDBDirectory::DropCard
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbMDBDirectory.cpp, line 746]
nsAbCardProperty::DropCardToDatabase
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbCardProperty.cpp, line 855]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 139]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1837]
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1242]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2703]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3322] 

Comment 8

[chuang]

I finally can reporduce the bug.  Some how there's null pointer in the listener
list.  I have a preventive fix for the crash, still looking for the real cause
of the problem.

Comment 9

[chuang]

Attachment: Patch for the safe fix

Comment 10

[scottputterman]

this gets a PDT+ on preventing the crash.  We should open another bug for
finding the cause and fix that in a later milestone.

Comment 11

[chuang]

The fix is a safe fix to prevent the crash.  It prevent adding a null pointer to
the listener list, check and revome the null pointer from the listener list when
notifying the listener.

I think I found the cause of how null pointer gets into the listener list.  The
fix for it is risky at this stage.  I've filed a new bug 84795 for it.

Comment 12

[Jean-Francois Ducarroz]

as a temporary fix, R=ducarroz

Comment 13

[Scott MacGregor]

sr=mscott

Comment 14

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to the trunk.
(on behalf of drivers)

Comment 15

[chuang]

*** Bug 85442 has been marked as a duplicate of this bug. ***

Comment 16

[chuang]

Fix checked in

Comment 17

[chuang]

.

Comment 18

[fenella]

Linux (2001-06-14-06 trunk)
Win32 (2001-06-14-09 trunk)
Mac (2001-06-14-04 trunk)
I try different numbers, I do not see any problem with 160, 275 and 435.

Comment 19

[Jan Carpenter]

Reopened. Crashing on N610 branch (not marking as topcrash yet.)

Comments from recent crashes:
     (33021907) Comments: clicked on a mail message in thread pan
     (32861938) Comments: reading mail

Stacktrace from crash on build 2001071508:

Incident ID 33021907 
nsAddrDatabase::NotifyCardEntryChange 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrDatabase.cpp, line 297] 
nsAddrDatabase::CreateNewCardAndAddToDB 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrDatabase.cpp, line 
1625] 
nsAbMDBDirectory::AddCard 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbMDBDirectory.cpp, line 
687] 
nsAbCardProperty::AddCardToDatabase 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbCardProperty.cpp, line 
793] 
nsAbAddressCollecter::CollectAddress 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbAddressCollecter.cpp, 
line 170] 
nsAbAddressCollecter::CollectUnicodeAddress 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbAddressCollecter.cpp, 
line 82] 
XPTC_InvokeByIndex 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, 
line 139] 
XPCWrappedNative::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
1883] 
XPC_WN_CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 1253] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2703] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] 
nsXPCWrappedJSClass::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 
1002] 
nsXPCWrappedJS::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 427] 
PrepareAndDispatch 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, 
line 102] 
SharedStub 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, 
line 124] 
nsMimeHtmlDisplayEmitter::WriteHTMLHeaders 
[d:\builds\seamonkey\mozilla\mailnews\mime\emitters\src\nsMimeHtmlEmitter.cpp, 
line 220] 
nsMimeHtmlDisplayEmitter::EndHeader 
[d:\builds\seamonkey\mozilla\mailnews\mime\emitters\src\nsMimeHtmlEmitter.cpp, 
line 299] 
mimeEmitterEndHeader 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, line 1747] 
MimeMessage_close_headers 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 390] 
MimeMessage_close_headers 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 390] 
MimeMessage_parse_line 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 256] 
convert_and_send_buffer 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimebuf.cpp, line 134] 
mime_LineBuffer [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimebuf.cpp, line 
256] 
MimeObject_parse_buffer 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimeobj.cpp, line 256] 
MimeMessage_parse_line 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 131] 
nsStreamConverter::OnDataAvailable 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 890] 
nsStreamConverter::OnDataAvailable 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 890] 
nsDocumentOpenInfo::OnDataAvailable 
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 236] 
nsStreamListenerTee::OnDataAvailable 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 57] 
nsOnDataAvailableEvent0::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
416] 
nsStreamListenerEvent0::HandlePLEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
107] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 
1072] 
KERNEL32.DLL + 0x2222f (0xbff9222f) 
0x00688b60 

Comment 20

[chuang]

I tried on today's branch build by dragging about 600 cards to another address
book and it worked without crash.  I'm runing on Win2000.

Comment 21

[selmer (gone)]

Removing whiteboard comments due to reopen.

Comment 22

[Blake Ross]

Milestone reality check.

Comment 23

[fenella]

Linux (2001-08-15-06 trunk)
I tried it 5 times dragging a large number of addresses between address books, 2
of which were crashes. 
Number of addresses are 800+

Comment 24

[chuang]

I have 828 card in one of my address book,  I tried dragging it to other address
book for over 8 times.  I didn't get a crash.  I'm using 8/20's build on Window
2000.

Comment 25

[Jan Carpenter]

Not appearing on trunk or N610 talkback topcrash reports for 9/3

Comment 26

[chuang]

Move to 0.9.5

Comment 27

[scottputterman]

moving to 0.9.6

Comment 28

[scottputterman]

reassigning to cavin

Comment 29

[scottputterman]

moving to 1.0

Comment 30

[Jay Patel [:jay]]

Adding N620 and M096 to summary, since I see quite a few of these crashes with
Netscape 6.20 and Mozilla 0.9.6.

Here's a couple of recent incidents:
M096 crash:
  38439282     2001112012   MozillaBranch   Windows NT 5.0 build 2195  
2001-11-24 03:34:58   nsAddrDatabase::NotifyCardEntryChange 588fea31   1537  
1537    
Comments: 1. I created a new folder for my emaill account. 2. I dragged and
dropped 1 email from my InBox into the new folder 3. I then clicked on a mail in
my InBox and the application crashed

MozillaTrunk crash:
  37784931     2001110809   MozillaTrunk   Windows NT 5.0 build 2195  
2001-11-09 05:09:54   nsAddrDatabase::NotifyCardEntryChange 588fea31   1603  
1603     
Comments: I was reading a new message just received, while there was still
opened the window for the creation of a new distribution list (not the Address
Book!!)

Netscape 6.20 crash:
  38541355     2001102218   Netscape6.20   Windows NT 5.0 build 2195  
2001-11-26 17:48:59   nsAddrDatabase::NotifyCardEntryChange 1bd5c575   135870  
135870
Comments: Moving e-mail message from inbox to a folder inside another folder
(inbox -> investing/quicken). After restarting, the e-mail was in the correct
folder and was intact.

Adding qawanted and topcrash keywords to see if we can get this reproduced...so
we can perhaps up the target milestone.

Comment 31

[scottputterman]

The summary may not be correct anymore or we have a different crash.  The
comments make it sound like the crash is happening when using mail.  So either
there's a large copy going on in the background or it sounds like this might be
the collected address book.

cc'ing Seth because I'm not sure if the new outliner branch is going to fix some
of these problems.  I know there was some work on listeners.

Comment 32

[scottputterman]

reassigning to racham to help spread out top crasher bugs.

Comment 33

[racham]

I copied as many as 1200 addresses (drag&drop) and haven't noticed a crash.
Anyway, I will check with Ninoschka.

Comment 34

[racham]

Ninoschka mentioned to me that this problem was seen when a group of 250-275
addresses are copied. I have copied groups of address books of various sizes in
that range, viz., 250, 256, 265, 275 across various addressbooks (Personal,
Collected & test). It copied addresses as expected. Couldn't reproduce the crash
reported. Only problem I noticed was that there wasn't any feedback during/(on
finish of) copy activity. I will open a separate bug for that.

Ninoschka is going to try this today (she has this one on the list of bugs to be
reproduced). Will followup with her again.

Comment 35

[Ninoschka Baca]

Trunk build 2001-11-12-08: WinMe
I was unable to reproduce the crash. I drag-n-dropped 300 addresses from one
address book to another. Then I tried 574 addresses and it copied without a
crash. Should we mark as Worksforme?

Comment 36

[Jay Patel [:jay]]

Looking at the latest Talkback data I've noticed that none of the comments for
M096 or N621 really mention copying addresses between address books...so the
crash originally reported might not be happening anymore (after N620).  The
stack signature and stack trace for the most recent crashes do look similar
though.  Here is the latest stack trace from a crash with Netscape 6.21:

Incident 324913:
Stack Signature  nsAddrDatabase::NotifyCardEntryChange 84b4143c
Trigger Time 2001-12-11 04:25:44
Email Address
URL visited
User Comments Opening an html message, the mail client crashed!!
Build ID 2001112815
Product ID Netscape6.21
Platform
Operating System Win32
Module
Trigger Reason Access violation
Stack Trace
nsAddrDatabase::NotifyCardEntryChange
[c:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrDatabase.cpp, line 297]
nsAddrDatabase::CreateNewCardAndAddToDB
[c:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrDatabase.cpp, line 1626]
nsAbMDBDirectory::AddCard
[c:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbMDBDirectory.cpp, line 800]
nsAbCardProperty::AddCardToDatabase
[c:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbCardProperty.cpp, line 818]
nsAbAddressCollecter::CollectAddress
[c:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbAddressCollecter.cpp,
line 171]
nsAbAddressCollecter::CollectUnicodeAddress
[c:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbAddressCollecter.cpp,
line 83]
XPTC_InvokeByIndex
[c:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 139]
XPCWrappedNative::CallMethod
[c:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1954]
XPC_WN_CallMethod
[c:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1263]
js_Invoke [c:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809]
js_Interpret [c:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2720]
js_Invoke [c:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825]
nsXPCWrappedJSClass::CallMethod
[c:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 1024]
nsXPCWrappedJS::CallMethod
[c:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 430]
PrepareAndDispatch
[c:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 102]
SharedStub
[c:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 124]
nsMimeHtmlDisplayEmitter::WriteHTMLHeaders
[c:\builds\seamonkey\mozilla\mailnews\mime\emitters\src\nsMimeHtmlEmitter.cpp,
line 205]
nsMimeHtmlDisplayEmitter::EndHeader
[c:\builds\seamonkey\mozilla\mailnews\mime\emitters\src\nsMimeHtmlEmitter.cpp,
line 297]
mimeEmitterEndHeader
[c:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, line 1746]
MimeMessage_close_headers
[c:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 391]
MimeMessage_close_headers
[c:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 391]
MimeMessage_parse_line
[c:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 257]
convert_and_send_buffer
[c:\builds\seamonkey\mozilla\mailnews\mime\src\mimebuf.cpp, line 134]
mime_LineBuffer [c:\builds\seamonkey\mozilla\mailnews\mime\src\mimebuf.cpp, line
256]
MimeObject_parse_buffer
[c:\builds\seamonkey\mozilla\mailnews\mime\src\mimeobj.cpp, line 256]
MimeMessage_parse_line
[c:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 132]
nsStreamConverter::OnDataAvailable
[c:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 904]
nsStreamConverter::OnDataAvailable
[c:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 904]
nsDocumentOpenInfo::OnDataAvailable
[c:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 244]
nsMailboxProtocol::ReadMessageResponse
[c:\builds\seamonkey\mozilla\mailnews\local\src\nsMailboxProtocol.cpp, line 543]
nsMailboxProtocol::ProcessProtocolState
[c:\builds\seamonkey\mozilla\mailnews\local\src\nsMailboxProtocol.cpp, line 633]
nsMsgProtocol::OnDataAvailable
[c:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp, line 246]
nsOnDataAvailableEvent::HandleEvent
[c:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 188]
PL_HandleEvent [c:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [c:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [c:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[c:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 468]
netscp6.exe + 0x1769 (0x00401769)
netscp6.exe + 0x121a (0x0040121a)
netscp6.exe + 0x34eb (0x004034eb)
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

If this doesn't look like the same crash or even slightly similar to the one
originally reported by putterman in comment #7, just mark this bug worksforme
and I'll log new bug(s) for the recent crashes with M096 and N621.  Otherwise, I
can put more user comments in this bug so we can try to reproduce this.

Comment 37

[racham]

OK. The crash now seem to be more random. Last report mentions that opening the
html message crahsed the app and some others like reading a message and clicking
on a message in theradpane. I can only guess that there seems to be an attempt
to add addresses to collected address book may possible be one of the reason.

Anyway, I am closing this one as worksforme as copying is done without any
problems. Ninoschka, thanks for running those tests.

Jay, If you find other recent reports with similar stack traces, can you please
open a new bug with any common patterns among them.

thanks.

Comment 38

[Ninoschka Baca]

Verified Worksforme.