111305 - N620 crash [@ .__ptr_glue - MimeMultipart_parse_line]

Status: VERIFIED FIXED

(MailNews Core :: MIME, defect, P1)

Description

[Jay Patel [:jay]]

This is one of the topcrasher with Netscape 6.20 on Mac. Here is the latest info
we have from Talkback on this crash:

[ 24   .__ptr_glue 4ab20c49 - MimeMultipart_parse_line() ]
 
     Crash date range: 2001-11-10 to 2001-11-20
     Min/Max Seconds since last crash: 39 - 205769
     Min/Max Runtime: 61 - 757994
     Keyword List : attach(7), mail(16), message(5), forward(10),  
     Count   Platform List 
     9   MacOS version 9.1  
     7   MacOS version 9.2.1  
     7   MacOS version 9.0.4  
     1   MacOS version 8.6  
 
     Count   Build Id List 
     24   2001102217
 
     No of Unique Users        15
 
 Stack trace(Frame) 

	 .__ptr_glue  
	 MimeMultipart_parse_line()
[mimemult.cpp  line 204] 
	 convert_and_send_buffer()
[mimebuf.cpp  line 168] 
	 mime_LineBuffer()
[mimebuf.cpp  line 186] 
	 MimeObject_parse_buffer()
[mimeobj.cpp  line 249] 
	 MimeMultipart_parse_child_line()
[mimemult.cpp  line 547] 
	 MimeMultipart_parse_line()
[mimemult.cpp  line 261] 
	 convert_and_send_buffer()
[mimebuf.cpp  line 168] 
	 mime_LineBuffer()
[mimebuf.cpp  line 186] 
	 MimeObject_parse_buffer()
[mimeobj.cpp  line 249] 
	 MimeMessage_parse_line()
[mimemsg.cpp  line 211] 
	 convert_and_send_buffer()
[mimebuf.cpp  line 168] 
	 mime_LineBuffer()
[mimebuf.cpp  line 262] 
	 MimeObject_parse_buffer()
[mimeobj.cpp  line 249] 
	 mime_parse_stream_write()
[mimedrft.cpp  line 414] 
	 nsStreamConverter::OnDataAvailable()
[nsStreamConverter.cpp  line 901]  
 
     (38267786)	Comments: Editing one deleted message as a new one.  The browser just
stopped working.
     (38233282)	Comments: I was forwarding an e-mail that included an attachment.
     (38222620)	Comments: Composing a e-mail message. I cut and pasted some text  which
created a highlighted block of text (which I had NOT copied) and I could not get
rid of it. I saved the message as text AND as a draft. The message also included
an attachment. We I tried to
     (38222620)	Comments:  re-open the draft  the application crashed.
     (38137584)	Comments: 5th time.  Refer to theprevious ones.
     (38137508)	Comments: Same damn thing as last time.  I'm getting tired of this.  I would
like to be able to forward a message with an attachment.
     (38137394)	Comments: I pressed the forward button on Messenger on a message with a JPEG
 attachment.
     (38137353)	Comments: Type 2 error.   I was about to attach a JPEG file to an e-mail
message.
     (38136141)	Comments: forwarding a piece of mail
     (38128236)	Comments: trying to foward  mail with an attachment.
     (38126952)	Comments: Forwarding an e-mail
     (38104369)	Comments: forwarding mail with an attachment
     (37976316)	Comments: resending an email
     (37899351)	Comments: trying to open and send a email draft.
     (37883878)	Comments: tried to forward a draft email
     (37883733)	Comments: moved from sent to draft; then  tried to edit draft
     (37883239)	Comments: forwarding one email
     (37880989)	Comments: sent mail  then tried to edit it for a different address.
     (37879741)	Comments: upgraded to your latest version and tried to edit an email draft.
     (37834146)	Comments: Forwarding emails
     (37834056)	Comments: Forwarding emails
     (37830407)	Comments: Sending emails.

Comment 1

[scottputterman]

esther, could you or someone else on QA help try to reproduce this.

Comment 2

[varada]

The number of crashes has increased to 46 and unique reporters to 25- This
happens only on the 6.2 release build and not in the later trunk builds.

Comment 3

[varada]

Attachment: Talkback reports of this crash

The crashes have all happened with either the 6.2 release build - 2001102217,
6.1 release build 2001072622 and 2001091311(just once with this build ).

Comment 4

[Shiva Thirumazhusai]

It is normal that sometimes crashes happen only in external release build and
not in the Trunk builds. This is due to huge variations in the usage pattern.

Comment 5

[scottputterman]

If we can't reproduce this crash, perhaps we could ask one of the recent
crashers if they have a particular message that crashes and if they'd be willing
to let us test with it.

Comment 6

[Jean-Francois Ducarroz]

Using a 6.2 release build on Mac, I cannot reproduce this problem. We really
need to have a reproducible case.

Comment 7

[esther]

Using the vague scenarios on the comments listed in the talkback reports I could
not reproduce this using the 10-22 or the 7-26 Netscape 6 builds on a mac os
9.1.   Others in mailqa have tried this too, no luck reproducing. 
I have sent emails to (5) of the reporters asking if this still happens and for
more information.  Now just waiting for their replys.

Comment 8

[Blu3]

Please change to All, Moz doesn't "crash", the UI stalls dead in the water and
has  to be killed.  I'm on Linux, using CVS builds every several hours.

Comment 9

[Jean-Francois Ducarroz]

Esther was finally able to reproduce the problem using a message that include an
AppleWorks 5 attachment. I tried to forward inline or edit as new the message on
Window (My Mac is still trying to catch up with the CW7 landing from yesterday)
and that cause the App to freeze like reporter in comment #8.

The freeze problem is due to the fact I am trying to truncate a string at length
-1 in nsMsgAttachment::SetContentType.

Comment 10

[Jean-Francois Ducarroz]

Attachment: Proposed fix for the freeze issue (not the crash one), v1

Comment 11

[varada]

Comment on attachment 61369 [details] [diff] [review]
Proposed fix for the freeze issue (not the crash one), v1

r=varada; This fixes only the freeze - should the crash be made another bug?

Comment 12

[esther]

An update:
Using a mail message sent to us by one of the reporters we were able to
reproduce the crash on messages that had an appleworks5 attachment when using
6.2 on mac (not on windows or linux).  However, repeating these tests on the
20011210 mac, win & linux builds trying to Forward this same message causes the
app to freeze not crash before a compose window comes up, so there are no
talkback reports for current builds.
This bug was Mac only on 6.2, but is cross all platforms with 12/10 trunk builds.

Comment 13

[Jean-Francois Ducarroz]

I am not crashing on Mac but I freeze. However it's a different freeze than the
one I posted a fix for. Here is a more complete stack trace:

 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  3E4A1990  
  0E799DA0    PPC  3E4805A0  main+001B0
  0E799D40    PPC  3E47DEE4  main1(int, char**, nsISupports*)+00A04
  0E799C10    PPC  3DF719D4  nsAppShellService::Run()+00054
  0E799BC0    PPC  3DF0EC8C  nsAppShell::Run()+0004C
  0E799B80    PPC  3DF0F7D4  nsMacMessagePump::DoMessagePump()+00044
  0E799B30    PPC  3DF0FCB0  nsMacMessagePump::DispatchEvent(int,
EventRecord*)+001B0
  0E799AE0    PPC  3DEDCBAC  Repeater::DoRepeaters(const EventRecord&)+0003C
  0E799A90    PPC  3DEF5734  nsMacNSPREventQueueHandler::RepeatAction(const
EventRecord&)+000
14
  0E799A50    PPC  3DEF5D64  nsMacNSPREventQueueHandler::ProcessPLEventQueue()+00184
  0E7999D0    PPC  3E2A6FB8  nsEventQueueImpl::ProcessPendingEvents()+00068
  0E799960    PPC  3E32242C  PL_ProcessPendingEvents+000BC
  0E799910    PPC  3E322694  PL_HandleEvent+00054
  0E7998D0    PPC  3E2E0624  EventHandler(PLEvent*)+00074
  0E799880    PPC  3E2D5BEC  XPTC_InvokeByIndex+0002C
  0E799840    PPC  3E2D5CF8  _XPTC_InvokeByIndex+000CC
  0E799780    PPC  3DD5F6D4 
nsStorageTransport::nsReadRequest::OnDataAvailable(nsIRequest*, 
nsISupports*, nsIInputStream*, unsigned int, unsigned int)+00074
  0E799720    PPC  3CF45DF0 
nsImapCacheStreamListener::OnDataAvailable(nsIRequest*, nsISuppo
rts*, nsIInputStream*, unsigned int, unsigned int)+000B0
  0E7996B0    PPC  3C7A1878  nsStreamConverter::OnDataAvailable(nsIRequest*,
nsISupports*, ns
IInputStream*, unsigned int, unsigned int)+00258
  0E7991B0    PPC  3C7A73A0  mime_parse_stream_write(_nsMIMESession*, const
char*, int)+00080
  0E799170    PPC  3C78D2A0  MimeObject_parse_buffer(char*, int, MimeObject*)+00080
  0E799130    PPC  3C772DC0  mime_LineBuffer+00260
  0E7990B0    PPC  3C772AF4  convert_and_send_buffer(char*, int, int, int
(*)(char*, unsigned
 int, void*), void*)+00194
  0E799060    PPC  3C788768  MimeMessage_parse_line(char*, int, MimeObject*)+002B8
  0E799000    PPC  3C78D2A0  MimeObject_parse_buffer(char*, int, MimeObject*)+00080
  0E798FC0    PPC  3C772C38  mime_LineBuffer+000D8
  0E798F40    PPC  3C772AF4  convert_and_send_buffer(char*, int, int, int
(*)(char*, unsigned
 int, void*), void*)+00194
  0E798EF0    PPC  3C78BD48  MimeMultipart_parse_line(char*, int, MimeObject*)+006F8
  0E798DA0    PPC  3C78C7CC  MimeMultipart_parse_child_line(MimeObject*, char*,
int, int)+001
FC
  0E798D40    PPC  3C78D2A0  MimeObject_parse_buffer(char*, int, MimeObject*)+00080
  0E798D00    PPC  3C772C38  mime_LineBuffer+000D8
  0E798C80    PPC  3C772AF4  convert_and_send_buffer(char*, int, int, int
(*)(char*, unsigned
 int, void*), void*)+00194
  0E798C30    PPC  3C78B904  MimeMultipart_parse_line(char*, int, MimeObject*)+002B4
  0E798AE0    PPC  3C78C1BC  MimeMultipart_create_child(MimeObject*)+001CC
  0E798A80    PPC  3C7ABA60  mime_decompose_file_init_fn(void*, MimeHeaders*)+00A40
  0E798730    PPC  3DC847AC  nsOSHelperAppService::GetFromMIMEType(const char*,
nsIMIMEInfo**
)+0019C
  0E7986A0    PPC  3DFA9E3C  nsInternetConfigService::FillInMIMEInfo(const
char*, const char*
, nsIMIMEInfo**)+0010C
  0E7980E0    PPC  3DFA94EC 
nsInternetConfigService::FillMIMEInfoForICEntry(ICMapEntry&, nsI
MIMEInfo**)+001CC
  0E797DE0    PPC  3E37A710  nsCAutoString::nsCAutoString(const char*, int)+000A0
  0E797D90    PPC  3E394E58  nsACString::do_AppendFromElementPtrLength(const
char*, unsigned 
int)+00058
  0E797D40    PPC  3E39493C  nsACString::do_AppendFromReadable(const
nsACString&)+0005C
  0E797C90    PPC  3E3768F8  nsCString::SetLength(unsigned int)+00038
  0E797C50    PPC  3E376998  nsCString::SetCapacity(unsigned int)+00038

Comment 14

[Jean-Francois Ducarroz]

Attachment: Proposed fix for the freeze, v2

On Mac, we freeze also at aother location. This new patch address both freeze
issues. Now I am finally able to reproduce the crash on Mac.

Comment 15

[Jean-Francois Ducarroz]

I have a fix for the crash too. However, the message generated when doing a edit
dratf, edit template, edit message as new of forward as attachment will contains
invalid attachment file if the message contains an AppleDouble/AppleSingle
attachment and the resource fork of the attachment will be lost. This is a
limitation of the current support of appledouble for which I'll file a new bug.
But at least we will not crash anymore. Patch coming...

Comment 16

[Jean-Francois Ducarroz]

Attachment: Proposed fix for freezes and crash, v3

Comment 17

[Dan M]

Comment on attachment 61398 [details] [diff] [review]
Proposed fix for freezes and crash, v3

r=danm

Comment 18

[Scott MacGregor]

Comment on attachment 61398 [details] [diff] [review]
Proposed fix for freezes and crash, v3

sr=mscott

Comment 19

[Asa Dotzler [:asa]]

a=asa (on behalf of drivers) for checkin to 0.9.7 

Comment 20

[Jean-Francois Ducarroz]

Fixed and checked in

Comment 21

[Jean-Francois Ducarroz]

I filed bug 115163 for the problem with the apple double attachment.

Comment 22

[Jean-Francois Ducarroz]

*** Bug 101620 has been marked as a duplicate of this bug. ***

Comment 23

[esther]

using mac build 2001220 on os9.1 this is fixed (it doesn't hang anymore, but it
doesn't show the attachment on a Reply and Forward gives an error during
sending=new bug 115163) Verified for orgingally stated bug

Comment 24

[Michael Buckland]

Adding to status whiteboard AOLTW and plussing bugs definite requirements,
adding just AOLTW for possibles.

Comment 25

[Scott MacGregor]

fixed on the AOLTW branch.

Comment 26

[esther]

We have a new crashing bug with the same mail message as the one we used to
reproduce this bug.  I crash on the Mac and Winxp.  The stack for the crash on
Winxp is:
nsScanner::~nsScanner [d:\builds\seamonkey\mozilla\htmlparser\src\nsScanner.cpp,
line 237]
CParserContext::~CParserContext
[d:\builds\seamonkey\mozilla\htmlparser\src\CParserContext.cpp, line 112]
nsParser::~nsParser [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 402]
nsParser::`scalar deleting destructor'
nsParser::Release [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line
424]
CSSLoaderImpl::Cleanup
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 736]
CSSLoaderImpl::SheetComplete
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 849]
CSSLoaderImpl::ParseSheet
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 884]
CSSLoaderImpl::DidLoadStyle
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 920]
SheetLoadData::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 672]
nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 123]
nsJARChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 582]
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 162]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
USER32.dll + 0x3c076 (0x77d7c076)
USER32.dll + 0x3c076 (0x77d7c076)
netscp6.exe + 0x6770 (0x00406770)
kernel32.dll + 0x3bb86 (0x77e9bb86) 

Comment 27

[Jean-Francois Ducarroz]

Looking at the stacktrace, this is a totally different problem, this time this
is a layout crash and not a mime one. Esther, I think it would be better to open
a new bug...

Comment 28

[esther]

I agree after testing more, I think this has to do with all 5 attachments in the
message so I will verify this again.  Just wanted to be sure.

Comment 29

[esther]

verified again