336957 - Crash when calling messageServiceFromURI("file://...").streamMessage [@ nsMailboxService::FetchMessage]

Status: RESOLVED FIXED

(MailNews Core :: Database, defect)

Description

[Jens Bannmann]

To read the original message source, one can ask the Messenger for the respective message service, from which one can then stream the message. This works fine for mailbox-message://, but when a file:// URL is used that points to a saved e-mail (.eml format), Thunderbird crashes (talkback report TB18391440X).


messageURI = "file:///C:/foo.eml?type=application/x-message-display";
stream = Components.classes["@mozilla.org/network/sync-stream-listener;1"]
                   .createInstance()
                   .QueryInterface(Components.interfaces.nsIInputStream);
messenger.messageServiceFromURI(messageURI)
         .streamMessage(messageURI, stream, msgWindow, null, false, null);


This was discovered with the MessageFaces extension, which I built without thinking that I might have to handle EML files in a different way than mailbox messages. If the messenger.messageServiceFromURI returned null for file:// URLs, and/or the message service streamMessage() implementations failed cleanly, other extensions with the same error would still be broken, but things would look way better :-)

Comment 1

[timeless]

fwiw:

                   .createInstance()
                   .QueryInterface(Components.interfaces.nsIInputStream);

can be replaced with:
                   .createInstance(Components.interfaces.nsIInputStream);

it's cheaper.

While i'm handing out notes
SyncStream = Components.Constructor("@mozilla.org/network/sync-stream-listener;1", Components.interfaces.nsIInputStream);
...
stream = new SyncStream;

Anyway, patch for your bug in a moment.

Comment 2

[timeless]

Attachment: look before leaping

Comment 3

[Adam Guthrie]

Incident ID: 18391440
Stack Signature	nsMailboxService::FetchMessage 83c42599
Product ID	Thunderbird15
Build ID	2006030803
Trigger Time	2006-05-07 01:19:23.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	thunderbird.exe + (004efec0)
URL visited	
User Comments	
Since Last Crash	1514 sec
Total Uptime	31547 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 259
Stack Trace 	
nsMailboxService::FetchMessage  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 259]
nsMailboxService::StreamMessage  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 309]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_CallMethod  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Execute  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424]
obj_eval  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1266]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Execute  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424]
obj_eval  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1266]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
js_Interpret  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
js_InternalInvoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1274]
JS_CallFunctionValue  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4171]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1411]
nsGlobalWindow::RunTimeout  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6360]
nsGlobalWindow::TimerCallback  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6723]
nsAppStartup::Run  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mail/app/nsMailApp.cpp, line 62]
KERNEL32.DLL + 0x11af6 (0x77e81af6)

Comment 4

[Jens Bannmann]

timeless, would this be suitable for the 1.8 branch? I noticed that you ported other patches to that file back to the branch, but not this one...

(Come to think of it, this might even be a candidate for a 1.8.0.x Gecko, as it's clearly stability-improving)

Comment 5

[timeless]

Comment on attachment 221153 [details] [diff] [review]
look before leaping

mozilla/mailnews/local/src/nsMailboxService.cpp 	1.122

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Seems kind of scary that this function can return success without touching aURL.

Comment 7

[timeless]

Comment on attachment 221153 [details] [diff] [review]
look before leaping

MOZILLA_1_8_BRANCH:
mozilla/mailnews/local/src/nsMailboxService.cpp 	1.114.8.6

Comment 8

[timeless]

i filed bug 343398 for dbaron.

i'm using this bug simply to fix the crash, which i believe i did.

if anyone wants to do anything else (including object to my fixing this bug) then they're free to use any bug that isn't assigned to me.

Comment 9

[Daniel Veditz [:dveditz]]

Comment on attachment 221153 [details] [diff] [review]
look before leaping

approved for 1.8.0 branch, a=dveditz for drivers

Comment 10

[timeless]

Comment on attachment 221153 [details] [diff] [review]
look before leaping

MOZILLA_1_8_0_BRANCH:
mozilla/mailnews/local/src/nsMailboxService.cpp 	1.114.8.3.2.2

Comment 11

[Marcia Knous [:marcia]]

Jens: I am wondering if you have a suggestion as to an easy way I can verify that the patch fixes the crash. 

Comment 12

[Jens Bannmann]

(In reply to comment #11)
> Jens: I am wondering if you have a suggestion as to an easy way I can verify
> that the patch fixes the crash. 

The following line crashes Thunderbird 1.5.0.5 when evaluated in the JS console:

messageURI = "file:///C:/foo.eml?type=application/x-message-display"; stream = Components.classes["@mozilla.org/network/sync-stream-listener;1"].createInstance(Components.interfaces.nsIInputStream); Components.classes['@mozilla.org/messenger;1'].getService(Components.interfaces.nsIMessenger).messageServiceFromURI(messageURI).streamMessage(messageURI,stream,null, null, false, null);

The original code passed a non-null value for msgWindow to streamMessage(), but getting one from the JS console did not seem easy. I guess it is still a sufficient test case.

Comment 13

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.3 with Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.0 ID:2007032620 using Talkback Data and the testcase from comment #12