562647 - crash (while using Gmail Conversation View add-on) when click Reply inside the message window [@ nsMsgComposeService::GetOrigWindowSelection(int, nsIMsgWindow*, nsACString_internal&)]

Status: RESOLVED FIXED

(MailNews Core :: Composition, defect)

Description

[Chris Coleman]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.4) Gecko/20100413 Firefox/3.6.4
Build Identifier: Eudora 8.0b9  Help/About says Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.7) Gecko/20100301 Eudora [Thunderbird]/3.0.1

Eudora team, thank you for Eudora, I like it a lot !!

I found a crash bug, it crashes eudora while using the popular "gmail conversation view" add-on.

Eudora 8.0beta9/Thunderbird 3.0.1  crashes when you click the Reply button located INSIDE the message window of a "gmail conversation view".

To reproduce the bug:
1) install the gmail conversation view add-on in eudora 8.0b9
2) click any message that is part of a thread, and 
3) you will see the gmail conversation view appears in the message window.
4) move your mouse to the messag window.
5) click the small "reply" or "reply all" button which appears on the lower-right of a collapsed message.
6)  crash!

I filed a bug report with the add-on developer on his bug-report page. 

The add-on developer says that extensions are not able to cause crash in their own code, so the bug must be in either eudora/penelope or thunderbird.  

Then I installed Thunderbird 3.0.1 on same machine as Eudora to test:  same config, same email accounts, same add-ons.  Thunderbird  ran perfectly no crash while clicking reply button inside the GMCV message window.

Since thunderbird does not crash under this test case, I think the bug is in eudora.

The crash happens with both: 
GMCV (GMail Conversation View) stable 0.3beta2, 
GMCV development version 0.3beta3.100422pre

Copied from the Mozilla Crash Reporter / Details screen: 
====================

Add-ons: {58D4392A-842E-11DE-B51A-C7B855D89593}:1.1.7,[e-mail]:2.0.4,[e-mail]:0.3.1,[e-mail]:0.3beta3.100422pre,{e2fda1a4-762b-4020-b5ad-a41df1933103}:1.0b1,{D1D37B8A-4F3C-11DB-8373-B622A1EF5492}:1.0b1,{a62ef8ec-5fdc-40c2-873c-223b8a6925cc}:0.6b1,{ad7d8a66-253b-11dc-977c-000c29a3126e}:0.8.13.3,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.1
BuildID: 20100301223703
CrashTime: 1272527482
InstallTime: 1267927225
ProductName: Thunderbird
SecondsSinceLastCrash: 1602
StartupTime: 1272525884
Theme: classic/1.0
Throttleable: 1
URL: 
Vendor: 
Version: 3.0.1

This report also contains technical information about the state of the application when it crashed.

==========

The console (eudora.exe -console >console.txt) does not give any error messages or warnings, just information. 

Last few lines:

*** Got an "offline message"
*** Completed message 2
*** Treating message 3
Registering 154546imap://account@server/INBOX
*** Got an "offline message"
*** Completed message 3
*** Treating message 4
Registering 154554imap://account@server/INBOX
*** Got an "offline message"
*** Completed message 4
--- End ThreadSummary::summarize


Could it be a null pointer that caused the crash?!  

Let me know what I can do to provide you with more info on this crash to help you fix it as soon as possible. :)


Reproducible: Always

Steps to Reproduce:
To reproduce the bug:
1) install the gmail conversation view add-on in eudora 8.0b9
2) click any message that is part of a thread, and 
3) you will see the gmail conversation view appears in the message window.
4) move your mouse to the messag window.
5) click the small "reply" or "reply all" button which appears on the lower-right of a collapsed message.
6)  crash!

Actual Results:  
full crash of thunderbird/eudora

Expected Results:  
Show me a Composition Window with a reply message partly filled in and ready to complete.

Comment 1

[Matt Dudziak]

Confirmed. Crashes Eudora 8.0b9. Contrary to what the Addons DL page says, I am not able to get this to work with Thunderbird 3.0.1. Does not cause a crash in Thunderbird 3.0.4.

Comment 2

[Chris Coleman]

I heard from the extension developer:  He forwarded me his 12-14 lines of code that does the reply. It seems to be written according to Thunderbird documentation.  I've pasted his code at the bottom of this message.

"Did the Eudora team change anything in the way ComposeMessage is called, or changed one of the nsIMsgCompType or nsIMsgCompFormat interfaces. That might explain the crash."

First thoughts: Is there an easy way to find out which of Thunderbird's functions and interfaces Eudora has changed/redefined?? 

Could this be a clean solution:  to inheirit from ComposeMessage, and extend those 2 interfaces, instead of changing/redefining them ??


<code>
        /* The reply, reply to all, forward links. For reference, start reading
         * http://mxr.mozilla.org/comm-central/source/mail/base/content/messageWindow.js#949
         * and follow the function definitions. */
        let uri = msgHdr.folder.getUriForMsg(msgHdr);
        let compose = function compose_ (aCompType, aEvent) {
          if (aEvent.shiftKey) {
            ComposeMessage(aCompType, Ci.nsIMsgCompFormat.OppositeOfDefault, msgHdr.folder, [uri]);
          } else {
            ComposeMessage(aCompType, Ci.nsIMsgCompFormat.Default, msgHdr.folder, [uri]);
          }
        };
        let register = function register_ (selector, f, action) {
          if (!action)
            action = "click";
          let nodes = selector ? msgNode.querySelectorAll(selector) : [msgNode];
          for each (let [, node] in Iterator(nodes))
            node.addEventListener(action, f, true);
        }
        register(".link-reply, .button-reply", function (event) {
            /* XXX this code should adapt when news messages have a JS
             * representation. It don't think this will ever happen. See
             * http://mxr.mozilla.org/comm-central/source/mail/base/content/mailWindowOverlay.js#1259
             * */
            compose(Ci.nsIMsgCompType.ReplyToSender, event);
          });
</code>

Comment 3

[Jeff Beckley]

The crash is not due to different code.  The code used here is the same in TB and Eudora.  It's actually caused by a pref having a different default value in Eudora than TB.  The pref in question is mailnews.reply_quoting_selection.only_if_chars.  If that pref has any characters in it (which it is by default Eudora does but TB does not), then the code crashes when hitting reply on a message in a gmail conversation view.

So a workaround for now is to clear out the contents of that pref, which you can do via the Options/Preferences dialog->Advanced->Config Editor.

I will look at making a fix so that the code doesn't crash with there being some characters in the pref.

Comment 4

[Chris Coleman]

Wow :) Thanks Jeff for finding the root cause so fast.. u're awesome man !!

Just now, Ive verified that the preference data field, when changed in Tb to be the same as in Eudora, this crash does occur in TB at runtime exactly as in Eudora.

For the record... here are my official steps, for anyone else who wants to independently reproduce this crash in Thunderbird: 
1)Launch TB
2)Click Tools/Options/Advanced/General/Config Editor.
3)Paste into search field: mailnews.reply_quoting_selection.only_if_chars
4)Modify this pref to contain Yes
5)OK out of Config Editor.
6)OK out of Options.
7)Click Reply in GMCV message view window (in other words, do all of my original Steps to Reproduce this bug).
8)TB crashes and burns!! totally kicks the bucket!!! And they told us add-ons will never crash TB!!! ;)

It seems like the true bug is living inside the TB code... and GMCV is the first extension to bring this bug to popular exposure , ultimately to the point where I reported it, and you found it

I hope there is a way to easily fix this bug in the underlying TB code, and make both the Eudora and the TB user communities safe from this crash

Comment 5

[Jeff Beckley]

Moving this to MailNews Core as that's where the fix needs to be made.

Comment 6

[Jeff Beckley]

Attachment: Fix for reply selection crash

Here's the fix.  It's a trivial parenthetical grouping.  The block shouldn't be entered if there is no selection.

Comment 7

[Jonathan Protzenko [:protz]]

This also crashes my 3.1. As this is a severe crash and some other users might also have this preference enabled, I'm requesting the blocking-3.1 flag.

Comment 8

[Mark Banner (:standard8)]

Checked in to trunk:

http://hg.mozilla.org/comm-central/rev/37551db7fecb

I don't think we'd block 3.1 on this, but I see no harm in taking the patch.

Comment 9

[Mark Banner (:standard8)]

Checked in to 1.9.2 for 3.1rc1: http://hg.mozilla.org/releases/comm-1.9.2/rev/81c4ba7dd2d7

Comment 10

[Mark Banner (:standard8)]

Checked in to 1.9.1 for 3.0.5:
http://hg.mozilla.org/releases/comm-1.9.1/rev/2177404ec42e

Comment 11

[Wayne Mery (:wsmwk)]

full signature is nsMsgComposeService::GetOrigWindowSelection(int, nsIMsgWindow*, nsACString_internal&)