760583 - Thunderbird crashes when saving an email as draft or trying to send, in nsHTMLEditRules::WillDo; Permanent orange: TEST-UNEXPECTED-FAIL | Disconnect Error: Application unexpectedly closed | test-eml-actions.js | test_reply_to_eml_save_as_draft

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect)

Description

[Mike Conley (:mconley) (:⚙️)]

Just saw this on trunk:

https://tbpl.mozilla.org/?tree=Thunderbird-Trunk&rev=5b8e006efafa

I tried without the Contacts API patch, and we're still crashing, so I have to conclude this is breakage from mozilla-central landing something.

I've started to bisect.

TEST-START | /home/cltbld/talos-slave/test/build/mozmill/composition/test-eml-actions.js | test_reply_to_eml_save_as_draft
Step Pass: {"function": "Controller.keypress()"}
search "ldap" not found - skipping.
search "ldap" not found - skipping.
TEST-UNEXPECTED-FAIL | Disconnect Error: Application unexpectedly closed
INFO Passed: 1
INFO Failed: 1
INFO Skipped: 0
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/thunderbird/tinderbox-builds/comm-central-linux64/1338565743/thunderbird-15.0a1.en-US.linux-x86_64.crashreporter-symbols.zip
PROCESS-CRASH | composition | application crashed (minidump found)
Crash dump filename: /home/cltbld/talos-slave/test/build/mozmill/mozmillprofile/minidumps/7f4955a4-9c6a-9684-3ebcdf31-6b30d03c.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGSEGV
Crash address: 0x20

Thread 0 (crashed)
 0  libxul.so!nsHTMLEditRules::WillDoAction [nsTArray.h : 192 + 0x0]
    rbx = 0x8f6d6000   r12 = 0xa25d4a3f   r13 = 0xa25d49a0   r14 = 0x00000000
    r15 = 0x00000000   rip = 0xabc2e091   rsp = 0xa25d4800   rbp = 0x00000000
    Found by: given as instruction pointer in context
 1  libxul.so!nsPlaintextEditor::OutputToString [nsPlaintextEditor.cpp : 1341 + 0x1f]
    rbx = 0x9658f000   r12 = 0xa25d4c60   r13 = 0x00002002   r14 = 0xa25d48a0
    r15 = 0x00000000   rip = 0xabb9f028   rsp = 0xa25d4890   rbp = 0xa25d4b10
    Found by: call frame info
 2  libxul.so!nsMsgComposeAndSend::GetBodyFromEditor [nsMsgSend.cpp : 1566 + 0x13]
    rbx = 0x8faa5420   r12 = 0xa25d4b10   r13 = 0xa25d4d20   r14 = 0x00000000
    r15 = 0x00000000   rip = 0xac0e7dde   rsp = 0xa25d4a70   rbp = 0xa25d4c60
    Found by: call frame info
 3  libxul.so!nsMsgComposeAndSend::Init [nsMsgSend.cpp : 3350 + 0xb]
    rbx = 0x8faa5420   r12 = 0x00000000   r13 = 0xa25d4d20   r14 = 0x00000000
    r15 = 0x00000000   rip = 0xac0ef132   rsp = 0xa25d4cd0   rbp = 0x8f65b100
    Found by: call frame info
 4  libxul.so!nsMsgComposeAndSend::CreateAndSendMessage [nsMsgSend.cpp : 4197 + 0x91]
    rbx = 0x8faa5420   r12 = 0x9b8b5ed0   r13 = 0x8f65b100   r14 = 0x00000000
    r15 = 0x00000000   rip = 0xac0ef5f3   rsp = 0xa25d4dc0   rbp = 0x9658f000
    Found by: call frame info
 5  libxul.so!nsMsgCompose::_SendMsg [nsMsgCompose.cpp : 1147 + 0x76]
    rbx = 0x8f2766d0   r12 = 0xad6dd880   r13 = 0x00000000   r14 = 0x00000004
    r15 = 0x00000006   rip = 0xac1095d4   rsp = 0xa25d4e70   rbp = 0x8fa9f4f0
    Found by: call frame info
 6  libxul.so!nsMsgCompose::SendMsg [nsMsgCompose.cpp : 1341 + 0x16]
    rbx = 0x8f2766d0   r12 = 0x00000004   r13 = 0x93de3dc0   r14 = 0x00000000
    r15 = 0xa25d53c0   rip = 0xac109fb6   rsp = 0xa25d5140   rbp = 0x8fa9f4f0
    Found by: call frame info
 7  libxul.so!NS_InvokeByIndex_P [xptcinvoke_x86_64_unix.cpp : 163 + 0x8]
    rbx = 0x00000005   r12 = 0xffffffff   r13 = 0x00000006   r14 = 0x00000005
    r15 = 0xac328333   rip = 0xac32849d   rsp = 0xa25d5460   rbp = 0xa25d5550
    Found by: call frame info
 8  libxul.so!XPCWrappedNative::CallMethod [XPCWrappedNative.cpp : 3062 + 0x19]
    rbx = 0xa25d57d0   r12 = 0xa25d5770   r13 = 0x00000000   r14 = 0x00000012
    r15 = 0xa25d5705   rip = 0xabd62a74   rsp = 0xa25d5560   rbp = 0x00000005
    Found by: call frame info
 9  libxul.so!XPC_WN_CallMethod [XPCWrappedNativeJSOps.cpp : 1500 + 0x9]
    rbx = 0x92e500b0   r12 = 0x8f3b5100   r13 = 0x8f32bbe0   r14 = 0x00000005
    r15 = 0x9ed002c0   rip = 0xabd663ab   rsp = 0xa25d59f0   rbp = 0xa25d5a10

Skipping 874 lines...

0x7fa3aeb85000 - 0x7fa3aedc0fff  libnspr4.so  ???
0x7fa3aedc3000 - 0x7fa3aefc4fff  libldif60.so  ???
0x7fa3aefc5000 - 0x7fa3af1c9fff  libprldap60.so  ???
0x7fa3af1ca000 - 0x7fa3af3fffff  libldap60.so  ???
0x7fa3af505000 - 0x7fa3af58afff  [e-mail]  ???
0x7fa3af58b000 - 0x7fa3af58efff  87f5e051180a7a75f16eb6fe7dbd3749-x86-64.cache-2  ???
0x7fa3af58f000 - 0x7fa3af597fff  b79f3aaa7d385a141ab53ec885cc22a8-x86-64.cache-2  ???
0x7fa3af598000 - 0x7fa3af599fff  2e1514a9fdd499050989183bb65136db-x86-64.cache-2  ???
0x7fa3af59a000 - 0x7fa3af59cfff  5c755b2f27115486aa6359c84dd3cbda-x86-64.cache-2  ???
0x7fa3af59d000 - 0x7fa3af59efff  3f821257dd33660ba7bbb45c32deb84c-x86-64.cache-2  ???
0x7fa3af59f000 - 0x7fa3af5a0fff  830f035fa84a65ce80e050178dbb630d-x86-64.cache-2  ???
0x7fa3af5a1000 - 0x7fa3af5a1fff  81a173283b451552b599cfaafd6236bd-x86-64.cache-2  ???
0x7fa3af5a2000 - 0x7fa3af5a2fff  6cfc7d49b27ba7d3eb71ab86e04def2c-x86-64.cache-2  ???
0x7fa3af5a3000 - 0x7fa3af5a3fff  b887eea8f1b96e1d899b44ed6681fc27-x86-64.cache-2  ???
0x7fa3af5a4000 - 0x7fa3af5a4fff  860639f272b8b4b3094f9e399e41bccd-x86-64.cache-2  ???
0x7fa3af5a5000 - 0x7fa3af5a5fff  211368abcb0ff835c229ff05c9ec01dc-x86-64.cache-2  ???
0x7fa3af5a6000 - 0x7fa3af5a6fff  c46020d7221988a13df853d2b46304fc-x86-64.cache-2  ???
0x7fa3af5a7000 - 0x7fa3af5a7fff  d290456e58f67f52b0f8f224126f9ea8-x86-64.cache-2  ???
0x7fa3af5a8000 - 0x7fa3af5a8fff  b63c21b9c3e5b4a4009aa5966b421593-x86-64.cache-2  ???
0x7fa3af5a9000 - 0x7fa3af5a9fff  df893b4576ad6107f9397134092c4059-x86-64.cache-2  ???
0x7fa3af5aa000 - 0x7fa3af5aafff  ff627ea95a65192232277bf7c8a56f23-x86-64.cache-2  ???
0x7fa3af5ab000 - 0x7fa3af5abfff  900402270e15d763a6e008bb2d4c7686-x86-64.cache-2  ???
0x7fa3af5ac000 - 0x7fa3af5acfff  2881ed3fd21ca306ddad6f9b0dd3189f-x86-64.cache-2  ???
0x7fa3af5ad000 - 0x7fa3af5adfff  3c3fb04d32a5211b073874b125d29701-x86-64.cache-2  ???
0x7fa3af5ae000 - 0x7fa3af5aefff  e61abf8156cc476151baa07d67337cae-x86-64.cache-2  ???
0x7fa3af5af000 - 0x7fa3af5b2fff  b67b32625a2bb51b023d3814a918f351-x86-64.cache-2  ???
0x7fa3af5b3000 - 0x7fa3af5bbfff  12b26b760a24f8b4feb03ad48a333a72-x86-64.cache-2  ???
0x7fa3af5bc000 - 0x7fa3af5c2fff  928306c3ad40271d946e41014a49fc28-x86-64.cache-2  ???
0x7fa3af5c3000 - 0x7fa3af5cdfff  18db0204b1f108dd01663673626fcd3d-x86-64.cache-2  ???
0x7fa3af6d3000 - 0x7fa3af6d4fff  d3379abda271c4acd2ad0c01f565d0b0-x86-64.cache-2  ???
0x7fa3af6d5000 - 0x7fa3af6d9fff  46b47dbc682d2ca4191e148ea7bde7f2-x86-64.cache-2  ???
0x7fa3af6da000 - 0x7fa3af6dafff  b4d0b56f766d89640448751fcd18ec1e-x86-64.cache-2  ???
0x7fa3af6db000 - 0x7fa3af6dbfff  1248881498ac025e45c3042f6afe9284-x86-64.cache-2  ???
0x7fa3af6dc000 - 0x7fa3af6e2fff  gconv-modules.cache  ???
0x7fffa25ff000 - 0x7fffa25fffff  linux-gate.so  ???

Comment 1

[Mike Conley (:mconley) (:⚙️)]

bug 759748 looks pretty suspect...

Comment 2

[(no longer active)]

http://mxr.mozilla.org/mozilla-central/source/editor/libeditor/text/nsPlaintextEditor.cpp#1341 calls WillDoAction with aSelection set to null!

Comment 3

[(no longer active)]

Attachment: Patch (v1)

Comment 4

[Mike Conley (:mconley) (:⚙️)]

Comment on attachment 629246 [details] [diff] [review]
Patch (v1)

Review of attachment 629246 [details] [diff] [review]:
-----------------------------------------------------------------

My knowledge of how the Editor component works is pretty much nil, but here's what I've got:

1)  This patch does indeed fix our crash
2)  The patch itself looks reasonable
3)  You're the Editor guy, so I trust you know what you're doing

So, uh, r=me.

Comment 5

[Ben Bucksch (:BenB)]

Comment on attachment 629246 [details] [diff] [review]
Patch (v1)

+  // Nothing to do if there's no selection to act on
+  NS_ENSURE_TRUE(aSelection && aSelection->GetRangeCount(), NS_OK);

As discussed on IRC, I agree with irving that this is not a good use of the macro. It should be used for error conditions only, and this one clearly isn't.

Comment 6

[Mike Conley (:mconley) (:⚙️)]

Comment on attachment 629246 [details] [diff] [review]
Patch (v1)

Removing my r+ until this NS_ENSURE_TRUE thing is resolved.

Comment 7

[(no longer active)]

Attachment: Patch (v2)

Comment 8

[Ben Bucksch (:BenB)]

Comment on attachment 629319 [details] [diff] [review]
Patch (v2)

After talking with ehsan on IRC, I revoke my objection above.
He says this is a common use throughout editor. While I disagree with that, this bug is not the right place.

Comment 9

[Mike Conley (:mconley) (:⚙️)]

Comment on attachment 629319 [details] [diff] [review]
Patch (v2)

I don't really want to debate this thing on a bustage fix. Let's land this puppy, and if we want to strip the NS_ENSURE_blah from Editor down the road, well, this'll be part of it I guess.

Comment 10

[(no longer active)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a86bc3f872cc

Comment 11

[Steffen Wilberg]

Thunderbird Daily, which contains the patch from bug 759748, crashes every time I try to save an email as draft, or Thunderbird tries to auto-save it, or I try to send it, in line 525:

524 // Nothing to do if there's no selection to act on
525 NS_ENSURE_TRUE(aSelection->GetRangeCount(), NS_OK);

https://crash-stats.mozilla.com/report/index/bp-93746bb1-c756-49e8-b73c-f52192120602

Comment 12

[Wayne Mery (:wsmwk)]

yeah, TB totally unusable
bp-eb0eb96a-5596-420b-81d2-156e32120602

Comment 13

[Mike Conley (:mconley) (:⚙️)]

The patch for this has landed in mozilla-inbound, and we're just waiting for it to land in mozilla-central.

As for in-testsuite?, yes, that's how we originally noticed this bug - our test_reply_to_eml_save_as_draft Mozmill test in test-eml-actions.js was causing a crash.

Comment 15

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/a86bc3f872cc

Comment 17

[Wayne Mery (:wsmwk)]

daily build - send and draft both work

Comment 19

[Tony Mechelynck [:tonymec]]

setting status-(gecko)15 = verified on the basis of comment #17 and of bug 760886 comment #4.