105086 - forward inline causes core dump

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect)

Description

[Wyllys Ingersoll]

build id: 2001101312
Mozilla 0.9.5
Solaris 8 (sparc)

Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:0.9.5) Gecko/20011013

Using the MailNews tool as primary mail client, whenever I forward [inline]
from the "Message" menu on top, mozilla drops core (segmentation fault).
This is reproducable with some messages every time, with others it works
without crashing.  The message that causes the crashes has several attachments, 
which may be part of the problem.


Below is a stacktrace of the core dump (using Solaris dbx) -
(note: I removed alot of demangle statements)

$ dbx mozilla-bin core
Using .dbxinit compatibility mode.  See `help .dbxrc' for more information.
changes (topic)
Reading libplds4.so
Reading libplc4.so
Reading libnspr4.so
Reading libdl.so.1
Reading libgtk-1.2.so.0.9.0
Reading libgdk-1.2.so.0.9.0
Reading libgmodule-1.2.so.0.0.9
Reading libglib-1.2.so.0.0.9
Reading libXext.so.0
Reading libX11.so.4
Reading libsocket.so.1
Reading libnsl.so.1
Reading libm.so.1
Reading libstdc++.so.2.10.0
Reading libpthread.so.1
Reading libc.so.1
Reading librt.so.1
Reading libthread.so.1
Reading libintl.so
Reading libmp.so.2
Reading libaio.so.1
Reading libc_psr.so.1
Reading libembedcomponents.so
Reading libgtksuperwin.so
Reading libprofile.so
Reading libucvlatin.so
Reading libgtkxtbin.so
Reading libXt.so.4
Reading libSM.so.6
Reading libICE.so.6
Reading libnullplugin.so
Reading libmailnews.so
detected a multithreaded program
t@1 (l@1) terminated by signal SEGV (no mapping at the fault address)
0xfeac1880: realfree+0x0070:	ld      [%i0 + 0x8], %o2
(dbx) where
current thread: t@1
=>[1] realfree(0x6e162ce0, 0xfeb3e7c8, 0xfeb38000, 0x4, 0x6d6c0009, 0xaa2ce0), 
at 0xfeac1880
  [2] cleanfree(0x0, 0xfeb38000, 0xfeb3e73c, 0xfeb3e7bc, 0xfeb3e750, 0x0), at 
0xfeac2184
  [3] _malloc_unlocked(0x1c, 0x0, 0xfeb38000, 0x20, 0xffbed640, 0x0), at 
0xfeac12b8
  [4] malloc(0x1c, 0xfeb3e750, 0x6, 0x5, 0x0, 0xfdde0e48), at 0xfeac11ac
  [5] __builtin_new(0x1c, 0xfeb38000, 0xaa2ce0, 0xfeb38000, 0xfde20814, 
0xfddd0d60), at 0xfebcb6f8
  [6] MakeInterface__14nsFileSpecImplRC10nsFileSpecPP11nsIFileSpec(0x714808, 
0xaa27c0, 0xaa655c, 0xaa64d0, 0xfddd23b4, 0xaa2cd0), at 0xff177b24
  [7] NS_NewFileSpecWithSpec__FRC10nsFileSpecPP11nsIFileSpec(0x714808, 
0xaa27c0, 0xaa6548, 0x0, 0xfcbb3430, 0x0), at 0xff17a240
  [8] mime_decompose_file_init_fn__FPvP11MimeHeaders(0xaa2798, 0x714808, 
0xfcba29bc, 0x1, 0xfcbad2f8, 0x1), at 0xfcba32e4
  [9] 0xfcb8ae84(0x0, 0xfcb8acdc, 0x7a3b70, 0xfcb8abd0, 0xfcb8b0b4, 0x0), at 
0xfcb8ae83
  [10] 0xfcb8a98c(0x0, 0x1, 0x7a3b10, 0xaa3b79, 0xaa36f4, 0xff242778), at 
0xfcb8a98b
  [11] 0xfcb91de4(0xaa3b78, 0x1, 0x1, 0xfcb8a7d0, 0x7a3b10, 0xaa3b78), at 
0xfcb91de3
  [12] mime_LineBuffer(0xa7e300, 0x1, 0x7a3b38, 0x7a3b40, 0x7a3b48, 0x1), at 
0xfcb91f80
  [13] 0xfcb8b974(0xa7e300, 0x1, 0x7a3b10, 0xfcb8b940, 0xff3e2660, 0xfdd99a88), 
at 0xfcb8b973
  [14] 0xfcb88a3c(0xa7e300, 0x1, 0xaa30b0, 0xa7e301, 0xff3e2660, 0xfdda1923), 
at 0xfcb88a3b
  [15] 0xfcb91de4(0xa7e300, 0x1, 0x1, 0xfcb88844, 0xaa30b0, 0xa7e300), at 
0xfcb91de3
  [16] mime_LineBuffer(0xa7dd68, 0x58f, 0xaa30d8, 0xaa30e0, 0xaa30e8, 0x1), at 
0xfcb91f80
  [17] 0xfcb8b974(0xa7cae0, 0x1817, 0xaa30b0, 0xfcb8b940, 0xffbedea4, 
0xfdde6a98), at 0xfcb8b973
  [18] 0xfcb9fe1c(0xa7c7e8, 0xa7cae0, 0x1817, 0xfcb9fde8, 0xfdde6a50, 0x0), at 
0xfcb9fe1b
  [19] 
OnDataAvailable__17nsStreamConverterP10nsIRequestP11nsISupportsP14nsIInputStream
UiUi(0x7a4530, 0xaa32e0, 0xaa3174, 0xaa33f8, 0x0, 0x1817), at 0xfcb9e5f0
  [20] 
OnDataAvailable__25nsImapCacheStreamListenerP10nsIRequestP11nsISupportsP14nsIInp
utStreamUiUi(0x60db70, 0xaa33f0, 0xaa3174, 0xaa33f8, 0x0, 0x1817), at 0xfccec4e0
  [21] 
OnDataAvailable__Q218nsStorageTransport13nsReadRequestP10nsIRequestP11nsISupport
sP14nsIInputStreamUiUi(0xaa33e8, 0xaa33f0, 0xaa3174, 0xaa33f8, 0x0, 0x1817), at 
0xfdde69c0
  [22] 0xff1b1284(0xaa33e8, 0x30, 0x5, 0xa7beb8, 0x4d4, 0xac4), at 0xff1b1283
  [23] 0xff19f114(0xa1e518, 0xff19f0e4, 0x4d4, 0xac4, 0x4d4, 0xac4), at 
0xff19f113
  [24] PL_HandleEvent(0xaa34b8, 0x2d790, 0x0, 0x0, 0x0, 0x0), at 0xff199dd4
  [25] PL_ProcessPendingEvents(0x3d6f0, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xff199d04
  [26] ProcessPendingEvents__16nsEventQueueImpl(0x1199c8, 0xff19adb8, 0x1, 0x0, 
0x0, 0x0), at 0xff19ade8
  [27] 0xfdcad230(0x1199c8, 0x4, 0x1, 0xfdcad214, 0x0, 0x0), at 0xfdcad22f
  [28] 0xfdcacee4(0x179a70, 0x1, 0x211da8, 0xfdcacec0, 0x1, 0x0), at 0xfdcacee3
  [29] 0xfee44740(0x2332a8, 0xffbee868, 0x211da8, 0x0, 0x0, 0x0), at 0xfee4473f
  [30] 0xfee461ac(0x470, 0x470, 0x4d4, 0xac4, 0x4d4, 0xac4), at 0xfee461ab
  [31] 0xfee46a70(0xfee6d4cc, 0xfee6d438, 0x4d4, 0xac4, 0x4d4, 0xac4), at 
0xfee46a6f
  [32] g_main_run(0x211db8, 0xff0aae5c, 0x131f48, 0x0, 0x0, 0x0), at 0xfee4733c
  [33] gtk_main(0x2c00, 0xfdcad59c, 0x211d98, 0xfdcc60e4, 0x0, 0x0), at 
0xfef4bac8
  [34] Run__10nsAppShell(0x169ab8, 0xfdcad794, 0x169ab8, 0xff189ffc, 0x0, 
0xffe), at 0xfdcad7cc
  [35] Run__17nsAppShellService(0x12cd90, 0xfe84945c, 0x12cd90, 0xfe84a544, 
0xffbee9d0, 0xff20a358), at 0xfe849470
  [36] 0x17064(0x0, 0xffbeec84, 0x0, 0x5, 0x100d4, 0x0), at 0x17063
  [37] main(0x0, 0xffbeec84, 0xffbeec8c, 0x2b548, 0x0, 0x0), at 0x17b04
(dbx) quit

Comment 1

[Reinout van Schouwen]

WFM with Solaris 0.9.6 build. I successfully inline forwarded a message with
attachments to myself.

Comment 2

[Sheela Ravindran]

Reporter,
You are using fairly an old build. This might not be a problem on the recent
builds. Can you download latest build and try again.  Thanks.

Comment 3

[Wyllys Ingersoll]

This seems to be fixed with the 0.9.6 build for Solaris/Sparc.
I think this can be closed.
-wyllys

Comment 4

[Sheela Ravindran]

Verified this as worksforme based on reporter comments.  Please reopen the bug 
if you see it on recent builds.