Closed Bug 1277038 Opened 8 years ago Closed 5 years ago

Crash when changing text encoding of message/rfc822 attachment (opened in a stand-alone window) - [@ nsHtml5UTF16Buffer::hasMore ]

Categories

(Thunderbird :: Message Reader UI, defect)

45 Branch
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED WORKSFORME

People

(Reporter: vulnerable.zappa, Unassigned)

References

Details

(Keywords: crash, reproducible, testcase)

Crash Data

Attachments

(1 file)

Attached file Test.eml.txt
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20160502172042

Steps to reproduce:

Open Repro in ThunderBird


Actual results:

Thunderbird crash


Expected results:

Nothing
Severity: normal → critical
Status: UNCONFIRMED → NEW
Crash Signature: [@ nsHtml5UTF16Buffer::hasMore ]
Component: Untriaged → Message Reader UI
Depends on: 745696
Ever confirmed: true
Keywords: crash, testcase
I can open that in TB 49 Daily. No crash.
echo, have you ever crashed before?

For me, this testcase crashes builds 45.2b1, 48.0a1, and today's daily (new profile). bp-1938b786-96f2-4d25-a03c-82df42160531.
(Unlike bug 745696 whose testcases no longer crash)
Flags: needinfo?(vulnerable.zappa)
Hmm, when I import that to a folder I can view the message without crash. If I open it as a saved file it crashes consistently.
Indeed that is how I am crashing. sorry, forgot to mention that.
(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #2)
> echo, have you ever crashed before?
> 
> For me, this testcase crashes builds 45.2b1, 48.0a1, and today's daily (new
> profile). bp-1938b786-96f2-4d25-a03c-82df42160531.
> (Unlike bug 745696 whose testcases no longer crash)

Yes it's full reproducible (on windows 7 x64 and TB 45.1.1) - just open repro
testcase crashes v38 and v31
In 45.7.1 I have a message with three message/rfc822 attachments. I double-click one to open it and it opens in a stand-alone window. I use |View > Text Encoding| and get a crash immediately:

http://crash-stats.mozilla.com/report/index/bp-ddce0b51-7a16-42d1-bc3b-fd5bd2170301
http://crash-stats.mozilla.com/report/index/bp-28dabe3e-c84e-406e-8b82-9682c2170301

100% reproducible. Doing the same operation on Daily 54.0a1 (2017-02-28) (64-bit) doesn't crash but gives an empty message window, so the crash is gone but the function still doesn't work.
Flags: needinfo?(vulnerable.zappa)
Summary: Null Pointer Dereference → Crash when changing text encoding of message/rfc822 attachment (opened in a stand-alone window) - [@ nsHtml5UTF16Buffer::hasMore ]
Filed bug 1343476 for the remaining malfunction on trunk.
bp-ddce0b51-7a16-42d1-bc3b-fd5bd2170301
0 	xul.dll	nsHtml5UTF16Buffer::hasMore()	parser/html/nsHtml5UTF16Buffer.cpp:84
1 	xul.dll	nsHtml5StreamParser::ParseAvailableData()	parser/html/nsHtml5StreamParser.cpp:1340
2 	xul.dll	nsHtml5RequestStopper::Run()	parser/html/nsHtml5StreamParser.cpp:1055
3 	xul.dll	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp:972
4 	xul.dll	NS_ProcessNextEvent(nsIThread*, bool)	xpcom/glue/nsThreadUtils.cpp:297
Keywords: reproducible
See Also: → 1343476

Crash-stats is clean. And testcase is good too.

Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: