1322223 - Sending email in Earlybird 52 crashes when anchor with non-standard protocol is contained in the message, for example <a href="skype: ...">

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect)

Description

[Марко М. Костић (Marko M. Kostić) [:Kostic]]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
Build ID: 20161130084405

Steps to reproduce:

Wrote a new email and clicked the "Send" button.


Actual results:

Earylbird crashes.


Expected results:

Earylbird should have sent the email.

Comment 1

[Марко М. Костић (Marko M. Kostić) [:Kostic]]

Host OS is Fedora 25, desktop envirnoment is Gnome 3.22 and I am using the Wayland session instead of the Xorg one (I'm 99% sure that Earlybird runs on Wayland inside XWayland).

Comment 2

[Wayne Mery (:wsmwk)]

maybe Andre can assist you

Comment 3

[Andre Klapper]

Thanks for taking the time to report this!
Please provide a stacktrace of the crash. See https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report . 
After doing this, please remove the "stackwanted" keyword from this report.

Comment 4

[Марко М. Костић (Marko M. Kostić) [:Kostic]]

The crash has been submitted by the Mozilla Crash Reporter. Crash ID is bp-f9b461dc-1493-4439-b5fd-9304a2160519. Is this what you wanted?

Comment 5

[Марко М. Костић (Marko M. Kostić) [:Kostic]]

Sorry, that's the wrong crash id. The correct one is bp-0a29ac9d-376b-45dc-9823-aa5ed2161206.

Comment 6

[Andre Klapper]

yes :)

Comment 7

[Jorg K (CEST = GMT+2)]

No crash on Windows with 52.0a2 (2016-12-06) (32-bit)

Comment 8

[Wayne Mery (:wsmwk)]

Not much going on in thread 0.  Nor in the raw dump. We really need a better dump.

[@ libxul.so@0xb18740 ]
Frame	Module	Signature
0 	libxul.so	libxul.so@0xb18740

Does it reproduce in safe mode?
With nightly build https://archive.mozilla.org/pub/thunderbird/nightly/latest-comm-central/ ?

Comment 9

[Марко М. Костић (Marko M. Kostić) [:Kostic]]

I found a way to narrow the crash. To reliably crash Earlybird when sending an email, the email you send from should contain an HTML signature.

Sending from an email account which doesn't have HTML signature configured does not crash Earlybird.

The crash happens in regular and in safe mode, in Daily and in Earylbird versions.

Comment 10

[Wayne Mery (:wsmwk)]

please (always) post all your newer crash ids.

Does your signature contain a link or image?
Can you attach the html to the bug?

Comment 11

[Jorg K (CEST = GMT+2)]

Do you attach the signature from a file or do you type it in directly into the signature box?

Can you please answer this question and paste the signature here.

Magnus, we/you most likely caused this in "our favourite bug" (which has access limitations, that's why I won't quote the number here).

Comment 12

[Jorg K (CEST = GMT+2)]

We've done some work in the area of adding the signature. I just tried and got no crash. So it must be a specific signature that causes the crash.

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to Jorg K (GMT+1) from comment #11)
> 
> Magnus, we/you most likely caused this in "our favourite bug" (which has
> access limitations, that's why I won't quote the number here).

However, it is useful to those of us who do have access

Comment 14

[Jorg K (CEST = GMT+2)]

Oops, wrong bug, mist likely caused by bug 1316570. Lots of digging around with the signature there:
https://hg.mozilla.org/comm-central/rev/dd4587a78cfd200881956427c8d3fd468aaf9758#l6.50

We must however have the crashing signature to debug this.

Comment 15

[Марко М. Костић (Marko M. Kostić) [:Kostic]]

The signature has been configured in the Account settings (text pasted, checked the "Use HTML") button.

The HTML signature is work related and I am somewhat reluctant to attach it to a public forum. Is it possible to create a private attachement?

Comment 16

[Jorg K (CEST = GMT+2)]

Send it to me via e-mail, please, just click on the "JK" to get my e-mail. I won't publish your signature ;-)

Comment 17

[Марко М. Костић (Marko M. Kostić) [:Kostic]]

That's good to know. :D

Sent the sig to your email, Jorg.

Comment 18

[Jorg K (CEST = GMT+2)]

I received the signature in question via a private message. It's quite a large block of HTML ;-)
It reproduced the crash upon sending a message with this signature. I'll look into it.

Stack:
xul.dll!nsMsgComposeAndSend::GetEmbeddedObjectInfo(nsIDOMNode * node, nsMsgAttachmentData * attachment, bool * acceptObject) Line 1408	C++
xul.dll!nsMsgComposeAndSend::GetMultipartRelatedCount(bool forceToBeCalculated) Line 1497	C++
xul.dll!nsMsgComposeAndSend::Init(nsIMsgIdentity * aUserIdentity, const char * aAccountKey, nsMsgCompFields * fields, nsIFile * sendFile, bool digest_p, bool dont_deliver_p, int mode, nsIMsgDBHdr * msgToReplace, const char * attachment1 [details] [diff] [review]_type, const nsACString_internal & attachment1 [details] [diff] [review]_body, nsIArray * attachments, nsIArray * preloaded_attachments, const char * password, const nsACString_internal & aOriginalMsgURI, int aType) Line 3026	C++
xul.dll!nsMsgComposeAndSend::CreateAndSendMessage(nsIEditor * aEditor, nsIMsgIdentity * aUserIdentity, const char * aAccountKey, nsIMsgCompFields * fields, bool digest_p, bool dont_deliver_p, int mode, nsIMsgDBHdr * msgToReplace, const char * attachment1 [details] [diff] [review]_type, const nsACString_internal & attachment1 [details] [diff] [review]_body, nsIArray * attachments, nsIArray * preloaded_attachments, mozIDOMWindowProxy * parentWindow, nsIMsgProgress * progress, nsIMsgSendListener * aListener, const char * password, const nsACString_internal & aOriginalMsgURI, int aType) Line 4046	C++
xul.dll!nsMsgCompose::SendMsgToServer(int deliverMode, nsIMsgIdentity * identity, const char * accountKey) Line 1273	C++
xul.dll!nsMsgCompose::SendMsg(int deliverMode, nsIMsgIdentity * identity, const char * accountKey, nsIMsgWindow * aMsgWindow, nsIMsgProgress * progress) Line 1473	C++

The code in question is:
  bool isHttp =
    (NS_SUCCEEDED(attachment->m_url->SchemeIs("http", &isHttp)) && isHttp) ||
    (NS_SUCCEEDED(attachment->m_url->SchemeIs("https", &isHttp)) && isHttp);
And attachment->m_url is sadly null :-(

Comment 19

[Jorg K (CEST = GMT+2)]

Attachment: 1322223-crash-with-fancy-sig.patch

Fixing a crash you caused ;-)

Comment 20

[Марко М. Костић (Marko M. Kostić) [:Kostic]]

Excellent!

Any ETA on how long it takes for the patch to get to the Earlybird, from master?

Comment 21

[Jorg K (CEST = GMT+2)]

Attachment: This is the signature that makes it crash (stripped down, of course)

This is the signature that crashes stripped down. All personal details removed. I have actually not worked out what causes the crash exactly.

(In reply to Марко М. Костић (Marko M. Kostić)  [:Kostic] from comment #20)
> Any ETA on how long it takes for the patch to get to the Earlybird, from
> master?
If Magnus approves the patch tonight, it will be in Earlybird tomorrow ;-) Otherwise the day after it gets approved.

Comment 22

[Wayne Mery (:wsmwk)]

Ouch. I guess I haven't been watching nightly crash stats for a couple weeks.  This is our #1 crash in both...
https://crash-stats.mozilla.com/topcrashers/?product=Thunderbird&version=52.0a2
https://crash-stats.mozilla.com/topcrashers/?product=Thunderbird&version=53.0a1

Comment 23

[Jorg K (CEST = GMT+2)]

Comment on attachment 8817000 [details]
This is the signature that makes it crash (stripped down, of course)

You don't need this, this will already make it crash:

<a href="skype:name.surname.company?call" title="Skype">name.surname.Test</a>

A URL Gecko doesn't understand.

Comment 24

[Jorg K (CEST = GMT+2)]

Attachment: 1322223-crash-with-fancy-sig.patch (v1b).

Same code, but nicer comment since we understand the problem now.

Comment 25

[Magnus Melin [:mkmelin]]

Comment on attachment 8817002 [details] [diff] [review]
1322223-crash-with-fancy-sig.patch (v1b).

Review of attachment 8817002 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM, thx! r=mkmelin

Comment 26

[Molly Howell (she/her) (no longer active)]

Seems like you meant to block this one, not an old Mac installer bug. :)

Comment 27

[Jorg K (CEST = GMT+2)]

Sorry Matt, I gave you the wrong bug. This was caused by the access-restricted bug.

I'll land my patch soon and close this bug here.

Comment 28

[Jorg K (CEST = GMT+2)]

Attachment: 1322223-crash-with-fancy-sig.patch (v2)

I'm landing something slightly different. Turns out that attachment->m_url was null if an error was ignored above. So proper error handling would have saved the day ;-)

I took the liberty to kill some super-ugly braces while I was there ;-)

Comment 29

[Jorg K (CEST = GMT+2)]

C-C (TB 53): https://hg.mozilla.org/comm-central/rev/8881e860371794a64312b206e086ec10f7f9a827
C-A (TB 52): https://hg.mozilla.org/releases/comm-aurora/rev/7268754697f9580ab2a546d52ffdd0fdbb404beb
Landed with yet another tweak to a comment ;-)

Daily and Earlybird of tomorrow won't show this crash any more.
Go and tell all your correspondents how to reach you on Skype ;-)

Comment 30

[Wayne Mery (:wsmwk)]

(must have hit the wrong key)

Comment 31

[Wayne Mery (:wsmwk)]

v.fixed - no crashes starting with 2016-12-07 build