241757 - Crash when "forward" mail is used

Status: RESOLVED FIXED

(Core Graveyard :: GFX: OS/2, defect)

Description

[Paul Lazaga]

User-Agent:       Mozilla/5.0 (OS/2; U; Warp 4.5; en-US; rv:1.7b) Gecko/20040422
Build Identifier: Mozilla/5.0 (OS/2; U; Warp 4.5; en-US; rv:1.7b) Gecko/20040422

Forwarding a message results in browser crash.  The following message appears in
POPUPLOG.OS2

04-26-2004  08:46:31  SYS3175  PID 0081  TID 0001  Slot 0081
D:\BIN\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
c0000005
1ddfd6d6
P1=00000001  P2=00000014  P3=XXXXXXXX  P4=XXXXXXXX  
EAX=00000000  EBX=0012d1e8  ECX=16dc6d04  EDX=00000000
ESI=00000000  EDI=0012d370  
DS=0053  DSACC=f0f3  DSLIM=ffffffff  
ES=0053  ESACC=f0f3  ESLIM=ffffffff  
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:1ddfd6d6  CSACC=f0df  CSLIM=ffffffff
SS:ESP=0053:0012d058  SSACC=f0f3  SSLIM=ffffffff
EBP=0012d170  FLG=00012202

LIBC05.DLL 0001:0001d6d6


Reproducible: Always
Steps to Reproduce:
1. Highlight mail
2. Click "Forward" button
3.

Actual Results:  
Complete browser crash

Expected Results:  
New compose window with mail to be forwarded embedded

Build platform
target
i386-pc-os2-emx

Build tools
Compiler 	Version 	Compiler flags
gcc 	gcc version 3.2.2 (Innotek Build 2004-02-23 14:15) 	-Wall -W -Wno-unused
-Wpointer-arith -Wcast-align -Wno-long-long -pedantic -Zomf -pipe
g++ 	gcc version 3.2.2 (Innotek Build 2004-02-23 14:15) 	-fno-rtti
-fno-exceptions -Wall -Wconversion -Wpointer-arith -Wcast-align
-Woverloaded-virtual -Wsynth -Wno-ctor-dtor-privacy -Wno-non-virtual-dtor
-Wno-long-long -pedantic -Zomf -pipe

Configure arguments
--enable-crypto --disable-tests --disable-debug --enable-optimize

Comment 1

[Mike Kaply [:mkaply]]

Does it happen with new or just with mail?

Comment 2

[Paul Lazaga]

(In reply to comment #1)
> Does it happen with new or just with mail?

"Compose" and "Reply" work fine.  Just when using the "Forward".  So far it
happens every time (well at least three times on several messages).

Comment 3

[Mike Kaply [:mkaply]]

Sorry, I meant does it happen with news :)

Or just mail

Comment 4

[Paul Lazaga]

(In reply to comment #3)
> Sorry, I meant does it happen with news :)
> 
> Or just mail

Interesting... it works in newsgroups, but not in mail.

Comment 5

[Mike Kaply [:mkaply]]

Yep it crashes

Comment 6

[knut st. osmundsen]

The crash is in fclose() and is caused by passing a NULL pointer (esi) to it.
There is to my knowlegde no defined behaviour for this scenario, but crashing is
the normal action (IIRC LIBC, VAC and FreeBSD does so, while GLIBC doesn't).

Comment 7

[knut st. osmundsen]

Mike: If you want LIBC symbols in idbug you should just rename libc05.dbg to
libc05.dll. libc05.dbg is the unstripped library and since we on purpose does
not enable strack frame optimizations you'll have a stacktrace out of libc at
least. (You will get perhaps get the source file dialog if crashing inside LIBC
but that's normally something you can dismiss without crashing the debugger...)

Also mark that there is a libc05.map in the usr/lib directory of the GCC
installation. This mapfile also includes linenumbers offsets which is very handy
for figuring out what's wrong.

Comment 8

[Mike Kaply [:mkaply]]

Attachment: Fix

You may wonder what on earth a fix to the icon code has to do with this.

For some reason, when you forward an email, it tries to get an icon for:
 .com/Inbox#0

My new icon code tries to create this as a file to get an icon and of course it
fails.

I wasn't checking the error code from creating the file, and the fclose was
crashing.

Comment 9

[Andy Willis (abwillis)]

My build is from the 25th and it doesn't crash when I click forward so I don't
know if this is related but if I have Mozilla set to use a socks server then
Mozilla crashes when I click send on a mail, regardless of forward, reply or
compose.  I don't see a relation but don't want to open a new bug if it is related.
------------------------------------------------------------

04-27-2004  07:05:23  SYS3175  PID 0047  TID 0003  Slot 00a4
E:\BROWSERS\WARPZILLA\MOZILLA.EXE
c0000005
00000000
P1=00000001  P2=00000000  P3=XXXXXXXX  P4=XXXXXXXX
EAX=00000134  EBX=00000000  ECX=00000000  EDX=00000134
ESI=01513780  EDI=027afb8c
DS=0053  DSACC=f0f3  DSLIM=ffffffff
ES=0053  ESACC=f0f3  ESLIM=ffffffff
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:00000000  CSACC=f0df  CSLIM=ffffffff
SS:ESP=0053:027afb7c  SSACC=f0f3  SSLIM=ffffffff
EBP=01127e68  FLG=00012202

Andy

Comment 10

[Mike Kaply [:mkaply]]

Comment on attachment 147158 [details] [diff] [review]
Fix

sr=blizzard (platform specific)
a=mkaply (OS/2 only)

Comment 11

[Mike Kaply [:mkaply]]

Fix checked in.

Comment 12

[Mike Kaply [:mkaply]]

*** Bug 242384 has been marked as a duplicate of this bug. ***

Comment 13

[Karen Huang]

Verified as fix on latest 1.7 branch 06-24 build for Windows, Mac & Linux.
Changing keywords from fixed1.7 to verified1.7.
Leave this bug status "as is" until this bug be verified on trunk again...

Reporter, please reopen this bug if problem is still existing on OS/2.