264467 - Crash if a folder is renamed to anything containing forward slash (/) [@ nsMsgLocalMailFolder::Rename]

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect)

Description

[Brian Brennan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1
Build Identifier: Mozilla Thunderbird version 0.8 (20041014)

If you try to rename a folder to a string that contains the forward slash, on
selecting OK it will change it but leave the folder rename dialog open. If OK is
selected a second time, Thunderbird will crash. If cancel is selected instead,
the folder name with the slash in it will be left as is for the current session
but will be undeletable and unrenamable. Upon restarting firefox, the folder
name will revert to what it was before it was renamed to contain the forward slash.

Reproducible: Always
Steps to Reproduce:
1. Create a folder, name it "foo".
2. Rename folder to "foo / bar" and press OK.
3a. Press OK a second time..
-OR-
3b. Press Cancel.

Actual Results:  
If 3a. is performed, Thunderbird will crash.
If 3b. is performed, the folder will become unrenamable and undeletable. When
trying to rename it back to "foo", an Alert comes up saying "The folder could
not be renamed. Perhaps the folder is being parsed, or the new name is not a
valid name."

Comment 1

[Brian Brennan]

I forgot to add, if step 3b. is followed the folder is only unrenamable and
undeletable for the current session, if Thunderbird is restarted the folder will
revert to being named "foo".

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Can you give us a talkback-id of this crash?

Comment 3

[Brian Brennan]

The original crash was TB1314415Z, I reproduced it at TB1314709Q.

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Confirmed on described talkback-ids.

There are other 330 incidents available whose describing rename of a folder.
Perhaps this could be a dupe but I couldn't find another bug, which handles the
same crash.

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsMsgLocalMailFolder%3A%3ARename&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=

Crash occurs at: parentFolder->GetPath(getter_AddRefs(parentPathSpec));
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/local/src/nsLocalMailFolder.cpp&mark=1234&rev=AVIARY_1_0_20040515_BRANCH#1234

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Ok, tried for myself and can reproduce it with version 0.8 (20041013). 

Hitting ok the first time only shows the hour glass. I have to wait and hit ok
again to crash Thunderbird.

Comment 6

[Karsten Düsterloh]

Same here for a self-built Mozilla 2004-10-14 nightly, so product should
probably be changed to MailNews.

Comment 7

[Mike Cowperthwaite]

*** Bug 265074 has been marked as a duplicate of this bug. ***

Comment 8

[Sean Vickery]

In the report of this bug I filed (bug 265074), I included a stack trace and
register dump from the time of the crash, which might be useful to the person
investigating.

Nominating for blocking-aviary 1.0.

Comment 9

[WADA:World Anti-bad-Duping Agency]

Added Bug 124287 to "blocks bug" as other bugs does.

Comment 10

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Update to comment 4. Here the full stack trace of the talkback incidents.

Stack Signature	 nsMsgLocalMailFolder::Rename 17d72fba
Product ID	Thunderbird10
Build ID	2004091303
Trigger Time	2004-10-14 20:28:07.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	thunderbird.exe + (004e105c)
URL visited	
User Comments	I was managing my RSS feeds, creating folders to sort Fark's RSS
feed into it's seperate categories. I renamed a folder from "Stupid" to "Stupid
/ Dumbass" and it crashed.
Since Last Crash	207781 sec
Total Uptime	207781 sec
Trigger Reason	Access violation
Source File, Line No.
e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/mailnews/local/src/nsLocalMailFolder.cpp,
line 1234
Stack Trace 	
nsMsgLocalMailFolder::Rename 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/mailnews/local/src/nsLocalMailFolder.cpp,
line 1234]
nsMsgFolderDataSource::DoCommand 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/mailnews/base/src/nsMsgFolderDataSource.cpp,
line 831]
CompositeDataSourceImpl::DoCommand 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/rdf/base/src/nsCompositeDataSource.cpp,
line 1340]
nsMessenger::RenameFolder 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/mailnews/base/src/nsMessenger.cpp,
line 1377]
XPTC_InvokeByIndex 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2028]
XPC_WN_CallMethod 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2973]
js_Invoke  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 958]
js_InternalInvoke 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1035]
JS_CallFunctionValue 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 3698]
nsJSContext::CallEventHandler 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1297]
nsJSEventListener::HandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1436]
nsEventListenerManager::HandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1516]
nsXULElement::HandleDOMEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2841]
PresShell::HandleDOMEventWithTarget 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6137]
nsButtonBoxFrame::MouseClicked 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp,
line 178]
nsButtonBoxFrame::HandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp,
line 147]
PresShell::HandleEventInternal 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6101]
PresShell::HandleEventWithTarget 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5982]
nsEventStateManager::CheckForAndDispatchClick 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2921]
nsEventStateManager::PostHandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1921]
PresShell::HandleEventInternal 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6109]
PresShell::HandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5919]
nsViewManager::HandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line
2290]
nsViewManager::DispatchEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line
2030]
HandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 79]
nsWindow::DispatchEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x3a50 (0x77d43a50)
USER32.dll + 0x3b1f (0x77d43b1f)
USER32.dll + 0x3d79 (0x77d43d79)
USER32.dll + 0x3ddf (0x77d43ddf)
nsContentTreeOwner::ShowAsModal 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp,
line 449]
GlobalWindowImpl::OpenInternal 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 4680]
GlobalWindowImpl::OpenDialog 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 3377]
XPTC_InvokeByIndex 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2028]
XPC_WN_CallMethod 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2973]
js_Invoke  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 958]
nsXPCWrappedJSClass::CallMethod 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1336]
nsXPCWrappedJS::CallMethod 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
XPTC_InvokeByIndex 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2028]
XPC_WN_CallMethod 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2973]
js_Invoke  [e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 958]
js_InternalInvoke 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1035]
JS_CallFunctionValue 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 3698]
nsJSContext::CallEventHandler 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1297]
nsJSEventListener::HandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsXBLPrototypeHandler::ExecuteHandler 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp,
line 463]
nsXBLWindowHandler::WalkHandlersInternal 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLWindowHandler.cpp,
line 298]
nsXBLWindowKeyHandler::WalkHandlers 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp,
line 197]
nsXBLWindowKeyHandler::KeyPress 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp,
line 250]
nsEventListenerManager::HandleEvent 
[e:/builds/tbird-tbox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1524]

Comment 11

[Scott MacGregor]

Attachment: the fix

Comment 12

[Scott MacGregor]

Comment on attachment 163355 [details] [diff] [review]
the fix

We fixed ::CreateSubFolder during the 0.8 time frame to handle forward slashes
and other troublesome url delimiting characters.

But we never made the same change to ::Rename.

Comment 13

[Scott MacGregor]

fixed branch and trunk

Comment 14

[WADA:World Anti-bad-Duping Agency]

Verified with Mozilla Suite 2004102604-trunk on Win-2K(NTFS drive).
 (1) Create a folder named "A" under a folder and copy a mail to it.
     A/A.msf were created  
 (2) Rename folder name of "A" to "/".
     A/A.msf were changed to 00000045/00000045.msf
 (3) Move folder named "/" from a folder to another folder
 (4) Move back folder named "/" to original folder
 (5) Delete folder named "/"
All of above test were successfull.

However, regression on folder renaming has been newly generated in addition to
regression on folder creation.
See bug 264071 comment #21.

Comment 15

[Henrik Skupin [:whimboo][⌚️UTC+2]]

v.

Comment 16

[Scott MacGregor]

*** Bug 266950 has been marked as a duplicate of this bug. ***

Comment 17

[Robin Monks]

*** Bug 219905 has been marked as a duplicate of this bug. ***