324293 - Crash on dates before 1970 and after 2038 [@icaltime_from_timet_with_zone]

Status: RESOLVED FIXED

(Calendar :: Internal Components, defect)

Description

[gekacheka]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060121 Mozilla Sunbird/0.3a1+

Sunbird crashes when selecting events dated before 1970 in an ics calendar.
Such dates are common among users who keep birth-dates of their relatives in a calendar.

Crash probably occurs when setting the calDateTime.nativeTime.

Reproducible: Always

Steps to Reproduce:
1. Open ics file with date before 1970.
2. Select the event in event list.


Actual Results:  
Crash:  The instruction at "0x0088864e" referenced memory at "0x00000000".  The memory could not be "read".

Expected Results:  
No crash.

Was able to cause same crash message by running this code:

    var d1 = Components.classes["@mozilla.org/calendar/datetime;1"]
              .createInstance(Components.interfaces.calIDateTime);
    d1.year= 1960;
    d1.timezone="UTC";
    d1.normalize();
    alert("d1: "+d1+" nativeTime="+d1.nativeTime);
    var d2 = Components.classes["@mozilla.org/calendar/datetime;1"]
              .createInstance(Components.interfaces.calIDateTime);
    d2.nativeTime = d1.nativeTime;           // <-- crashes here.
    alert("completed");                      // <-- never reached.

Note that the d1 nativeTime is -1 * million.  -1 (one second before epoch) is a cardinal error value.

May be related to bug 278236, but this bug crashes, and jsDate is not involved.

Comment 1

[gekacheka]

Attachment: Sample event on 1960-1-1

Comment 2

[Joey Minta]

jsDate relies on nativeTime, which does not come out properly for these earlier dates.  I strongly suspect that both this bug and bug 278236 have the same root cause, namely reliance on time_t.  Setting nativeTime calls setTimeInTimezone, which relies on a time_t object.

Sunbird 0.2 had some useful libical datetime to/from prtime functions in libxpical/oeICalEventImpl.cpp at line 87.  Adaptations of those could probably help us out a lot here.  (I'm happy to paste the original functions here if someone is having trouble tracking them down, since libxpical was cvs-removed.)

Comment 3

[Stefan Sitter [:ssitter]]

Extract of the stacktrace from the crash when selecting a date before 1970-01-01 in datepicker:

00 sunbird!icaltime_from_timet_with_zone(long tm = -50400, int is_date = 0, struct _icaltimezone * zone = 0x013cb410)+0x3b 
   [d:/dev/mozilla/calendar/libical/src/libical/icaltime.c @ 192]

01 sunbird!calDateTime::SetTimeInTimezone(int64 aTime = -50400000000, class nsACString_internal * aTimezone = 0x00123138)+0xb6 
   [d:/dev/mozilla/calendar/base/src/calDateTime.cpp @ 332]

02 sunbird!calDateTime::SetNativeTime(int64 aNativeTime = -50400000000)+0x2a 
   [d:/dev/mozilla/calendar/base/src/calDateTime.cpp @ 233]

03 sunbird!calDateTime::SetProperty(class nsIXPConnectWrappedNative * wrapper = 0x037447d8, struct JSContext * cx = 0x03200420, struct JSObject * obj = 0x024656b0, long id = 37640732, long * vp = 0x00124218, int * _retval = 0x001231bc)+0xf8 
   [d:/dev/mozilla/calendar/base/src/calDateTime.cpp @ 707]

04 sunbird!XPC_WN_Helper_SetProperty(struct JSContext * cx = 0x03200420, struct JSObject * obj = 0x024656b0, long idval = 37640732, long * vp = 0x00124218)+0x96 
   [d:/dev/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp @ 953]

05 js3250!js_SetProperty(struct JSContext * cx = 0x03200420, struct JSObject * obj = 0x024656b0, long id = 37704920, long * vp = 0x00124218)+0xc43 
   [d:/dev/mozilla/js/src/jsobj.c @ 3161]

06 js3250!js_Interpret(struct JSContext * cx = 0x03200420, unsigned char * pc = 0x026c4b29 "", long * result = 0x0012440c)+0xe731 
   [d:/dev/mozilla/js/src/jsinterp.c @ 3610]

Hope this helps to find the proper solution.

Comment 4

[Michiel van Leeuwen (email: mvl+moz@)]

I think bug 278236 will fix this crash, but i can't test (because linux doesn't crash here)

Comment 5

[Michiel van Leeuwen (email: mvl+moz@)]

*** Bug 341868 has been marked as a duplicate of this bug. ***

Comment 6

[Joey Minta]

*** Bug 305838 has been marked as a duplicate of this bug. ***

Comment 7

[Reed Loden [:reed]]

The bugspam monkeys have struck again. They are currently chewing on default assignees for Calendar. Be afraid for your sanity!

Comment 8

[Joey Minta]

*** Bug 349696 has been marked as a duplicate of this bug. ***

Comment 9

[Matthew (lilmatt) Willis]

gekacheka:
mvl landed bug 278236. Can you still reproduce this crash in nightlies?

Be aware that once you go < 1970, you should end up in floating time, since our timezone definitions all start in 1970.

Comment 10

[gekacheka]

Looks fixed by bug 278236.  

(Unfortunately in the process of testing this I found bug 354073, but the test cases for this bug all seem to work for me now.)

Comment 11

[Stefan Sitter [:ssitter]]

*** Bug 359720 has been marked as a duplicate of this bug. ***

Comment 12

[Paul Ivanov]

< 1970 works for me, but >2037 causes sunbird to hang and become unresponsive for a while. After coming back it does not go to the event but stays on the current day/week.

Comment 13

[Paul Ivanov]

my mistake, it's working