Closed Bug 326344 Opened 19 years ago Closed 16 years ago

Firefox crashes on Yahoo Mail when trying to send a mail without a recipient (involves npYState.dll plugin)

Categories

(Core :: XPConnect, defect)

Product:
Core
Component:
XPConnect
Version:
1.8 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: kartiknagaraja, Assigned: granrosebugs)

References

(
URL
)

Details

(Keywords: crash, testcase, topcrash)

Attachments

(2 files)

Content policy component for testcase
1.13 KB, text/plain
Details
Testcase
65 bytes, text/html
Details
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1 I have noticed that Firefox 1.0.5.1 seems to crash when you try to send a mail through Yahoo Mail when you haven't specified an email addresss. If the same operation were to be done through IE, then a message appears on the top reporting that: There was a problem: Please enter at least one addressee in the To field. Your message has not been sent. Please try to look into the issue. I have also noticed that it crashes when you are to close all the windows except for the Download Manager window. This did not used to happen with the earlier releases of Firefox. I am an avid user of Firefox for the different functionalities that it offers. So reporting the problems and having them fixed would be great. Reproducible: Always Steps to Reproduce: 1.Goto mail.yahoo.com and sign in 2.Try to compose a mail 3.Type in the subject and body but leave the address field blank. Actual Results: Firefox crashes. Expected Results: Should report that the "TO" address is empty and the message was not sent.
I could not reproduce the crash in 1.5.0.1 on winxp, but that doesn't mean you didn't see it. Are you prompted to send in a talkback incident about the crash? It would be helpful if you could send in a talkback and paste the incident id here. Anything you can tell us about what you have done to customize firefox such as plugins and extensions or any configuration changes you have made or anything you can think of? talkback shows the top crasher in ntdll.dll has many comments about crashing in yahoo mail.
Keywords: crash
There is a talkback report on this: http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=15138602 I get continued reports about crashes with Yahoo Mail and Adblock or Adblock Plus, can't reproduce it myself however. Unfortunately talkback usually isn't very helpful. Latest is http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=15256911, stack trace is empty. http://bugzilla.mozdev.org/show_bug.cgi?id=13091 lists the following talkbacks: TB14752632G, TB14752373H, TB14752355Z, TB14752156G, TB14751626M, TB14751136M, TB14750305W, TB14750173Y, TB14749943Y, TB14749863Y, TB14749763E, TB14754444Z The stack signature of the crash varies here, it appears to be a data corruption issue.
Tweaking summary so the bug can be found by the keyword "Yahoo Mail".
Summary: Firefox crashes when trying to send a mail without having specified an address → Firefox crashes on Yahoo Mail when trying to send a mail without a recipient
More talkbackId from yahoo mail beta ==================================== 1. ntdll.dll + 0x11f6e (0x7c911f6e) 06351aeb http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=15329693 2. ntdll.dll + 0x18fea (0x7c918fea) efed733c http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=15215723 Some similar bugs: https://bugzilla.mozilla.org/show_bug.cgi?id=320605 https://bugzilla.mozilla.org/show_bug.cgi?id=321387
Component: General → Build Config
Product: Firefox → Core
Version: unspecified → 1.0 Branch
might take a bit to find the right component for this one... first try switch from firefox general...
Component: Build Config → Embedding: Docshell
ntdll usually means heap corruption and is not a useful thing to blame for anything.
I was finally able to track this down. These crashes are caused by the plugin "Yahoo Application State" (npYState.dll), installed by Yahoo Messenger. Purpose of this plugin is unclear, I will request information from Yahoo (and send them info on the crash of course). Removing it definitely solves the problem (it is usually installed in C:\Program files\Yahoo!\Shared). kartiknagaraja: You should test whether removing this plugin solves you problem (check about:plugins to find out whether you have it installed). If it does, then it is the same issue.
Thanks.. I created another dir at Shared, and moved the dll over. noticed that firefox no longer crashes when you try to send an empty mail through yahoo. Thanks trev@gtchat.de
A few more details: in my case the crash seems to be triggered when the web bug loaded from yahoo.ivwbox.de is blocked (meaning especially that it gets the style display:none). I don't see this web bug unless nsYState.dll is installed, so I guess it there for the plugin to use. IVW being "Informationsgemeinschaft zur Feststellung der Verbreitung von Werbeträgern e.V." (Society for determinining the distribution of advertising media) I have the bad feeling that Yahoo Messenger users are being spied upon.
Now it gets weird. Blocking ivwbox.de is a sure way to crash but I noticed that crashes still occur even if nothing is blocked - it simply takes longer, you have to change between Mail/Inbox/Compose a number of times. There are no crashes if Adblock Plus is disabled via extension manager. Ok, re-enabled and changed the content policy component so it doesn't do anything (always returns OK immediately) - crashes. browser.xul overlay removed (meaning user interface for Adblock Plus isn't loaded at all) - still crashes. And there isn't much more going on in Adblock Plus. Unfortunately I didn't finish localizing the problem when Yahoo banned me - guess they don't like people clicking links all the time.
Sorry, comment 10 isn't quite true, the yahoo.ivwbox.de web bug isn't related to the plugin. From http://us.js2.yimg.com/us.js.yimg.com/lib/pim/r/medici/13_14/mail/mailcommonlib.js it looks that the purpose of the plugin is to tell Yahoo Mail, which version (if any) of Yahoo Messenger you have installed. It should then offer you some messenger links (voice mail) but it doesn't work because of a bug in ymsgr_is_messenger(). Still trying to figure out what exactly is causing this to crash...
Talkback from my crashes: TB16582675G, TB16582647E Stack traces: ntdll.dll + 0x4bd4e (0x77fcbd4e) MSVCRT.DLL + 0x1532 (0x78001532) MSVCRT.DLL + 0x14cf (0x780014cf) nsEditor::PostCreate [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/editor/libeditor/base/nsEditor.cpp, line 337] nsCSSFrameConstructor::ConstructHTMLFrame [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5621] nsCSSFrameConstructor::ConstructFrameInternal [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7735] nsCSSFrameConstructor::ConstructFrame [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7624] nsCSSFrameConstructor::ProcessChildren [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12012] ... ntdll.dll + 0x4c453 (0x77fcc453) MSVCRT.DLL + 0x1532 (0x78001532) MSVCRT.DLL + 0x14cf (0x780014cf) nsCSSFrameConstructor::InitAndRestoreFrame [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6845] nsCSSFrameConstructor::ConstructHTMLFrame [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5561] nsCSSFrameConstructor::ConstructFrameInternal [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7735] nsCSSFrameConstructor::ConstructFrame [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7624] nsCSSFrameConstructor::ProcessChildren [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12012] ...
I was able to reliably reproduce this crash with a minimized test case. It came out that the pure fact of registering a content policy is enough to trigger the crash. As there are content policy implementations in the browser by default I guess the important thing here is that the content policy is written in JavaScript. There were a few stack traces with hints into the direction of XPCNativeWrappers, and it was reported that this crash doesn't occur with Firefox 1.0 (I didn't have time to check myself yet). So my bet is on XPCNativeWrappers, moving to XPConnect and confirming. Testcase coming.
Status: UNCONFIRMED → NEW
Component: Embedding: Docshell → XPConnect
Ever confirmed: true
Version: 1.0 Branch → 1.8 Branch
This component will register a minimal content policy - an empty JavaScript object. To install save the file into components subdir in your application directory. Then remove the file compreg.dat in your profile to make it rebuild on next startup.
Attached file Testcase —
Steps to reproduce: - Install the component attached above - Save this testcase to your disk (to save Bugzilla's traffic) - Install Yahoo Messenger 7.0 from http://messenger.yahoo.com/download.php (it should be enough to put npYState.dll into plugins directory but I don't think I should attach this file here), restart Firefox. - Now open the testcase, press Ctrl-R and hold it pressed. The crash should occur in under 30 seconds. Note: you shouldn't open JavaScript console when the component is installed, it will create an infinite loop.
Attachment #215660 - Attachment mime type: application/octet-stream → text/plain
Tested in different Firefox version on Windows 2000 SP4: Firefox 1.0.7 - crash Firefox 1.5 - crash Firefox 1.5.0.1 - crash 2.0a1-2006032005 nightly - crash trunk-2006032004 nightly - no crash
Pre-Cairo trunk nightlies crash all on this testcase - including 2006022107.
Some talkback reports again, this time on trunk: TB16604603X, TB16604532Y, TB16604481Y, TB16604399H, TB16604339Y, TB16604295H, TB16604185Q, TB16604132X, TB16604063M, TB16603952Z The crash is always in RtlAllocateHeap, the next two frames are malloc calls. So this is a heap corruption. Which leaves me with the problem that I don't have a tool that would help me find out when this heap corruption happens. Anybody willing to help?
biesi, didn't we have a bug where a JS content policy (adblock or something?) caused issues because it caused us to instantiate plugins sync? I know we fixed that on trunk, but I see nothing related in the range from comment 18...
that was: 2005-12-03 03:26 Bug #315841 don't flush frames in order to ensure that plugins are instantiated.
So if I had to guess, the heap corruption is there in cairo builds too and just not triggering crashes as obviously... Blake, do you have something like valgrind or equiv on Windows?
I don't unfortunately. Running this testcase under Purify might shed some light, though.
*** Bug 316507 has been marked as a duplicate of this bug. ***
*** Bug 328685 has been marked as a duplicate of this bug. ***
*** Bug 328764 has been marked as a duplicate of this bug. ***
*** Bug 335346 has been marked as a duplicate of this bug. ***
Keywords: testcase
Summary: Firefox crashes on Yahoo Mail when trying to send a mail without a recipient → Firefox crashes on Yahoo Mail when trying to send a mail without a recipient (involves npYState.dll plugin)
*** Bug 335346 has been marked as a duplicate of this bug. *** Yeah,, That's nice except in 335346 I'm not using XP. I don't have the npYState.dll plugin. ~ The file is non-existant on my system. TB18361757E TB18361767Z TB18391120Q .
*** Bug 334375 has been marked as a duplicate of this bug. ***
Firefox crashed after I had started it and gotten to my home page, WHICH IS YAHOO. I checked the extension manager to see if any extensions needed updating, at which point Firefox immediately crashed: FIREFOX caused an invalid page fault in module MSVCRT.DLL at 0167:7800d16a. Registers: EAX=00e30008 CS=0167 EIP=7800d16a EFLGS=00010283 EBX=00000008 SS=016f ESP=00d1d0e0 EBP=00d1d0fc ECX=00e33fc8 DS=016f ESI=0591f00c FS=4657 EDX=00000011 ES=016f EDI=0000001f GS=0000 Bytes at CS:EIP: 8b 5c d1 04 8d 0c d1 89 5e 04 89 4e 08 89 71 04 Stack dump: 00000000 00000105 0591f0a0 00e33fc8 00000000 00000090 00000120 00d1d15c 78011b77 00e30138 0591f00c 05920ef0 0591f0a0 00000090 000000fd 000000fd TB18572641G - Talkback ID Windows 98SE
TB18633597H - This crash occured when I was viewing a profile in Yahoo 360. I had just clicked on the Icon of one of Friends of the person whose profile I was viewing, when Firefox crashed.
Jack, this isn't a generic bug for any Yahoo-related crash. Your crashes seem to be caused by different problems, you should file separate bugs on them.
Blocks: 322363
*** Bug 339224 has been marked as a duplicate of this bug. ***
Assignee: nobody → dbradley
QA Contact: general → xpconnect
how can i get my browser to work , lately when i go to see my emails at Yahoo.com, all the browser do it get stuck on a page, when i try to delete or tune another, the green dot down at the bottomof the page just stay there onstruck. do have a way to fix this , Allen
A temporary fix is to rename the npYstate.dll file. It still crashes on the latest branch nightly and the new Yahoo Messenger's npYstate.dll
*** Bug 347375 has been marked as a duplicate of this bug. ***
The steps to reproduce described in this bug ***may*** be a description of the problem that is our #1 topcrash. I think we need to put resources into investigating this for 1.8.1.1.
Flags: blocking1.9?
Flags: blocking1.8.1.1?
Keywords: topcrash
seeing if I can find some one at yahoo to help investigate too...
The Messenger team recently fixed a bug related to npystate.dll (bug 322363) that will be in the next release. If these crashes only happen with npystate.dll, this might be resolved then. Is this a dup, or something completely different?
Plussing for investigation. Granrose: can you get us a pre-release copy of your new messenger so we can test and see if this does indeed fix the problem?
Assignee: dbradley → granrosebugs
Flags: blocking1.8.1.1? → blocking1.8.1.1+
It should be in 8.1 which was released last week - http://messenger.yahoo.com
bug reporter, if you have yahoo messenger installed, try the new version 8.1 http://messenger.yahoo.com/ which is reported in bug 322363. If your problem goes away then close your bug as a duplicate of bug 322363.
Flags: blocking1.8.1.1+ → wanted1.8.1.x+
Flags: wanted1.8.1.x+
I have two CPUs. One Linux anda one WinXP. Both computers possess the Firefox. In these two computers I do not obtain to have access, with the Firefox, the pages of email of the Yahoo! (mail.yahoo.fr and mail.yahoo.com.br). The Firefox stops and closes in 90% of my attempts to have access my email. Moreover, in these problems, it it does not obtain to send the report of errors for the central office of the Mozilla. It would like to know what I must make to have access mine normally e-mails with the Firefox. Thanks Arthur Meucci
Arthur, did you try following? 1.Firefox's safe-mode to exclude extension problems 2.a new profile 3.a reinstall in a new empty directory ? Links: http://kb.mozillazine.org/Safe_Mode_(Firefox) http://kb.mozillazine.org/Profile_Folder http://forums.mozillazine.org/viewforum.php?f=38 http://www.mozilla.com/en-US/firefox/all.html FF 1.5.0.1 has many crash problem but FF 2.0.0.x looks pretty solid.
Seems like the yahoo team has come out with a new version of npYState.dll that might have fixed this. If anyone can still reproduce with a recent version of the plugin on trunk please renominate for blocking1.9
Flags: blocking1.9? → blocking1.9-
I don't believe this one is dead yet - did it move to another thread?
This issue was about yahoo's page crashing with Firefox not email, after renaming the above .dll the issue was resolved. eg npYState1.dll This thread is over a year old. lmao
Boy, that's helpful and a positive contribution. Title of the thread is "Firefox crashes on Yahoo Mail when trying to send a mail without a recipient (involves npYState.dll plugin)". It's one of several that may all be related, since the issue remains unsolved -- look through the forums and see how many times this or something closely related comes up. There's a problem here, it may be partially with Yahoo and partially with FF, it's definitely inconsistent and asynchronous -- but it's real and has been an issue for a long time. Prior to my post to this thread, the most recent post was in May 2007 -- so not sure where your "over a year old" comment comes from. Bottom line -- if you use Yahoo Mail's most recent version, which has been "beta" now for almost a year, FF will crash out repeatedly in many different circumstances, especially those related to going into the mail app when notified by an IM alert. This issue has been discussed and kicked around for well over a year -- and it's not fixed.
So do you use the latest version of npYState? (what is it? what is the version of yahoo messenger you have installed?) What version of Firefox do you use? Did you try the 3.0 beta (as comment 46 you refer to says)? Bugzilla is not a forum, it's a tool for tracking issues; please post with detailed information and avoid flaming each other.
(In reply to comment #49) > Bottom line -- if you use Yahoo Mail's most recent version, which has been > "beta" now for almost a year, FF will crash out repeatedly in many different > circumstances, especially those related to going into the mail app when > notified by an IM alert. This issue has been discussed and kicked around for > well over a year -- and it's not fixed. To help clarify the situation, if you switch back to "Yahoo Mail Classic", does Firefox still crash as much???
Thanks Nickolay... :) I posted the fix long ago and have never had a problem since...the fix came way before v2.0 Why would someone want to send a email without a recipient anyway? lmao
Just sent a test email using yahoo with no recipient, no crash here... Firefox v2.0.0.9
Blocks: abp
WFM using both 3.0.10 and 3.5 Beta 4 on Windows XP Is this bug still valid?
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: