Last Comment Bug 336957 - Crash when calling messageServiceFromURI("file://...").streamMessage [@ nsMailboxService::FetchMessage]
: Crash when calling messageServiceFromURI("file://...").streamMessage [@ nsMai...
Status: RESOLVED FIXED
: crash, fixed1.8.0.7, fixed1.8.1, verified1.8.1.3
Product: MailNews Core
Classification: Components
Component: Database (show other bugs)
: 1.8 Branch
: x86 Windows 2000
: -- critical (vote)
: ---
Assigned To: timeless
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2006-05-07 01:22 PDT by Jens Bannmann
Modified: 2008-07-31 01:22 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---


Attachments
look before leaping (8.77 KB, patch)
2006-05-07 02:03 PDT, timeless
mozilla: review+
mozilla: superreview+
dveditz: approval1.8.0.7+
mtschrep: approval1.8.1+
Details | Diff | Splinter Review

Description Jens Bannmann 2006-05-07 01:22:27 PDT
To read the original message source, one can ask the Messenger for the respective message service, from which one can then stream the message. This works fine for mailbox-message://, but when a file:// URL is used that points to a saved e-mail (.eml format), Thunderbird crashes (talkback report TB18391440X).


messageURI = "file:///C:/foo.eml?type=application/x-message-display";
stream = Components.classes["@mozilla.org/network/sync-stream-listener;1"]
                   .createInstance()
                   .QueryInterface(Components.interfaces.nsIInputStream);
messenger.messageServiceFromURI(messageURI)
         .streamMessage(messageURI, stream, msgWindow, null, false, null);


This was discovered with the MessageFaces extension, which I built without thinking that I might have to handle EML files in a different way than mailbox messages. If the messenger.messageServiceFromURI returned null for file:// URLs, and/or the message service streamMessage() implementations failed cleanly, other extensions with the same error would still be broken, but things would look way better :-)
Comment 1 timeless 2006-05-07 01:59:24 PDT
fwiw:

                   .createInstance()
                   .QueryInterface(Components.interfaces.nsIInputStream);

can be replaced with:
                   .createInstance(Components.interfaces.nsIInputStream);

it's cheaper.

While i'm handing out notes
SyncStream = Components.Constructor("@mozilla.org/network/sync-stream-listener;1", Components.interfaces.nsIInputStream);
...
stream = new SyncStream;

Anyway, patch for your bug in a moment.
Comment 2 timeless 2006-05-07 02:03:08 PDT
Created attachment 221153 [details] [diff] [review]
look before leaping
Comment 3 Adam Guthrie 2006-05-07 10:49:19 PDT
Incident ID: 18391440
Stack Signature	nsMailboxService::FetchMessage 83c42599
Product ID	Thunderbird15
Build ID	2006030803
Trigger Time	2006-05-07 01:19:23.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	thunderbird.exe + (004efec0)
URL visited	
User Comments	
Since Last Crash	1514 sec
Total Uptime	31547 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 259
Stack Trace 	
nsMailboxService::FetchMessage  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 259]
nsMailboxService::StreamMessage  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 309]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_CallMethod  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Execute  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424]
obj_eval  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1266]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Execute  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424]
obj_eval  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1266]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
js_Interpret  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Invoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
js_InternalInvoke  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1274]
JS_CallFunctionValue  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4171]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1411]
nsGlobalWindow::RunTimeout  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6360]
nsGlobalWindow::TimerCallback  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6723]
nsAppStartup::Run  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mail/app/nsMailApp.cpp, line 62]
KERNEL32.DLL + 0x11af6 (0x77e81af6)
Comment 4 Jens Bannmann 2006-06-20 14:48:58 PDT
timeless, would this be suitable for the 1.8 branch? I noticed that you ported other patches to that file back to the branch, but not this one...

(Come to think of it, this might even be a candidate for a 1.8.0.x Gecko, as it's clearly stability-improving)
Comment 5 timeless 2006-06-21 00:04:56 PDT
Comment on attachment 221153 [details] [diff] [review]
look before leaping

mozilla/mailnews/local/src/nsMailboxService.cpp 	1.122
Comment 6 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2006-06-23 11:32:55 PDT
Seems kind of scary that this function can return success without touching aURL.
Comment 7 timeless 2006-06-25 00:52:17 PDT
Comment on attachment 221153 [details] [diff] [review]
look before leaping

MOZILLA_1_8_BRANCH:
mozilla/mailnews/local/src/nsMailboxService.cpp 	1.114.8.6
Comment 8 timeless 2006-07-02 05:08:10 PDT
i filed bug 343398 for dbaron.

i'm using this bug simply to fix the crash, which i believe i did.

if anyone wants to do anything else (including object to my fixing this bug) then they're free to use any bug that isn't assigned to me.
Comment 9 Daniel Veditz [:dveditz] 2006-08-15 15:05:45 PDT
Comment on attachment 221153 [details] [diff] [review]
look before leaping

approved for 1.8.0 branch, a=dveditz for drivers
Comment 10 timeless 2006-08-23 06:00:23 PDT
Comment on attachment 221153 [details] [diff] [review]
look before leaping

MOZILLA_1_8_0_BRANCH:
mozilla/mailnews/local/src/nsMailboxService.cpp 	1.114.8.3.2.2
Comment 11 Marcia Knous [:marcia - use ni] 2006-09-07 11:00:48 PDT
Jens: I am wondering if you have a suggestion as to an easy way I can verify that the patch fixes the crash. 
Comment 12 Jens Bannmann 2006-09-07 14:26:55 PDT
(In reply to comment #11)
> Jens: I am wondering if you have a suggestion as to an easy way I can verify
> that the patch fixes the crash. 

The following line crashes Thunderbird 1.5.0.5 when evaluated in the JS console:

messageURI = "file:///C:/foo.eml?type=application/x-message-display"; stream = Components.classes["@mozilla.org/network/sync-stream-listener;1"].createInstance(Components.interfaces.nsIInputStream); Components.classes['@mozilla.org/messenger;1'].getService(Components.interfaces.nsIMessenger).messageServiceFromURI(messageURI).streamMessage(messageURI,stream,null, null, false, null);

The original code passed a non-null value for msgWindow to streamMessage(), but getting one from the JS console did not seem easy. I guess it is still a sufficient test case.
Comment 13 Carsten Book [:Tomcat] 2007-04-06 07:46:58 PDT
verified fixed 1.8.1.3 with Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.0 ID:2007032620 using Talkback Data and the testcase from comment #12

Note You need to log in before you can comment on or make changes to this bug.