376082 - Thunderbird Trunk Nightly crashes on hitting Reply or Composing a New Email Message [@ NS_strlen - mozMySpell::ConvertCharset][@ NS_strlen - mozMySpell::Suggest][@NS_strtok]

Status: RESOLVED FIXED

(Core :: Spelling checker, defect)

Description

[Peter Reynolds]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3
Build Identifier: Thunderbird 3 alpha 1 (trunk nightly) 20070330 on Windows XP.

On upgrading to the last few trunk nightlies of Thunderbird 3 Alpha 1 (the latest example being 20070330), Thunderbird has crashed and invoked the Crash Reporting thingy (both Windows and Thunderbird's own) as soon as I have hit Reply.  Getting mail is fine - it's when I start replying that the problem occurs.

The same happens when starting a new email message.  Talk back details file on this here 
http://www.freenetpages.co.uk/hp/reynoldsp/details.txt

I've had to download an earlier version (20070325) to fix this.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Julien Moorrees]

This is confirmed. Hitting reply or new crashes thunderbird. I think this has got todo with the text-area control, since at the same time minefield latest trunk apears, it also crahses everytime a textarea has to be rendered. It appears in:
version 3 alpha 1 (20070330)

Comment 2

[Julien Moorrees]

I have 3 talkback ID's that where send:
TB30755154Z
TB30755132Q
TB30745649G

Comment 3

[Peter Reynolds]

Hmm... I thought it must be just me as I couldn't find anything about it on Bugzilla or Mozillazine!

Comment 4

[Julien Moorrees]

Also take a look at https://bugzilla.mozilla.org/show_bug.cgi?id=373658 since they appear to have a relation.

Comment 5

[Julien Moorrees]

Also the newest thunderbird trunks crashes when hitting reply.
Trackback record: TB30770686G

version 3 alpha 1 (20070331)

Comment 6

[timeless]

Incident ID: 30770686
Stack Signature	NS_strlen 225ebb7a
Product ID	ThunderbirdTrunk
Build ID	2007033103
Trigger Time	2007-03-31 13:42:44.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	xpcom_core.dll + (0000219d)
URL visited	
User Comments	Replying a normal message.
Since Last Crash	21 sec
Total Uptime	21 sec
Trigger Reason	Access violation
Source File, Line No.	d:\builds\tinderbox\tb-trunk\winnt_5.2_depend\mozilla\xpcom\build\nscrtglue.cpp, line 102
Stack Trace 	
NS_strlen  [mozilla/xpcom/build/nscrtglue.cpp, line 102]
myspell.dll + 0x4c54 (0x60044c54)
NS_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2247]

crashing in NS_strlen is legal if someone passes a null pointer, the culprit should be one of:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/extensions/spellcheck/myspell/src/mozMySpell.cpp&rev=1.18&mark=392,496

for now, I've tagged the summary w/ both possible crash points. Hopefully only one of them is a real crash point. Worst case I'm wrong about where this is happening.

It's too late for me to try to figure out where the pointers come from, they don't seem very local.

Comment 8

[Joe Sabash [:JoeS1]]

Since I am running nightly trunk builds also in WinXP without any crash problems, I am wondering just what the difference might be. One possibility is that I am running with administrator privs. You might check that in a current build.
If you can run OK, then a pending checkin here  bug 375102 will fix the problem.

Comment 9

[Julien Moorrees]

(In reply to comment #8)
> One possibility is
> that I am running with administrator privs. You might check that in a current
> build.
> If you can run OK, then a pending checkin here  bug 375102 will fix the
> problem.
> 

I also run in administrator privs. This is no problem at all. Maybe it has something to do with multi-threading and dual processors? I am running on an athlon X2-64 3800+. What are your specs?

Comment 10

[Joe Sabash [:JoeS1]]

P3 Tualitan -s 1.4 gig Guess it could be the dual core difference

Comment 11

[Peter Reynolds]

I have a Hewlett Packard Pavilion a409.uk with Intel Celeron 2.6 GHz, 0.99 GB of RAM.

I don't know what you mean about administrator privileges, but I am the owner and only user of the computer so if you're talking about my Windows XP then yes I presume I do have these.  I'm afraid bug 375102 is double dutch to me!

How many users have now reported this bug?  I'm guessing 3, myself, Julien Moorees, and Frederick Almgren (who submitted it as bug 376087)

Comment 12

[Peter Reynolds]

My wife also runs Thunderbird on her laptop, using the data files on my computer (over a newtork) but with the standard non-Beta non-Alpha version (1.5.0.10 20070221)

So to test the theory that the problem might be specific to a particular computer I temporarily installed TB 3 Trunk Alpha 1 (20070330) on hers.

Thunderbird 3 does not crash on hers despite the fact that the files are located on my computer.

She has Toshiba Satellite A15-S127 with Mobile Intel Celeron CPU 2GHz, 240MB of RAM

Does this help?

Comment 13

[Fredrik Almgren]

Thunderbird nightly has been crashing in this way for me since sometime
last week. Then the TalkBack reporting was triggered everytime and I did
not bother reporting it since I figured it was automatically handled. I did
report it when the talkback stopped working. I am now running the (20070401)
nightly and it still crashes but now the Talkback is active again.

As I wrote in the duplicate I happened to file, Thunderbird crashes also
when I go into Tools->Options and choose "Composition".

My hardware is an IBM T42P laptop with an Intel Pentium M 1.8GHz if that was
not already known.

Comment 14

[Peter Reynolds]

My wife also runs Thunderbird on her laptop, using the data files on my computer (over a newtork) but with the standard non-Beta non-Alpha version (1.5.0.10 20070221)

So to test the theory that the problem might be specific to a particular computer I temporarily installed TB 3 Trunk Alpha 1 (20070330) on hers.

Thunderbird 3 does not crash on hers despite the fact that the files are located on my computer.

She has Toshiba Satellite A15-S127 with Mobile Intel Celeron CPU 2GHz, 240MB of RAM

Does this help?

Comment 15

[Peter Reynolds]

How do I get my Talkback incident numbers?

I've just looked on Talkback regarding Thunderbird Trunk and there have been 87 crashes relating to NS_strlen starting on 28 March
http://talkback-public.mozilla.org/reports/thunderbird/
click on Trunk

I notice they only mention bug 336737 - is there any way of getting the problem linked to this bug too?

Later I'll check to see what spellchecker installations my wife and I have on our different computers that could account for the lack of crashing on hers.

Comment 16

[Michael Mak]

Any build between 0328 nightly trunk to 0402 nightly trunk builds crashes when I hit reply or compose a new message.

Talkback ID (with builds from 0328 to 0402):

TB30813031Z, TB30813008X, TB30812777Y, TB30804360K, TB30803884K, TB30803882X

Working build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070327 Thunderbird/3.0a1 ID:2007032703 [cairo]

Comment 17

[Nicholas Wourms]

This bug is also present in Firefox trunk. It is triggered with Firefox's inline html form spellchecking. If you have the inline spellchecker enabled, all Minefield trunk nightlies since 0328 will crash immediately upon loading any webpage with a multi-line form.

Talkback IDs:
<a href="http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB30793548W">TB30793548W</a>, <a href="http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB30817600X">TB30817600X</a>

Comment 18

[Peter Reynolds]

OK I checked out the spellcheckers on my own and wife's computers.  Both appear to be English-US, neither appears to be functioning right now (grossly misspelled text gets no results), though both show it as installed.  I viewed Tools Options on my wife's computer with 20070330 (TB Trunk 3.0 Alpha 1), and on my own computer with 20070325.  When I reinstalled 20070330 on my own computer to check it out there, as soon as I clicked on Options in the Tools menu, Thunderbird crashed and invoked Talkback.  BTW I am still not seeing anything from Talkback that indicates an incident number - I still have no idea where the rest of you are getting those from!

Comment 19

[Julien Moorrees]

You can get your trackback ID's from:
\thunderbird-win32\extensions\[e-mail]\components\talkback.exe
Just execute the .exe file, and right click on copy on the incident. Paste it here, and it is automatically converted to a link.

Is there any way to disable this spellchecking without crashing the app?

Comment 20

[Peter Reynolds]

Thanks Julien, easy when you know how!  Here are my Trackback incidents so far.

TB30820770K
TB30755427Z
TB30754243G

Comment 21

[Peter Reynolds]

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=NS_strlen&vendor=MozillaOrg&product=ThunderbirdTrunk&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
is a list of the 114 Talkback incidents related to this bug on Thunderbird Trunk.
These all relate to stack signature NS_strlen and include all of Julien Moorrees's and Michael Mak's incidents.

Removing the reference to Thunderbird Trunk expands the list to 339 crashes and shows that similar events are occurring on Firefox Trunk on both Windows and Linux Intel.

Mine all relate to
 NS_strtok c8f58f87
Creating a similar URL for NS_strtok
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=NS_strtok&vendor=MozillaOrg&product=ThunderbirdTrunk&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
produces a list of only my incidents, though, if one removes the reference to Thunderbird Trunk, 3 more incidents are added, all relating to Firefox Trunk.

So it looks as though my incidents might be different to everyone else's except for (probably) one other person using Firefox Trunk!

Comment 22

[Peter Reynolds]

Julien

Regarding turning off the spellchecker I turned it off in Tools Options in a working edition of Thunderbird Trunk (20070325) before installing a newer problematic one (20070330) but it still crashed as soon as I hit reply.  Talkback ID TB30838823E

Comment 23

[Peter Reynolds]

An NS_strlen bug has been started for Minefield, bug number 337672

Comment 24

[Peter Reynolds]

oops, make that 376025 - sorry!

Comment 25

[Peter Reynolds]

my sincere apologies - I don't know how to edit those last two comments out - what I should have typed was:

An NS_strlen bug has been started for Minefield, bug 376205

Comment 26

[Peter Reynolds]

Over at bug 376205 Arie Paap wrote:
"Right, I think I've found the cause of the crash. (Thanks to polidobj.) For a short while in July 2006 nightly builds shipped myspell.dll (At least the 2006071004 build did). When I put this dll in the components directory of a current trunk build I reproduce this crash. Doesn't happen with 2007032604. Presumably from bug 376082 comment 15 and 16 this started between 0327 and 0328. A regression window could still be interesting to determine which changed caused this, but nightly builds don't ship with myspell.dll.

I think this bug is invalid.

Last Question: those who experience this crash - where is the myspell.dll directory located (Program dir or Profile dir); what is the modified date on the file; and do you know where it came from?"

And I replied: 

Arie - You're a genius.  I removed myspell.dll and the myspell folder from the Program components directory and I no longer have a crash.  

myspell.dll was dated 13/7/06 and the myspell directory 14/7/06, while the dictionary files in the myspell directory (en-GB.aff and en-GB.dic came from December 2002).

Comment 27

[Julien Moorrees]

Well if this DLL should be removed, maybe the auto-upgrade features should remove it then. I have used the auto-upgrade feature all the time, and the application didn't crash until last week. 

In my case the myspell.dll is located in
\Mozilla\thunderbird-win32\components\
Which is from 13-1-2006 but I have to tell that the thunderbird version I use is now version 3 alpha 1 (20060714) because I need my mail client to reply, and was only planning to upgrade when the nightly build works again ;). Maybe the other guys/girls could take a look?

Comment 28

[Fredrik Almgren]

My myspell.dll is dated 2006-07-31 and the folder it is located in is C:\Program Files\Mozilla Thunderbird\components which also has a subfolder called myspell that contains dictionary files.

If I just remove the myspell.dll I get an error message saying "An error occurred
while creating a message compose window. Please try again." Going into Tools-Options and selecting "Composition" does not crash Thunderbird when the 
dll is removed.

Comment 29

[Henrik Skupin [:whimboo][⌚️UTC+2]]

This crash should also be fixed by the patch on bug 376205.

> If I just remove the myspell.dll I get an error message saying "An error
> occurred
> while creating a message compose window. Please try again." Going into
> Tools-Options and selecting "Composition" does not crash Thunderbird when the 
> dll is removed.

I think this should be bug 366255. 

Comment 30

[Joe Sabash [:JoeS1]]

The crash is probably related to
https://bugzilla.mozilla.org/show_bug.cgi?id=336737#c8
My question is, these nightly testers have had myspell.dll (wrongly) installed for some time (at least 6 months) So what caused it to just show up now.

Comment 31

[Michael Mak]

Is there any way to compose a new message without crashing it?

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070406 Thunderbird/3.0a1 ID:2007040604 [cairo]

Also should the status change to 'Confirmed' and maybe raise the severity to 'Blocker'? If Thunberbird can't compose any new message, it is pretty much useless.

Comment 32

[Michael Mak]

I updated my system to Vista today with a clean install. After installing Thunderbird with the latest nightly trunk (0410), I can compose messages without any problem. I copied my old profile to the new one.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9a4pre) Gecko/20070410 Thunderbird/3.0a1 ID:2007041003 [cairo]

Would this have something to do with the previous installers?

Comment 33

[Julien Moorrees]

Why is this bug still unconfirmed? It is still present in the latest build:
version 3.0a1 (20070415)

Comment 34

[timeless]

bugs are confirmed when we verify that they're approximately the only live report of a problem, and that the problem is a real bug in cvs code. in this case, we think this is not actually a bug in code, so much as a bug in installation procedure. until we determine what's actually buggy, the bug isn't really confirmed. if the bug is caused by users doing something wrong, it isn't a bug and should not be confirmed. and that's about where we are.

Comment 35

[Peter Reynolds]

My impression was that it was caused, not by users doing something wrong, but by something supplied with an earlier version of Thunderbird (from July 2006) not being compatible with the current installations.  Since I have already removed these files (myspell), I don't know whether current installations of Thunderbird fix the problem.  I still have the files somewhere else.  Would it help if I put them back where they were before and then reinstalled a recent version of Thunderbird?  Should the latest versions of Thunderbird automatically delete the Myspell files?  I gathered that was the intention of what Simon 'sipaq' Paquet   did over at bug 376205 on 5 April: 

"Created an attachment (id=260757) [details]
Patch v1

Patch for both Firefox and Thunderbird on trunk."

I see from 
http://talkback-public.mozilla.org/reports/thunderbird/
that there were still 17 instances of Talkback crashes from ns_strlen last Friday (13 April).  And, for instance, Talkback ID TB31165094 shows that the person was "just trying to write an email" using ThunderbirdTrunk Build ID 2007041303.

Comment 36

[Michael Mak]

I cannot open a compose message window in the 0416 nightly trunk build.
When I tried to open a message window (whether it be reply, forward or compose a new message), a error window popped up saying 'an error occurred while creating a message compose window. Please try again.'

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9a4pre) Gecko/20070416 Thunderbird/3.0a1 ID:2007041603 [cairo]

Comment 37

[Julien Moorrees]

OMG this has actually gotten worse. As a Test I removed myspel.dll from the components folder. Then I started to write a message. At that time a messagebox appears telling me: "'an error occurred while
creating a message compose window. Please try again.'". So to make a sure test, I removed al the files and downloaded a fresh new nightly build:
version 3.0a1 (20070416), installed it as a fresh copy and fired it up again.

As if you might expect, this messagebox did appear again and is is no longer possible to compose any message. I liked the time when I got a trackback ID, since that seems to alert some people over here. Maybe I should put back myspell.dll ;).

Comment 38

[Peter Reynolds]

Hmm... strange as I have been using the latest trunks with no problems since removing myspell, but then again my bug was in NS_strtok (unlike most who had a bug in NS_strlen).

Comment 39

[Adam Guthrie]

Simon's patch was checked in on 2007-04-15 09:15, which means this bug would not be fixed in builds before the 2007-04-16 nightly builds.

From what I've read, it sounds like the crash is indeed fixed in builds with Simon's patch in it, but you guys are still seeing problems related to message composition. This bug is for the crash, not for the other issues. Please file bugs on the other issue and if you can confirm that the patch in bug 376205 caused them, add it as a blocker.

I'm resolving this as FIXED, since the originally reported crash appears to be fixed.

Comment 40

[Adam Guthrie]

For what it's worth, it looks like bug 377662 has been filed on the issue you guys were seeing above.