377125 - crash in PrepareAndDispatch when calling nsIMsgQuote::QuoteMessage from javascript

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[arno renevier]

In a thunderbird extension, I'm trying to quote a message whose uri I have.
I call:

var quoteStreamListener = {
      QueryInterface : function(iid)  {
         if (iid.equals(Components.interfaces.nsIStreamListener) ||
            iid.equals(Components.interfaces.nsIRequestObserver) ||
            iid.equals(Components.interfaces.nsISupports))
          return this;
        throw Components.results.NS_NOINTERFACE;
      },
       
     onStartRequest: function (aRequest, aContext){
         dump('onStartRequest from js\n');
         },
     onStopRequest: function (aRequest, aContext, aStatusCode) {
         dump('onStopRequest from js\n');
         },
    onDataAvailable: function( aRequest , aContext , aInputStream , aOffset , aCount ){
         dump('onDataAvailable from js\n');
        },
}


 var quote = Components.classes["@mozilla.org/messengercompose/quoting;1"].getService(Components.interfaces.nsIMsgQuote);
quote.QuoteMessage(aUri, false, quoteStreamListener, null, false);

I get the dump for startRequest, and then thunderbird crashes.

I get this with any message uri.
I get this if I set true to the second and/or fifth argument
I get this if I set any charset in the fourth argument

Here is the trace I get with a thunderbird 1.5 built from source.
0xb7e75742 in PrepareAndDispatch () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
(gdb) where
#0  0xb7e75742 in PrepareAndDispatch () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#1  0xb63d8ba2 in nsMsgQuoteListener::OnHeadersReady () from /home/arno/thunderbird/dist/bin/components/libmail.so
#2  0xb64ee695 in nsStreamConverter::OnStopRequest () from /home/arno/thunderbird/dist/bin/components/libmail.so
#3  0xb62ead60 in nsMsgProtocol::OnStopRequest () from /home/arno/thunderbird/dist/bin/components/libmail.so
#4  0xb637ccb5 in nsMailboxProtocol::OnStopRequest () from /home/arno/thunderbird/dist/bin/components/libmail.so
#5  0xb7177358 in nsInputStreamPump::OnStateStop () from /home/arno/thunderbird/dist/bin/components/libnecko.so
#6  0xb7177bdf in nsInputStreamPump::OnInputStreamReady () from /home/arno/thunderbird/dist/bin/components/libnecko.so
#7  0xb7e49c25 in nsInputStreamReadyEvent::EventHandler () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#8  0xb7e5cf57 in PL_HandleEvent () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#9  0xb7e5d237 in PL_ProcessPendingEvents () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#10 0xb7e5edfd in nsEventQueueImpl::ProcessPendingEvents () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#11 0xb67d4f45 in event_processor_callback () from /home/arno/thunderbird/dist/bin/components/libwidget_gtk2.so
#12 0xb7790c7f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0
#13 0xb7767731 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#14 0xb776a7a6 in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#15 0xb776ab67 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#16 0xb7bd5281 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#17 0xb67d5345 in nsAppShell::Run () from /home/arno/thunderbird/dist/bin/components/libwidget_gtk2.so
#18 0xb6797ad7 in nsAppStartup::Run () from /home/arno/thunderbird/dist/bin/components/libtoolkitcomps.so
#19 0x0804f651 in XRE_main ()
#20 0x0804ae23 in main ()

problem is still present with latest release candidate

I suspect problem nsMsgQuoteListener::OnHeadersReady


      if (NS_SUCCEEDED(aStreamListener->QueryInterface(NS_GET_IID(QuotingOutputStreamListener), (void**)&quoting)) &&
            quoting)
        {
        quoting->SetMimeHeaders(headers);
            NS_RELEASE(quoting);
        }

If I put printf, I see that aStreamListener (my javascript quoteStreamListener) can be queryinterfaced
but thunderbird crashes when trying to call SetMimeHeaders for that object

Comment 1

[timeless]

you shouldn't be able to QI to that, it's a concrete class.

ask neil about fixing this for branch...

Comment 2

[Boris Zbarsky [:bzbarsky]]

That wouldn't help, since the "fixed" code just static_casts to the concrete class... and this listener would NOT be of that class.  Mailnews should not allow setting this listener to random things, or it should not assume it's a particular class.

Comment 3

[timeless]

oops, i should have read more of the code :(

Comment 4

[[e-mail]]

Attachment: Branch patch

For the trunk I want to modify the nsIMsgQuote interface to return an nsIMsgQuotingOutputStreamListener directly.

Comment 5

[[e-mail]]

Attachment: Trunk patch

Comment 6

[[e-mail]]

Fix checked in.

Comment 7

[Samuel Sidler (old account; do not CC)]

arno, can you verify this is fixed in recent branch builds of Thunderbird?

Comment 8

[arno renevier]

Yes, it is fixed on latest branch build

Comment 9

[Samuel Sidler (old account; do not CC)]

Thanks arno!

Comment 10

[Wayne Mery (:wsmwk)]

This FIXED bug is flagged with in‑testsuite?   It would be great if assignee or someone else can clear the flag if a test is not appropriate.  And if appropriate, create a test and plus the flag to finish off the bug.