38803 - Send crash

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect, P3)

Description

[fenella]

Win32 (2000-05-10-09 M16)
1. Launch Messenger using Task|Messenger
2. Click New Msg to open Compose window
3. Compose a message and click Send

Actual result: Application crashes.
However, message was sent.

Expected result: Should not crash

This happens in POP and IMAP. ( used both HTML and Plain editor

Have not tested Linux and Mac yet.

Comment 1

[Suresh]

adding seth, putterman to the cc list

Comment 2

[(not reading, please use [e-mail] instead)]

let me get a stack trace for this, could be the same as 38795

Comment 3

[scottputterman]

nsMsgComposeAndSend::DeleteListeners(nsMsgComposeAndSend * const 0x05cb64d0) 
line 3153 + 24 bytes
nsMsgComposeAndSend::Clear() line 357
nsMsgComposeAndSend::~nsMsgComposeAndSend() line 216
nsMsgComposeAndSend::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsMsgComposeAndSend::Release(nsMsgComposeAndSend * const 0x05cb64d0) line 157 + 
154 bytes
MailDeliveryCallback(nsIURI * 0x05cc2eb4, unsigned int 0, void * 0x05cb64d0) 
line 2594 + 12 bytes
nsMsgDeliveryListener::OnStopRunningUrl(nsMsgDeliveryListener * const 
0x05cc1c70, nsIURI * 0x05cc2eb4, unsigned int 0) line 82 + 21 bytes
nsUrlListenerManager::BroadcastChange(nsIURI * 0x05cc2eb4, nsUrlNotifyType 
nsUrlNotifyStopRunning, unsigned int 0) line 97
nsUrlListenerManager::OnStopRunningUrl(nsUrlListenerManager * const 0x05cc2e70, 
nsIMsgMailNewsUrl * 0x05cc2eb4, unsigned int 0) line 110 + 18 bytes
nsMsgMailNewsUrl::SetUrlState(nsMsgMailNewsUrl * const 0x05cc2eb4, int 0, 
unsigned int 0) line 94
nsSmtpProtocol::ProcessProtocolState(nsIURI * 0x05cc2eb4, nsIInputStream * 
0x05cc228c, unsigned int 317, unsigned int 36) line 1432
nsMsgProtocol::OnDataAvailable(nsMsgProtocol * const 0x05cc29d0, nsIChannel * 
0x05cc2714, nsISupports * 0x05cc2eb4, nsIInputStream * 0x05cc228c, unsigned int 
317, unsigned int 36) line 190 + 32 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x05cc50e0) 
line 406 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x05cc5090) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x05cc5090) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x01213f10) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00010ccc, unsigned int 49419, unsigned int 0, 
long 18956048) line 1030 + 9 bytes
USER32! 77e71820()

Comment 4

[scottputterman]

It's because it's trying to release a null ptr.  NS_IF_RELEASE would stop the 
crash.  Reassigning to ducarroz who maybe knows why the listener would be null.

Comment 5

[(not reading, please use [e-mail] instead)]

not a dup of that other bug, but I think I have the fix.

here's the stack:

nsMsgComposeAndSend::DeleteListeners(nsMsgComposeAndSend * const 0x058fa190) 
line 3153 + 24 bytes
nsMsgComposeAndSend::Clear() line 357
nsMsgComposeAndSend::~nsMsgComposeAndSend() line 216
nsMsgComposeAndSend::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsMsgComposeAndSend::Release(nsMsgComposeAndSend * const 0x058fa190) line 157 + 
154 bytes
MailDeliveryCallback(nsIURI * 0x05906954, unsigned int 0, void * 0x058fa190) 
line 2594 + 12 bytes
nsMsgDeliveryListener::OnStopRunningUrl(nsMsgDeliveryListener * const 
0x05902fd0, nsIURI * 0x05906954, unsigned int 0) line 82 + 21 bytes
nsUrlListenerManager::BroadcastChange(nsIURI * 0x05906954, nsUrlNotifyType 
nsUrlNotifyStopRunning, unsigned int 0) line 97
nsUrlListenerManager::OnStopRunningUrl(nsUrlListenerManager * const 0x05906910, 
nsIMsgMailNewsUrl * 0x05906954, unsigned int 0) line 110 + 18 bytes
nsMsgMailNewsUrl::SetUrlState(nsMsgMailNewsUrl * const 0x05906954, int 0, 
unsigned int 0) line 94
nsSmtpProtocol::ProcessProtocolState(nsIURI * 0x05906954, nsIInputStream * 
0x05905a3c, unsigned int 345, unsigned int 36) line 1432
nsMsgProtocol::OnDataAvailable(nsMsgProtocol * const 0x059063f0, nsIChannel * 
0x059060f4, nsISupports * 0x05906954, nsIInputStream * 0x05905a3c, unsigned int 
345, unsigned int 36) line 190 + 32 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x04e49150) 
line 406 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x04e492b0) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x04e492b0) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x011747f0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00bc020a, unsigned int 49435, unsigned int 0, 
long 18302960) line 1030 + 9 bytes
USER32! 77e71820()
011747f0()

Comment 6

[(not reading, please use [e-mail] instead)]

yeah, my fix is the same as puttermans.

adding alecf to the cc list.

Comment 7

[Jean-Francois Ducarroz]

strange, I haven't touch the send process for a while! Rich any idea?

Comment 8

[Alec Flett]

oh crap, this is my fault. I forgot to check in a file last night (I found the
crasher after I checked in)
attaching the patch and asking granrose for permission on IRC now.

Comment 9

[Alec Flett]

Attachment: fix for crash

Comment 10

[Alec Flett]

I had changed the way that listener arrays were passed around to be more XPCOM
compliant (so that par could do more whitebox testing) but I had forgotten that
the last element of every listener array was now null.

Comment 11

[(not reading, please use [e-mail] instead)]

the NS_IF_RELEASE() fix prevents the crash.  checking it in.

(maybe caused by alecf's recent changes?)

Comment 12

[Alec Flett]

oh, heh, seth had the exact same patch (byte for byte)
thanks, this is the proper thing to do.

Comment 13

[fenella]

Mac (2000-05-10-09 M16) does not have the problem.

Comment 14

[Jonas Nagel]

*** Bug 38824 has been marked as a duplicate of this bug. ***

Comment 15

[fenella]

Win32 (2000-05-10-12 M16) re-spin
Linux (2000-05-10-12 M16) re-spin
This problem has been fixed.