45362 - Mozilla crashes when reading news

Status: VERIFIED DUPLICATE of bug 45184

(SeaMonkey :: MailNews: Message Display, defect, P3)

Description

[Matthew Cline]

Mozilla build 20000712, Linux 2.2.14 i686, Redhat 6.1

With both the nightly build, and a debug build from the latest CVS tree,
Mozilla crashes when reading news.  After reading some 2 to 20 new
messages, Mozilla crashes (speficically, I was reading from the
Fresmeat news server).  The bottom part of the stack trace (from the
debug version) was:

#0  0x2ce59148 in nsGetterAddRefs<nsIRDFNode>::~nsGetterAddRefs (
    this=0x7fffcc04, __in_chrg=2) at ../../../dist/include/nsCOMPtr.h:903
#1  0x2cde6708 in nsMsgMessageDataSource::OnChangeStatusString (
    this=0x8ddae18, resource=0x8f01140, oldFlag=0, newFlag=1)
    at nsMsgMessageDataSource.cpp:992
#2  0x2cde6309 in nsMsgMessageDataSource::OnChangeStatus (this=0x8ddae18,
    resource=0x8f01140, oldFlag=0, newFlag=1) at nsMsgMessageDataSource.cpp:944
#3  0x2cde60cb in nsMsgMessageDataSource::OnItemPropertyFlagChanged (
    this=0x8ddae18, item=0x8f01140, property=0x822a6a8, oldFlag=0, newFlag=1)
    at nsMsgMessageDataSource.cpp:912
#4  0x2cdcd4a1 in nsMsgMailSession::OnItemPropertyFlagChanged (this=0x8dc7720,
    item=0x8f01140, property=0x822a6a8, oldValue=0, newValue=1)
    at nsMsgMailSession.cpp:193
#5  0x2c834be5 in nsMsgFolder::NotifyPropertyFlagChanged (this=0x8dea650,
    item=0x8f01140, property=0x822a6a8, oldValue=0, newValue=1)
    at nsMsgFolder.cpp:2244
#6  0x2c8372f6 in nsMsgDBFolder::SendFlagNotifications (this=0x8dea650,
    item=0x8f01140, oldFlags=0, newFlags=1) at nsMsgDBFolder.cpp:478
#7  0x2c8379d4 in nsMsgDBFolder::OnKeyChange (this=0x8dea650,
    aKeyChanged=1971, aOldFlags=0, aNewFlags=1, aInstigator=0x0)
    at nsMsgDBFolder.cpp:628
#8  0x2d035199 in nsMsgDatabase::NotifyKeyChangeAll (this=0x8dc2198,
    keyChanged=1971, oldFlags=0, newFlags=1, instigator=0x0)
    at nsMsgDatabase.cpp:279
#9  0x2d0385fd in nsMsgDatabase::MarkHdrReadInDB (this=0x8dc2198,
    msgHdr=0x8f00f68, bRead=1, instigator=0x0) at nsMsgDatabase.cpp:1376
#10 0x2d039338 in nsMsgDatabase::MarkHdrRead (this=0x8dc2198,
    msgHdr=0x8f00f68, bRead=1, instigator=0x0) at nsMsgDatabase.cpp:1647
#11 0x2d0386ec in nsMsgDatabase::MarkRead (this=0x8dc2198, key=1971, bRead=1,
    instigator=0x0) at nsMsgDatabase.cpp:1389
#12 0x2d04035d in nsMsgHdr::MarkRead (this=0x8f00f68, bRead=1)
    at nsMsgHdr.cpp:230
#13 0x2c7986c4 in nsNNTPProtocol::DisplayArticle (this=0x90de3d8,
    inputStream=0x90c3c44, length=167) at nsNNTPProtocol.cpp:2185
#14 0x2c798958 in nsNNTPProtocol::ReadArticle (this=0x90de3d8,
    inputStream=0x90c3c44, length=167) at nsNNTPProtocol.cpp:2223
#15 0x2c7a1a74 in nsNNTPProtocol::ProcessProtocolState (this=0x90de3d8,
    url=0x90ede5c, inputStream=0x90c3c44, sourceOffset=1582, length=167)
    at nsNNTPProtocol.cpp:4677
#16 0x2c84e2e8 in nsMsgProtocol::OnDataAvailable (this=0x90de3e0,
    ctxt=0x90ede58, inStr=0x90c3c44, sourceOffset=1582, count=167)
    at nsMsgProtocol.cpp:191
#17 0x2b8a6883 in nsOnDataAvailableEvent::HandleEvent (this=0x2cb018e0)
    at nsAsyncStreamListener.cpp:401
#18 0x2b8a5a38 in nsStreamListenerEvent::HandlePLEvent (aEvent=0x2cb02730)
    at nsAsyncStreamListener.cpp:97
#19 0x2abcda73 in PL_HandleEvent (self=0x2cb02730) at plevent.c:587
#20 0x2abcd900 in PL_ProcessPendingEvents (self=0x8067bd0) at plevent.c:528
#21 0x2abcf93d in nsEventQueueImpl::ProcessPendingEvents (this=0x8067ba8)
    at nsEventQueue.cpp:356
#22 0x2b529a22 in event_processor_callback (data=0x8067ba8, source=8,
    condition=GDK_INPUT_READ) at nsAppShell.cpp:158
#23 0x2b5295f8 in our_gdk_io_invoke (source=0x8225590, condition=G_IO_IN,
    data=0x835e5a8) at nsAppShell.cpp:58
#24 0x2b7088da in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0
#25 0x2b709f96 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0

Comment 1

[Matthew Cline]

Oops, that should have been "severity critical"; changing.

Comment 2

[Matthew Cline]

In the stack trace, some of the line numbers for the nsMsgMessage*
classes and the nsMsgFolder class are slightly off, because of
debugging statements I added.

Comment 3

[Matthew Dean]

Heh, atleast you got an error, when using my @home news server it just kinda sat
there, and I finally closed the window and mozilla just sat there and spun the
harddrive for 10 minutes before mozilla finally closed ( I closed both windows
). 
Here's some debug info tho about the URI:

We are looking for Sent
special folder name = none
news://Crimson2@news
In ChangeFolderByURI
preselectedURI = news://Crimson2@news
we don't handle eBorderStyle_close yet... please fix me

the way @home is set up is I put the news server as "NEWS" since it's a name
that resolves to an ip on the @home's nameserver... tho no newsgroups ever came
up..

Running Linux 2.2.16, Slackware 7.1, Build 2000071221

Comment 4

[lchiang]

cc: mscott and alecf since this is Linux and news.  Putterman is on vacation.

Karen - can you read news in today's commercial Linux build?

Comment 5

[Scott MacGregor]

this is a dup of the RDF literal crash that was fixed yesterday. Alec, can you
dup it? I don't have the bug # handy.

Comment 6

[Alec Flett]

*** This bug has been marked as a duplicate of 45184 ***

Comment 7

[Karen Huang]

I didn't get the crash when reading the news message.
Anyway, Verified as duplicate since there is random crash which report on bug 
45184. Thanks Scott & Alec for finding this bug.