492590 - Crash in nsMsgThreadedDBView::MoveThreadAt(unsigned int) when deleting email attachment (POP)

Status: RESOLVED FIXED

(SeaMonkey :: MailNews: Backend, defect)

Description

[Robert Roessler]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; rv:1.9.1b5pre) Gecko/20090512 SeaMonkey/2.0b1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; rv:1.9.1b5pre) Gecko/20090512 SeaMonkey/2.0b1pre

As of the 2009/5/10 SM 2 trunk build (2009/5/7 works), any attempt to delete either a single attachment or all attachments causes an instant crash in "nsMsgThreadedDBView::MoveThreadAt(unsigned int)" with EXCEPTION_ACCESS_VIOLATION @ 0x0.

This has been observed with both the Inbox and Sent folders.

Interestingly, this does not appear to lead to corruption of the MSF file - after the crash, the folder now contains TWO copies of the message: one with the attachment still in place, and one with the attachment properly removed.

Reproducible: Always

Steps to Reproduce:
1. Select a message with an attachment from a POP3 account.
2. (You can email yourself an attachment first if you need to.)
3. Request that the attachment be deleted from the context menu.
Actual Results:  
SM crashes immediately with a signature of "nsMsgThreadedDBView::MoveThreadAt(unsigned int)".

Expected Results:  
The attachment should be deleted.

So far, happens from [at least] May 10th onwards.

My box is running Vista SP1 x64.  I use the Mostly Crystal theme and the NoScript Addon... both of which can be disabled without changing the results.

Note that I am initially setting severity "Critical", since crashing seems to qualify.

Comment 1

[:deanis74]

Same as bug 492475?

Comment 2

[Robert Roessler]

Can't really tell, since that bug says absolutely nothing about how that crash happens, i.e, what Thunderbird was trying to do at the time... which is one reason why I didn't find it using a keyword string like "delete attachment".

I will comment that bug with a mention of this one...

Comment 3

[Mark Banner (:standard8)]

Looking at the rough details of what happened, timescales, and although I didn't crash, it does look like bug 492475 is probably the same as this one. Adding dependency, please re-test the day after that bug gets marked fixed.

Comment 4

[Robert Roessler]

The fix for bug 492475 does fix this crash - both single attachment delete and "Delete All" functionality is fully restored.