497894 - SeaMonkey crashes after deleting parts of the mail address in the To: field after autocomplete [@ nsAbQueryStringToExpression::ParseCondition][@ nsCharsetAlias2::GetPreferred(nsACString_internal const&, nsACString_internal&)]

Status: RESOLVED DUPLICATE of bug 280232

(MailNews Core :: Address Book, defect)

Description

[Frank Wein [:mcsmurf]]

To reproduce:
1. Create a new contact in the address book, the display name needs to be something like "Test 'test' test", the mail address does not seem to matter. The important part seem to be the '...' inside the display name.
2. Compose a new mail
3. Type "Test" in the To: field and watch it autocompleting
4. Press the right cursor key once to get to the end of the text field and now press the backspace key a few times to delete the last few letters in the text field

Results:
It crashes.

Reproduced this with a SeaMonkey 1.9.1/comm-central build, the crasher has also been reproduced with a Thunderbird 3.0b3pre build, see http://crash-stats.mozilla.com/report/index/f8e7fe12-60d2-4e2c-a891-0fcf72090408 for a stack trace. The crash itself is a stack overflow, so that stack is wrong in Frame 0,1,2,3 as far as I can tell.

Comment 1

[Frank Wein [:mcsmurf]]

Attachment: Stack trace

This is a stack trace I got with my SeaMonkey debug build, cut off of course.

Comment 2

[Wayne Mery (:wsmwk)]

And this goes back into Thunderbird1 TB55059412 and TB2 TB54988990.

Crash rate is low, about 50 thunderbird crashes per month
 http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsCharsetAlias2%3A%3AGetPreferred&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid&rlimit=100

Comment 3

[Wayne Mery (:wsmwk)]

#6 topcrash for 3.0b3

"When I use backspace to delete a mail address in address field in a write new message window, Thunderbird crashes."

Comment 4

[Mark Banner (:standard8)]

Not blocking on this because it is actually a duplicate of bug 280232.

Frank, seeing as you think you have STR, could you try this again on the latest builds and see if you hit the NS_ERROR line in nsAbMDBDirectory that says:

"Attempting to search a directory within a search"

?

I couldn't reproduce this with a quick test on my debug build - but although we worked around it in bug 280232 I'd still be interested in STR for how it actually gets into the loop state.

Leaving open until Frank confirms if he can reproduce or not (if not please close as dupe of bug 280232).

Comment 5

[Frank Wein [:mcsmurf]]

Crash seems to be gone.