508754 - Thunderbird crashes on sending mails with attached images [@ nsListBoxBodyFrame::GetNextItemBox]

Status: RESOLVED WONTFIX

(Core :: XUL, defect)

Description

[Jörg Giencke]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1
Build Identifier: Version 2.0.0.22 (20090605)

Thunderbird crashes on sending mails with attached images of any kind or size *IF* those images were dragged and dropped. This does *NOT* happen, when images are attached using 'File > Open'.
Any other kind of attachment works fine.
One other effect that comes with it is that dropped images appear twice in the attachment box. This, again, does not happen when using 'File > Open'.

Reproducible: Always

Steps to Reproduce:
1. Drag and drop any kind or size of image file into Thunderbird
2. Image file appears twice in the attachment box
3. Click 'Send'

Actual Results:  
Thunderbird crashes

Comment 1

[Ludovic Hirlimann [:Usul]]

Hi Jörg, could you provide us with a crash ID as described at http://kb.mozillazine.org/Mozilla_Suite_:_FAQs_:_Talkback ?

Comment 2

[Jörg Giencke]

TB55954721G, TB55953752X

Comment 3

[timeless]

Incident ID: 55953752
Stack Signature	nsListBoxBodyFrame::GetNextItemBox 7f6e4a28
Product ID	Thunderbird2
Build ID	2009060502
Trigger Time	2009-08-05 23:25:02.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	thunderbird.exe + (002cb4f4)
URL visited	
User Comments	Sending an e-mail with a picture (gif/20kb) attached. This happens all the time when attaching pictures. Besides of that pictures show up twice in the attachment box after dropping them. As I said above this goes *only for pictures* - no matter what
Since Last Crash	432563 sec
Total Uptime	432563 sec
Trigger Reason	Access violation
Source File, Line No.	e:/builds/tinderbox/Tb-Mozilla1.8-Release/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp, line 1188
Stack Trace 	
nsListBoxBodyFrame::GetNextItemBox  [mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp, line 1188]
nsListBoxBodyFrame::CreateRows  [mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp, line 1053]
nsListBoxBodyFrame::ReflowFinished  [mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp, line 503]
PresShell::HandlePostedReflowCallbacks  [mozilla/layout/base/nsPresShell.cpp, line 5362]
PresShell::DidDoReflow  [mozilla/layout/base/nsPresShell.cpp, line 7011]
PresShell::FlushPendingNotifications  [mozilla/layout/base/nsPresShell.cpp, line 5486]
PresShell::EndReflowBatching  [mozilla/layout/base/nsPresShell.cpp, line 5524]
nsEditor::EndPlaceHolderTransaction  [mozilla/editor/libeditor/base/nsEditor.cpp, line 1021]
nsAutoPlaceHolderBatch::~nsAutoPlaceHolderBatch  [mozilla/editor/libeditor/base/nsEditorUtils.h, line 66]
nsTextControlFrame::SetValue  [mozilla/layout/forms/nsTextControlFrame.cpp, line 3180]
nsTextControlFrame::SetProperty  [mozilla/layout/forms/nsTextControlFrame.cpp, line 2348]
nsHTMLInputElement::SetValue  [mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 762]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_GetterSetter  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1479]

Comment 4

[Wayne Mery (:wsmwk)]

Jörg, joris, do you still see this crash?  If you do, then bug 432068 definitely didn't catch everything.

I'm not finding this crash on v3 crash-stats.

Comment 5

[Ludovic Hirlimann [:Usul]]

Thunderbird 2.0 is EOLed closing this bugs as they won't be fixed. keeping them open has no value.