52190 - Creating a message filter with non-ASCII filter name causes browser crash

Status: VERIFIED FIXED

(MailNews Core :: Internationalization, defect, P2)

Description

[ji]

******observed with win32 and linux 2000091108 build****

If you create a message filer with a non-ASCII filter name, the appliaction 
crashes.

Steps to reproduce:
1. Launch Mail,
2. Select Edit | Message Filters...
3. Click on New button. It doesn't make difference if you choose a IMAP account 
or POP account.
4. Enter some non-ASCII characters into Filter Name: field. And enter something 
into criteria field, select a folder from the folder drop-down menu and click 
on OK button.

The application will crash.

Below is the call stack:
Incident ID: 17242046
 Trigger Type:  Program Crash 

 Trigger Reason:  SIGSEGV: Segmentation Fault: (signal 11) 

 Call Stack:    (Signature = nsMsgFilterDelegateFactory::getFilterDelegate() 
4c5c0796) 
     nsMsgFilterDelegateFactory::getFilterDelegate() 
     nsMsgFilterDelegateFactory::CreateDelegate() 
     nsRDFResource::GetDelegate() 
     nsMsgFilterDataSource::GetTargets() 
     CompositeAssertionEnumeratorImpl::GetEnumerator() 
     CompositeEnumeratorImpl::HasMoreElements() 
     FilterInstantiations() 
     TestNode::Propogate() 
     TestNode::Propogate() 
     RootNode::Propogate() 
     nsXULTemplateBuilder::CreateContainerContents() 
     nsXULTemplateBuilder::CreateTemplateAndContainerContents() 
     nsXULTemplateBuilder::CreateContents() 
     nsXULDocument::CreateContents() 
     EnsureContentsGenerated() 
     ChildCount() 
     nsXULTreeOuterGroupFrame::ComputeTotalRowCount() 
     nsXULTreeOuterGroupFrame::ComputeTotalRowCount() 
     nsTreeLayout::GetPrefSize() 
     nsContainerBox::GetPrefSize() 
     nsBoxFrame::GetPrefSize() 
     nsXULTreeOuterGroupFrame::GetPrefSize() 
     nsScrollBoxFrame::GetPrefSize() 
     nsGfxScrollFrame::GetPrefSize() 
     nsSprocketLayout::PopulateBoxSizes() 
     nsSprocketLayout::Layout() 
     nsContainerBox::DoLayout() 
     nsBoxFrame::DoLayout() 
     nsBox::Layout() 
     nsStackLayout::Layout() 
     nsContainerBox::DoLayout() 
     nsBoxFrame::DoLayout() 
     nsXULTreeFrame::DoLayout() 
     nsBox::Layout() 
     nsSprocketLayout::Layout() 
     nsContainerBox::DoLayout() 
     nsBoxFrame::DoLayout() 
     nsBox::Layout() 
     nsSprocketLayout::Layout() 
     nsContainerBox::DoLayout() 
     nsBoxFrame::DoLayout() 
     nsBox::Layout() 
     nsSprocketLayout::Layout() 
     nsContainerBox::DoLayout() 
     nsBoxFrame::DoLayout() 
     nsBox::Layout() 
     nsStackLayout::Layout() 
     nsContainerBox::DoLayout() 
     nsBoxFrame::DoLayout() 
     nsBox::Layout() 
     nsSprocketLayout::Layout() 
     nsContainerBox::DoLayout() 
     nsBoxFrame::DoLayout() 
     nsBox::Layout() 
     nsStackLayout::Layout() 
     nsContainerBox::DoLayout() 
     nsBoxFrame::DoLayout() 
     nsBox::Layout() 
     nsBoxFrame::Reflow() 
     nsRootBoxFrame::Reflow() 
     nsContainerFrame::ReflowChild() 
     ViewportFrame::Reflow() 
     nsHTMLReflowCommand::Dispatch() 
     PresShell::ProcessReflowCommands() 
     PresShell::FlushPendingNotifications() 
     nsCSSFrameConstructor::ContentAppended() 
     StyleSetImpl::ContentAppended() 
     PresShell::ContentAppended() 
     nsXULDocument::ContentAppended() 
     nsXULTemplateBuilder::RebuildContainerInternal() 
     nsXULTemplateBuilder::RebuildContainer() 
     nsXULDocument::RebuildWidgetItem() 
     nsXULDocument::AttributeChanged() 
     nsXULElement::SetAttribute() 
     nsXULElement::SetAttribute() 
     nsXULTreeElement::SetAttribute() 
     ElementSetAttribute() 
     libmozjs.so + 0x2b239 (0x4011d239) 
     libmozjs.so + 0x31e92 (0x40123e92) 
     libmozjs.so + 0x2b281 (0x4011d281) 
     libmozjs.so + 0x2b470 (0x4011d470) 
     libmozjs.so + 0x11fef (0x40103fef) 
     nsJSContext::CallEventHandler() 
     nsJSEventListener::HandleEvent() 
     nsEventListenerManager::HandleEventSubType() 
     nsEventListenerManager::HandleEvent() 
     nsXULElement::HandleDOMEvent() 
     PresShell::HandleEventInternal() 
     PresShell::HandleEventWithTarget() 
     nsEventStateManager::CheckForAndDispatchClick() 
     nsEventStateManager::PostHandleEvent() 
     PresShell::HandleEventInternal() 
     PresShell::HandleEvent() 
     nsView::HandleEvent() 
     nsViewManager2::DispatchEvent() 
     HandleEvent() 
     nsWidget::DispatchEvent() 
     nsWidget::DispatchWindowEvent() 
     nsWidget::DispatchMouseEvent() 
     nsWidget::OnButtonReleaseSignal()

Comment 1

[ji]

Nominating for nsbeta3, It used to work on PR2.

Comment 2

[nhottanscp]

Reassign to alecf.
I used WinNT US, I created a filter name "santé" and got the same crash.

Comment 3

[msanz]

adding more keywords

Comment 4

[Katsuhiko Momoi]

QA contact to ji.

Comment 5

[scottputterman]

marking nsbeta3+ per mail triage.

Comment 6

[Phil Peterson]

PDT agrees P2

Comment 7

[Jean-Francois Ducarroz]

I'll take a look at it once filters are back running...

Comment 8

[Jean-Francois Ducarroz]

..accepting

Comment 9

[Alec Flett]

so it turns out this is really a XUL/template builder bug that was exposed by a
change to GetUnicodeResource(). See bug 52165 for details.

Comment 10

[Jean-Francois Ducarroz]

Event if it's really a XUL/template builder bug, I thing we should protect ourself agains failure in 
nsMsgFilterDeleteFactory::getFilterDelegate by testing the result before trying to addref it.

Should I mark this bug as a duplicate of 52165?

Comment 11

[Alec Flett]

yeah, ok...why don't you make it an NS_IF_ADDREF, r=alecf.. that way we've fixed 
the crash, like you say. Then we'll handle the broken i18n problem in the other 
bug.

Comment 12

[Jean-Francois Ducarroz]

sound the right thing to do. BTW, I'll put an NS_IF_ADDREF in the function getFIlterListDelegate as well, just in case 
where GetFilterList would return a null result for a misterious reason...

Comment 13

[Jean-Francois Ducarroz]

Fixed and checked in

Comment 14

[ji]

Verified with win32 2000092005 and linux 2000092008 build. It's fixed.

Comment 15

[ji]

*** Bug 53547 has been marked as a duplicate of this bug. ***