Thunderbird crashes when pasting an image into the message body [@ memcpy - nsCSubstring::Assign]

RESOLVED WORKSFORME

Status

()

--
critical
RESOLVED WORKSFORME
9 years ago
7 years ago

People

(Reporter: dickm71, Unassigned)

Tracking

({crash})

1.9.2 Branch
x86
Windows XP
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [gs][tbird crash], crash signature, URL)

Attachments

(4 attachments)

(Reporter)

Description

9 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 (.NET CLR 3.5.30729)
Build Identifier: 2.0.0.23 (20090812)

Thunderbird crashes when pasting an a clipboard image (from Snagit) into the message body.  Some copied Snagit images paste ok.  I'm suspecting a corrupt or maybe too large an image from Snagit, but am informing Mozilla because I don't think ANY paste ought to cause a crash (i.e. make it more bullet proof).

Reproducible: Sometimes

Steps to Reproduce:
1. Copied large Snagit image onto clipboard
2. Select body of email message
3. Paste
Actual Results:  
Thunderbird crashed.  Microsoft Visual Studio debugger handled the exception.  It said: "Unhandled exception at 0x77c471d7 in thunderbird.exe: 0xC0000005: Access violation reading location 0x04bbfffc.
(Reporter)

Comment 1

9 years ago
Created attachment 414276 [details]
Visual Studio debug info

The attached screenshot is of an earlier, but similar, Thunderbird crash than the one I reported.
It happeans also in safe-mode? see http://kb.mozillazine.org/Safe_mode
Severity: normal → critical
Keywords: crash

Comment 3

9 years ago
For an image pasted from Snagit which didn't cause a crash, can you double- click on that image in the composition window and report its "Location" information into a comment here? Feel free to modify any components of the
path which you consider personal by writing "xxx" over it. This would help
to determine which mechanism Snagit uses to transfer the image data.
(Reporter)

Comment 4

9 years ago
Created attachment 414383 [details]
Bitmap of image which when pasted into TB crashes it.
(Reporter)

Comment 5

9 years ago
Created attachment 414384 [details]
png formated image that caused TB to crash when pasted (but was converted to bmp on the clipboard

The png version is format that I copied to the clipboard, but ClipMate stores it in bmp format, so I suspect that is the problem file and format.
(Reporter)

Updated

9 years ago
Attachment #414384 - Attachment description: png formated image that caused TB to crash when pasted → png formated image that caused TB to crash when pasted (but was converted to bmp on the clipboard

Comment 6

9 years ago
I've tried both of your images with 2.0.0.23 and 3.0rc1 on Windows XP without being able to crash the application, but then those are not directly going through Snagit onto the clipboard, thus I'm not entirely surprised.

Can you provide the information I've mentioned in comment #3 to see what's going on in the background?

1. Open a new message (in HTML composition mode to allow pasting);
2. copy an image using Snagit into the message body;
3. immediately after that, double-click on the image you've just pasted;
4. the Image Properties dialog shows up;
5. copy-paste the "Image Location" value into a comment here.

The requested value should be of the form "file://" or whatever else you see.

Comment 7

9 years ago
https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

change firefox to thunderbird
Keywords: stackwanted
(Reporter)

Comment 8

9 years ago
Created attachment 414765 [details]
How_to_get_a_stacktrace_with_WinDbg log file
(Reporter)

Comment 9

9 years ago
Re Comment 2: Crash occurs in Safe Mode also.
Re Comment 7: Went through the How_to_get_a_stacktrace_with_WinDbg process and attached log file. I'm not sure I did it correctly.  If not, guidance and/or corrections please and I'll run it again.

Comment 10

9 years ago
you did it right. someone will probably need to ask you further questions at some point.

0012e3f8 604a1076 msvcrt!memcpy+0x267
0012e428 604a1190 xpcom_core!nsCSubstring::Assign(char * data = 0x03cd13d0 "Version:0.9.StartHTML:86.EndHTML:99999999.StartFragment:00000184.EndFragment:00000294.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>.<BODY>.<!--StartFragment-->.<img border="0" src="file:///C:\DOCUME~2\ADMINI~1\LOCALS~1\Temp\SNAGHTMLbebcdb.PNG" width="527" height="763">.<!--EndFragment-->.</BODY>.</HTML>", unsigned int length = 0x5f5e0ff)


Offhand, the length value seems kinda suspicious.

0012e43c 604a123f xpcom_core!nsCSubstring::Assign(class nsCSubstring * str = 0x6046fda8)+0x71
0012e45c 6046fda8 xpcom_core!nsCSubstring::Assign(class nsACString_internal * readable = 0x0012e47c)+0x1e
0012e464 0051f275 xpcom_core!nsSupportsCStringImpl::SetData(class nsACString_internal * aData = 0x03cd1538)+0x10 
0012e48c 0051739d thunderbird!nsPrimitiveHelpers::CreatePrimitiveForData(char * aFlavor = 0x03cd1538 "???", void * aDataBuff = 0x03cd13d0, unsigned int aDataLen = 0x5f5e0ff, class nsISupports ** aPrimitive = 0x0012e4ec)+0xe2 [e:/builds/tinderbox/Tb-Mozilla1.8-Release/WINNT_5.0_Depend/mozilla/widget/src/xpwidgets/nsPrimitiveHelpers.cpp @ 92]

Since aDataLen is consistent here, I claim that's interesting/relevant.
Component: General → Widget: Win32
Product: Thunderbird → Core
QA Contact: general → win32
Summary: Thunderbird crashes when pasting an image into the message body → Thunderbird crashes when pasting an image into the message body [@ memcpy - nsCSubstring::Assign]
Version: unspecified → 1.8 Branch

Comment 11

9 years ago
(In reply to comment #10)
> src="file:///C:\DOCUME~2\ADMINI~1\LOCALS~1\Temp\SNAGHTMLbebcdb.PNG"
 
This also answers comment #6. Snagit doesn't seem to put the image data itself onto the clipboard but creates a PNG file in the user's TEMP folder, then passes HTML with a reference to that file over the clipboard.
(Reporter)

Comment 12

8 years ago
I am now using TB 3.0.5 and Thunderbird still crashes.  The status is UNCONFIRMED, but I think it IS confirmed.  Also keywords are 'crash' and 'stackwanted', but the stack was provided.  This is a plea to fix as I frequently want to paste a Snagit screen shot into TB.

Comment 13

8 years ago
(In reply to comment #0)
This only started happening to me after I upgraded to Window 7, TB 3.1.2, not sure which is at fault.  I still have the same version of SnagIt 9.0.0.  Luckily I can copy from the editor and then paste, this seems to work.
I am snagging and pasting exactly the same type and size of files I was before my computer upgrade last week!

Comment 14

8 years ago
This also happens with Linux running Slackware 13.x with Thunderbird 3.1.5 Appears to be related to the conversion from the source image format to the png format that thunderbird uses when pasting images. It is ok if you insert an image however.

It seems to have issues above an image size of around 1Mbit, although it is not consistent.

A workaround is to set thunderbirds default image type to jpg

In config editor set clipboard.paste_image_type to 0

Comment 15

8 years ago
john: w/o a stack trace there's no way to know if the crash you're seeing is this crash. please follow the instructions at:

https://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report
and file your own bug.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: stackwanted

Updated

8 years ago
Version: 1.8 Branch → 1.9.2 Branch
(Assignee)

Updated

7 years ago
Crash Signature: [@ memcpy - nsCSubstring::Assign]

Comment 16

7 years ago
dick, does this crash still happen for you?

Updated

7 years ago
Whiteboard: [gs] → [gs][tbird crash]

Comment 17

7 years ago
Are you using SnagIt to put it on the clip board and then pasting into Tbird?  I find I have to go to SnagIt editor and copy the image from THERE and then pate it, and all works fine.

Comment 18

7 years ago
(In reply to rsx11m from comment #11)
> (In reply to comment #10)
> > src="file:///C:\DOCUME~2\ADMINI~1\LOCALS~1\Temp\SNAGHTMLbebcdb.PNG"
>  
> This also answers comment #6. Snagit doesn't seem to put the image data
> itself onto the clipboard but creates a PNG file in the user's TEMP folder,
> then passes HTML with a reference to that file over the clipboard.

Assuming that's still reproducible, it may be good to have a look at that file immediately created by SnagIt and put into the user's Local\Temp file, then attach it here to see if it's broken or inconsistent in any way. The bitmap on the clipboard won't be used if an HTML part is present, thus Thunderbird will try to read and insert the content of that file instead.

Comment 19

7 years ago
Can someone reply to comment #18 after retesting with the current versions of both SnagIt and Thunderbird? Without a SnagIt-generated image triggering this issue it may not be possible to figure out what's happening (if it still applies).
(Reporter)

Comment 20

7 years ago
I am the original submitter of this bug.  The problem appears to be fixed using Snagit 10 and Thunderbird 10.0.2.

I pasted a large image 1280 x 900 x 32-bit into Thunderbird with no problems.
Thanks for re-testing it. I'll mark this as worksforme for now, but please re-open if anyone sees it again.
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.