Closed Bug 530789 Opened 15 years ago Closed 12 years ago

Thunderbird crashes when pasting an image into the message body [@ memcpy - nsCSubstring::Assign]

Categories

(Core :: Widget: Win32, defect)

Product:
Core
Component:
Widget: Win32
Version:
1.9.2 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: dickm71, Unassigned)

References

(
URL
)

Details

(Keywords: crash, Whiteboard: [gs][tbird crash])

Crash Data

Attachments

(4 files)

Visual Studio debug info
31.18 KB, image/png
Details
Bitmap of image which when pasted into TB crashes it.
72.67 KB, image/png
Details
png formated image that caused TB to crash when pasted (but was converted to bmp on the clipboard
81.80 KB, image/png
Details
How_to_get_a_stacktrace_with_WinDbg log file
16.17 KB, text/plain
Details 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 (.NET CLR 3.5.30729)
Build Identifier: 2.0.0.23 (20090812)

Thunderbird crashes when pasting an a clipboard image (from Snagit) into the message body.  Some copied Snagit images paste ok.  I'm suspecting a corrupt or maybe too large an image from Snagit, but am informing Mozilla because I don't think ANY paste ought to cause a crash (i.e. make it more bullet proof).

Reproducible: Sometimes

Steps to Reproduce:
1. Copied large Snagit image onto clipboard
2. Select body of email message
3. Paste
Actual Results:  
Thunderbird crashed.  Microsoft Visual Studio debugger handled the exception.  It said: "Unhandled exception at 0x77c471d7 in thunderbird.exe: 0xC0000005: Access violation reading location 0x04bbfffc.
The attached screenshot is of an earlier, but similar, Thunderbird crash than the one I reported.
It happeans also in safe-mode? see http://kb.mozillazine.org/Safe_mode
Severity: normal → critical
Keywords: crash
For an image pasted from Snagit which didn't cause a crash, can you double- click on that image in the composition window and report its "Location" information into a comment here? Feel free to modify any components of the
path which you consider personal by writing "xxx" over it. This would help
to determine which mechanism Snagit uses to transfer the image data.
The png version is format that I copied to the clipboard, but ClipMate stores it in bmp format, so I suspect that is the problem file and format.
Attachment #414384 - Attachment description: png formated image that caused TB to crash when pasted → png formated image that caused TB to crash when pasted (but was converted to bmp on the clipboard
I've tried both of your images with 2.0.0.23 and 3.0rc1 on Windows XP without being able to crash the application, but then those are not directly going through Snagit onto the clipboard, thus I'm not entirely surprised.

Can you provide the information I've mentioned in comment #3 to see what's going on in the background?

1. Open a new message (in HTML composition mode to allow pasting);
2. copy an image using Snagit into the message body;
3. immediately after that, double-click on the image you've just pasted;
4. the Image Properties dialog shows up;
5. copy-paste the "Image Location" value into a comment here.

The requested value should be of the form "file://" or whatever else you see.

    
    

    
  
Re Comment 2: Crash occurs in Safe Mode also.
Re Comment 7: Went through the How_to_get_a_stacktrace_with_WinDbg process and attached log file. I'm not sure I did it correctly.  If not, guidance and/or corrections please and I'll run it again.

    
    

    
  
you did it right. someone will probably need to ask you further questions at some point.

0012e3f8 604a1076 msvcrt!memcpy+0x267
0012e428 604a1190 xpcom_core!nsCSubstring::Assign(char * data = 0x03cd13d0 "Version:0.9.StartHTML:86.EndHTML:99999999.StartFragment:00000184.EndFragment:00000294.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">.<HTML>.<BODY>.<!--StartFragment-->.<img border="0" src="file:///C:\DOCUME~2\ADMINI~1\LOCALS~1\Temp\SNAGHTMLbebcdb.PNG" width="527" height="763">.<!--EndFragment-->.</BODY>.</HTML>", unsigned int length = 0x5f5e0ff)


Offhand, the length value seems kinda suspicious.

0012e43c 604a123f xpcom_core!nsCSubstring::Assign(class nsCSubstring * str = 0x6046fda8)+0x71
0012e45c 6046fda8 xpcom_core!nsCSubstring::Assign(class nsACString_internal * readable = 0x0012e47c)+0x1e
0012e464 0051f275 xpcom_core!nsSupportsCStringImpl::SetData(class nsACString_internal * aData = 0x03cd1538)+0x10 
0012e48c 0051739d thunderbird!nsPrimitiveHelpers::CreatePrimitiveForData(char * aFlavor = 0x03cd1538 "???", void * aDataBuff = 0x03cd13d0, unsigned int aDataLen = 0x5f5e0ff, class nsISupports ** aPrimitive = 0x0012e4ec)+0xe2 [e:/builds/tinderbox/Tb-Mozilla1.8-Release/WINNT_5.0_Depend/mozilla/widget/src/xpwidgets/nsPrimitiveHelpers.cpp @ 92]

Since aDataLen is consistent here, I claim that's interesting/relevant.
Component: General → Widget: Win32
Product: Thunderbird → Core
QA Contact: general → win32
Summary: Thunderbird crashes when pasting an image into the message body → Thunderbird crashes when pasting an image into the message body [@ memcpy - nsCSubstring::Assign]
Version: unspecified → 1.8 Branch

    
    

    
  
(In reply to comment #10)
> src="file:///C:\DOCUME~2\ADMINI~1\LOCALS~1\Temp\SNAGHTMLbebcdb.PNG"
 
This also answers comment #6. Snagit doesn't seem to put the image data itself onto the clipboard but creates a PNG file in the user's TEMP folder, then passes HTML with a reference to that file over the clipboard.

    
    

    
  
I am now using TB 3.0.5 and Thunderbird still crashes.  The status is UNCONFIRMED, but I think it IS confirmed.  Also keywords are 'crash' and 'stackwanted', but the stack was provided.  This is a plea to fix as I frequently want to paste a Snagit screen shot into TB.

    
    

    
  
(In reply to comment #0)
This only started happening to me after I upgraded to Window 7, TB 3.1.2, not sure which is at fault.  I still have the same version of SnagIt 9.0.0.  Luckily I can copy from the editor and then paste, this seems to work.
I am snagging and pasting exactly the same type and size of files I was before my computer upgrade last week!

    
    

    
  
This also happens with Linux running Slackware 13.x with Thunderbird 3.1.5 Appears to be related to the conversion from the source image format to the png format that thunderbird uses when pasting images. It is ok if you insert an image however.

It seems to have issues above an image size of around 1Mbit, although it is not consistent.

A workaround is to set thunderbirds default image type to jpg

In config editor set clipboard.paste_image_type to 0

    
    

    
  
john: w/o a stack trace there's no way to know if the crash you're seeing is this crash. please follow the instructions at:

https://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report
and file your own bug.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: stackwanted

    
  
Version: 1.8 Branch → 1.9.2 Branch
Crash Signature: [@ memcpy - nsCSubstring::Assign]

    
    

    
  
dick, does this crash still happen for you?

    
  
Whiteboard: [gs] → [gs][tbird crash]

    
    

    
  
Are you using SnagIt to put it on the clip board and then pasting into Tbird?  I find I have to go to SnagIt editor and copy the image from THERE and then pate it, and all works fine.

    
    

    
  
(In reply to rsx11m from comment #11)
> (In reply to comment #10)
> > src="file:///C:\DOCUME~2\ADMINI~1\LOCALS~1\Temp\SNAGHTMLbebcdb.PNG"
>  
> This also answers comment #6. Snagit doesn't seem to put the image data
> itself onto the clipboard but creates a PNG file in the user's TEMP folder,
> then passes HTML with a reference to that file over the clipboard.

Assuming that's still reproducible, it may be good to have a look at that file immediately created by SnagIt and put into the user's Local\Temp file, then attach it here to see if it's broken or inconsistent in any way. The bitmap on the clipboard won't be used if an HTML part is present, thus Thunderbird will try to read and insert the content of that file instead.

    
    

    
  
Can someone reply to comment #18 after retesting with the current versions of both SnagIt and Thunderbird? Without a SnagIt-generated image triggering this issue it may not be possible to figure out what's happening (if it still applies).

    
    

    
  
I am the original submitter of this bug.  The problem appears to be fixed using Snagit 10 and Thunderbird 10.0.2.

I pasted a large image 1280 x 900 x 32-bit into Thunderbird with no problems.

    
    

    
  
Thanks for re-testing it. I'll mark this as worksforme for now, but please re-open if anyone sees it again.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: