53258 - frequently fail to load messages with inline image

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect, P2)

Description

[(not reading, please use [e-mail] instead)]

I get a bunch of these assertions when trying to reproduce bug #49115

harish, do you see this?

NTDLL! 77f7629c()
nsDebug::Assertion(const char * 0x100cdc5c, const char * 0x100cdc4c, const char 
* 0x100cdc1c, int 302) line 256 + 13 bytes
CopyChars2To1(char * 0x0513d310, int 0, const char * 0x0513f8c0, unsigned int 0, 
unsigned int 27) line 302 + 41 bytes
nsStr::StrAppend(nsStr & {...}, const nsStr & {...}, unsigned int 0, int 27) 
line 175 + 50 bytes
nsCString::AssignWithConversion(const unsigned short * 0x0513f8c0, int 27) line 
796 + 43 bytes
nsCString::AssignWithConversion(const nsString & 
{"????????0?part=1.2&hackID=5"}) line 802
nsString::ToNewCString() line 615
nsFrameImageLoader::Init(nsFrameImageLoader * const 0x0513d4b0, nsIPresContext * 
0x0509f9f0, nsIImageGroup * 0x0513d600, const nsString & 
{"????????0?part=1.2&hackID=5"}, const unsigned int * 0x00000000, const nsSize * 
0x00000000 {width=??? height=???}, nsIFrame * 0x00f78048, nsImageAnimation 
eImageAnimation_Normal, ...) line 181 + 9 bytes
nsPresContext::StartLoadImage(nsPresContext * const 0x0509f9f0, const nsString & 
{"????????0?part=1.2&hackID=5"}, const unsigned int * 0x00000000, const nsSize * 
0x00000000 {width=??? height=???}, nsIFrame * 0x00f78048, unsigned int 
(nsIPresContext *, nsIFrameImageLoader *, nsIFrame *, void *, unsigned int)* 
...) line 968 + 66 bytes
nsHTMLImageLoader::StartLoadImage(nsIPresContext * 0x0509f9f0) line 217 + 73 
bytes
nsHTMLImageLoader::GetDesiredSize(nsIPresContext * 0x0509f9f0, const 
nsHTMLReflowState * 0x0012c7f0, nsHTMLReflowMetrics & {...}) line 479
nsImageFrame::GetDesiredSize(nsIPresContext * 0x0509f9f0, const 
nsHTMLReflowState & {...}, nsHTMLReflowMetrics & {...}) line 322 + 23 bytes
nsImageFrame::Reflow(nsImageFrame * const 0x00f78048, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 1231204) line 362
nsLineLayout::ReflowFrame(nsIFrame * 0x00f78048, nsIFrame * * 0x0012d39c, 
unsigned int & 1231204, nsHTMLReflowMetrics * 0x00000000, int & 0) line 921
nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineLayout & 
{...}, nsLineBox * 0x00f780f0, nsIFrame * 0x00f78048, unsigned char * 
0x0012c914) line 4357 + 29 bytes
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & {...}, nsLineLayout & 
{...}, nsLineBox * 0x00f780f0, int * 0x0012cf90, unsigned char * 0x0012cdd8, int 
0, int 0) line 4241 + 28 bytes
nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState & {...}, nsLineBox * 
0x00f780f0, int * 0x0012cf90, unsigned char * 0x0012cdd8, int 0, int 0) line 
4175 + 42 bytes
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & {...}, nsLineBox * 
0x00f780f0, int * 0x0012cf90, int 0, int 0) line 4120 + 32 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x00f780f0, int 
* 0x0012cf90, int 0) line 3256 + 29 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2945 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x00f77ffc, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 1746 + 15 bytes
nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason 
eReflowReason_Initial, nsIFrame * 0x00f77ffc, const nsRect & {x=0 y=1125 
width=12390 height=1073741824}, int 1, int 240, int 0, nsMargin & {top=0 right=0 
bottom=0 left=0}, unsigned int & 0) line 561 + 36 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x00f77ffc, const nsRect & {x=0 
y=1125 width=12390 height=1073741824}, int 1, int 240, int 0, nsMargin & {top=0 
right=0 bottom=0 left=0}, unsigned int & 0) line 331 + 50 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 
0x00f78204, int * 0x0012dac8) line 3873 + 56 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x00f78204, int 
* 0x0012dac8, int 1) line 3138 + 23 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2945 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x03c10dc4, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 1746 + 15 bytes
nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason 
eReflowReason_Incremental, nsIFrame * 0x03c10dc4, const nsRect & {x=0 y=0 
width=12630 height=1073741824}, int 1, int 0, int 1, nsMargin & {top=0 right=0 
bottom=0 left=0}, unsigned int & 0) line 561 + 36 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x03c10dc4, const nsRect & {x=0 y=0 
width=12630 height=1073741824}, int 1, int 0, int 1, nsMargin & {top=0 right=0 
bottom=0 left=0}, unsigned int & 0) line 331 + 50 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 
0x00f77cf0, int * 0x0012e600) line 3873 + 56 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x00f77cf0, int 
* 0x0012e600, int 1) line 3138 + 23 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2945 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x03c10d3c, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 1746 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x03c10d3c, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, 
int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes
CanvasFrame::Reflow(CanvasFrame * const 0x03c0fe54, nsIPresContext * 0x0509f9f0, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 306
nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState & {...}, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0, int 0, int 0, int 12630, int 3870, int 1) line 868
nsBoxToBlockAdaptor::DoLayout(nsBoxToBlockAdaptor * const 0x03c10cd0, 
nsBoxLayoutState & {...}) line 525 + 52 bytes
nsBox::Layout(nsBox * const 0x03c10cd0, nsBoxLayoutState & {...}) line 1002
nsScrollBoxFrame::DoLayout(nsScrollBoxFrame * const 0x03c0ff6c, nsBoxLayoutState 
& {...}) line 378
nsBox::Layout(nsBox * const 0x03c0ff6c, nsBoxLayoutState & {...}) line 1002
nsContainerBox::LayoutChildAt(nsBoxLayoutState & {...}, nsIBox * 0x03c0ff6c, 
const nsRect & {x=0 y=0 width=12630 height=3870}) line 593 + 16 bytes
nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState & {...}, nsIBox * 0x03c0ff6c, 
const nsRect & {x=0 y=0 width=12630 height=3870}) line 1063 + 17 bytes
nsGfxScrollFrameInner::Layout(nsBoxLayoutState & {...}) line 1146
nsGfxScrollFrame::DoLayout(nsGfxScrollFrame * const 0x03c0fec8, nsBoxLayoutState 
& {...}) line 1071 + 15 bytes
nsBox::Layout(nsBox * const 0x03c0fec8, nsBoxLayoutState & {...}) line 1002
nsBoxFrame::Reflow(nsBoxFrame * const 0x03c0fe90, nsIPresContext * 0x0509f9f0, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 775
nsGfxScrollFrame::Reflow(nsGfxScrollFrame * const 0x03c0fe90, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 775 + 25 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x03c0fe90, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, 
int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x03c0fe18, nsIPresContext * 
0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 546
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0513f9d0, 
nsIPresContext * 0x0509f9f0, nsHTMLReflowMetrics & {...}, const nsSize & 
{width=12630 height=3870}, nsIRenderingContext & {...}) line 146
PresShell::ProcessReflowCommands(int 0) line 4452
PresShell::FlushPendingNotifications(PresShell * const 0x050ab710) line 3539
PresShell::DidCauseReflow() line 4401
PresShell::ContentAppended(PresShell * const 0x050ab718, nsIDocument * 
0x05135240, nsIContent * 0x050d0388, int 0) line 3642
nsDocument::ContentAppended(nsDocument * const 0x05135240, nsIContent * 
0x050d0388, int 0) line 1883
nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x05135240, nsIContent * 
0x050d0388, int 0) line 1299
HTMLContentSink::NotifyAppend(nsIContent * 0x050d0388, int 0) line 4428
SinkContext::FlushTags(int 1) line 1977
HTMLContentSink::CloseBody(HTMLContentSink * const 0x05134530, const 
nsIParserNode & {...}) line 2793
CNavDTD::CloseBody(const nsIParserNode * 0x024d0160) line 2965 + 31 bytes
CNavDTD::CloseContainer(const nsIParserNode * 0x024d0160, nsHTMLTag 
eHTMLTag_body, int 0) line 3355 + 12 bytes
CNavDTD::CloseContainersTo(int 1, nsHTMLTag eHTMLTag_body, int 0) line 3417 + 20 
bytes
CNavDTD::CloseContainersTo(nsHTMLTag eHTMLTag_body, int 0) line 3574 + 20 bytes
CNavDTD::DidBuildModel(CNavDTD * const 0x050cd1e0, unsigned int 0, int 1, 
nsIParser * 0x05134ec0, nsIContentSink * 0x05134530) line 549
nsParser::DidBuildModel(unsigned int 0) line 1404 + 60 bytes
nsParser::ResumeParse(int 1, int 1) line 1924
nsParser::OnStopRequest(nsParser * const 0x05134ec8, nsIChannel * 0x03f8f6ac, 
nsISupports * 0x05133aa0, unsigned int 0, const unsigned short * 0x00000000) 
line 2365 + 19 bytes
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x05133630, 
nsIChannel * 0x03f8f6ac, nsISupports * 0x05133aa0, unsigned int 0, const 
unsigned short * 0x00000000) line 269
nsStreamConverter::OnStopRequest(nsStreamConverter * const 0x05133520, 
nsIChannel * 0x03f8f6ac, nsISupports * 0x05133aa0, unsigned int 0, const 
unsigned short * 0x00000000) line 974
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x05133770, 
nsIChannel * 0x03f8f6ac, nsISupports * 0x05133aa0, unsigned int 0, const 
unsigned short * 0x00000000) line 269
nsNNTPProtocol::CleanupAfterRunningUrl() line 5110 + 64 bytes
nsNNTPProtocol::ProcessProtocolState(nsIURI * 0x03f81c64, nsIInputStream * 
0x03ffbef0, unsigned int 14234, unsigned int 225) line 5020 + 11 bytes
nsMsgProtocol::OnDataAvailable(nsMsgProtocol * const 0x03f8f6a8, nsIChannel * 
0x03f85244, nsISupports * 0x03f81c60, nsIInputStream * 0x03ffbef0, unsigned int 
14234, unsigned int 225) line 192 + 32 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x050e8b30) 
line 400 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x050e8ae0) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x050e8ae0) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00b48d60) line 508 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x01e70294, unsigned int 49424, unsigned int 0, 
long 11832672) line 1044 + 9 bytes
USER32! 77e71820()

Comment 1

[harishd]

I see it a lot and it's very annoying!!!!!

Comment 2

[(not reading, please use [e-mail] instead)]

adding bienvenu.

Comment 3

[(not reading, please use [e-mail] instead)]

one step closer to seeing why we get that assertion.

the mime code is generating the following html:

"<P><CENTER><IMG SRC="нннннннн0?part=1.2&hackID=1"></CENTER><P>"

it does that because the url in the MimeObject (obj->options-url) is "нннннннн0"

here's the stack:
mime_image_make_image_html(void * 0x03920150) line 1087
MimeInlineImage_parse_begin(MimeObject * 0x03920e30) line 121 + 19 bytes
MimeMultipart_create_child(MimeObject * 0x03922a00) line 374 + 12 bytes
MimeMultipart_parse_line(char * 0x03cdbad0, int 2, MimeObject * 0x03922a00) line 
200 + 12 bytes
convert_and_send_buffer(char * 0x03cdbad0, int 2, int 1, int (char *, unsigned 
int, void *)* 0x02d31160 MimeMultipart_parse_line(char *, int, MimeObject *), 
void * 0x03922a00) line 157 + 15 bytes
mime_LineBuffer(const char * 0x00ceb548, int 2, char * * 0x03922a28, int * 
0x03922a30, unsigned int * 0x03922a38, int 1, int (char *, unsigned int, void 
*)* 0x02d31160 MimeMultipart_parse_line(char *, int, MimeObject *), void * 
0x03922a00) line 244 + 29 bytes
MimeObject_parse_buffer(char * 0x00ceb548, int 2, MimeObject * 0x03922a00) line 
253 + 49 bytes
MimeMessage_parse_line(char * 0x00ceb548, int 2, MimeObject * 0x0391ce20) line 
210 + 20 bytes
convert_and_send_buffer(char * 0x00ceb548, int 2, int 1, int (char *, unsigned 
int, void *)* 0x02d35be0 MimeMessage_parse_line(char *, int, MimeObject *), void 
* 0x0391ce20) line 157 + 15 bytes
mime_LineBuffer(const char * 0x03ceb3d6, int 1926, char * * 0x0391ce48, int * 
0x0391ce50, unsigned int * 0x0391ce58, int 1, int (char *, unsigned int, void 
*)* 0x02d35be0 MimeMessage_parse_line(char *, int, MimeObject *), void * 
0x0391ce20) line 244 + 29 bytes
MimeObject_parse_buffer(char * 0x03ceb028, int 2868, MimeObject * 0x0391ce20) 
line 253 + 49 bytes
mime_display_stream_write(_nsMIMESession * 0x0391cd90, const char * 0x03ceb028, 
int 2868) line 867 + 20 bytes
nsStreamConverter::OnDataAvailable(nsStreamConverter * const 0x0391b760, 
nsIChannel * 0x030288dc, nsISupports * 0x03bd7360, nsIInputStream * 0x034ed300, 
unsigned int 0, unsigned int 2868) line 843 + 24 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x03bd7030, 
nsIChannel * 0x030288dc, nsISupports * 0x03bd7360, nsIInputStream * 0x034ed300, 
unsigned int 0, unsigned int 2868) line 251 + 46 bytes
nsNNTPProtocol::DisplayArticle(nsIInputStream * 0x0302b770, unsigned int 2918) 
line 2205
nsNNTPProtocol::ReadArticle(nsIInputStream * 0x0302b770, unsigned int 2918) line 
2257 + 19 bytes
nsNNTPProtocol::ProcessProtocolState(nsIURI * 0x0351f2f4, nsIInputStream * 
0x0302b770, unsigned int 179, unsigned int 2918) line 4801 + 19 bytes
nsMsgProtocol::OnDataAvailable(nsMsgProtocol * const 0x030288d8, nsIChannel * 
0x03028654, nsISupports * 0x0351f2f0, nsIInputStream * 0x0302b770, unsigned int 
179, unsigned int 2918) line 192 + 32 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x034ed470) 
line 400 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x034eaf10) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x034eaf10) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00b48fd0) line 508 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x056002e4, unsigned int 49424, unsigned int 0, 
long 11833296) line 1044 + 9 bytes
USER32! 77e71820()
00b48fd0()

perhaps rhp, master of all that is mime, can help.

Comment 4

[(not reading, please use [e-mail] instead)]

updating summary.

when this bug happens, we fail to load the image.

Comment 5

[(not reading, please use [e-mail] instead)]

note, occasionally the image loads.  not sure why it works sometimes, and fails 
others times.

Comment 6

[(not reading, please use [e-mail] instead)]

I see this on win32 and linux.

Comment 7

[(not reading, please use [e-mail] instead)]

adding url to reproduce the problem.

Comment 8

[(not reading, please use [e-mail] instead)]

that url isn't the easiest way to reproduce the problem.

go the news://news.mozilla.org/netscape.test and read the postings on 8-16 and 
read the message "attached file again" and "attached file 3"

Comment 9

[selmer (gone)]

This happens frequently enough to warrant a P2??  I need a little convincing of
that.

Comment 10

[(not reading, please use [e-mail] instead)]

this happens very frequently.  updating summary.  clearning status whiteboard.

Comment 11

[selmer (gone)]

Not ready to plus this yet.  Found that saving attachments in news doesn't seem
to work at all and would rather fix that bug first.  Probably another symptom of
same underlying cause, please update when we know.

Comment 12

[(not reading, please use [e-mail] instead)]

interesting note:  if I copy this news mesage into my local folders, I see the
"intermittent failure to display inline image" problem.

I'll attach the berkeley mbox file to this bug report.

Comment 13

[(not reading, please use [e-mail] instead)]

Attachment: mbox (Trash) to reproduce this bug.

Comment 14

[(not reading, please use [e-mail] instead)]

I should note that this bug is less frequent when you try to reproduce it with a
message in a local folder.  but it still happens.

Comment 15

[David :Bienvenu]

as I mentioned privately, I've seen this with imap messages (like k'trina's
recent pizza message).

Comment 16

[selmer (gone)]

OK, I'm feeling convinced now (K'trina's message displayed the problem for my
IMAP Inbox too.)  nsbeta3+, P2 for high-profile functionality.

Comment 17

[selmer (gone)]

pdt agrees p2.

Comment 18

[(not reading, please use [e-mail] instead)]

updating summary, since this is not news only.

note to selmer:  now that #53421 is fixed (save attachment works from news
messages) there is some what of a work around when the failure occurs:
save or open the attachment.

I just found out that opening an attachment from a news message doesn't work.

nsNntpService::OpenAttachment() returns NS_ERROR_NOT_IMPLEMENTED.

I'll go open a bug on that.  I feel a little silly finding all these bugs right
before nsbeta3.

Comment 19

[(not reading, please use [e-mail] instead)]

reopen.  didn't mean to mark it fixed.

Comment 20

[(not reading, please use [e-mail] instead)]

accepting.

Comment 21

[(not reading, please use [e-mail] instead)]

rhp, do you have the cycles to help investigate this?

Comment 22

[rhp (gone)]

Sure thing.

- rhp

Comment 23

[selmer (gone)]

If this doesn't make b3, we'd like to consider it for rtm.

Comment 24

[rhp (gone)]

Ok, looking into this further, this is puking inside of image layout with data 
conversion asserts:

nsStr::StrAppend(nsStr & {...}, const nsStr & {...}, unsigned int 0, int 26) 
line 175 + 50 bytes
nsCString::AssignWithConversion(const unsigned short * 0x03ebf390, int 26) line 
796 + 43 bytes
nsCString::AssignWithConversion(const nsString & 
{"?x?@u??part=1.2&hackID=1"}) line 802
nsString::ToNewCString() line 615
nsFrameImageLoader::Init(nsFrameImageLoader * const 0x03d3b0a0, nsIPresContext 
* 0x038f2380, nsIImageGroup * 0x03d39430, const nsString & 
{"?x?@u??part=1.2&hackID=1"}, const unsigned int * 0x00000000, const nsSize * 

Continuing to dig.

- rhp

Comment 25

[(not reading, please use [e-mail] instead)]

rhp, see my comment on 2000-09-19 21:27

there is a stack trace (in mime) to where we emit the bogus html.

Comment 26

[rhp (gone)]

Ok, I have this one nailed. It was a case where one structure pointed to memory 
in another structure and that memory was getting freed. This code resets that 
pointer when reassigned:

Index: mozilla/mailnews/mime/src/nsStreamConverter.cpp
===================================================================
RCS file: /cvsroot/mozilla/mailnews/mime/src/nsStreamConverter.cpp,v
retrieving revision 1.66
diff -u -r1.66 nsStreamConverter.cpp
--- nsStreamConverter.cpp	2000/09/13 23:53:43	1.66
+++ nsStreamConverter.cpp	2000/09/25 20:00:37
@@ -110,6 +110,7 @@
 bridge_new_new_uri(void *bridgeStream, nsIURI *aURI, PRInt32 aOutputType)
 {
   nsMIMESession *session = (nsMIMESession *)bridgeStream;
+  const char    **fixup_pointer = nsnull;
 
   if (session)
   {
@@ -128,6 +129,7 @@
           default_charset = &(mdd->options->default_charset);
           override_charset = &(mdd->options->override_charset);
           url_name = &(mdd->url_name);
+          fixup_pointer = &(mdd->options->url);
         }
       }
       else
@@ -139,6 +141,7 @@
           default_charset = &(msd->options->default_charset);
           override_charset = &(msd->options->override_charset);
           url_name = &(msd->url_name);
+          fixup_pointer = &(msd->options->url);
         }
       }
 
@@ -190,6 +193,8 @@
             if (!(*url_name))
               return NS_ERROR_OUT_OF_MEMORY;
 
+            // rhp: Ugh, this is ugly...but it works.
+            *fixup_pointer = (const char *)*url_name;
             CRTFREEIF(urlString);
           }
         }

Comment 27

[rhp (gone)]

Also, put in a bug for a better future fix:

http://bugzilla.mozilla.org/show_bug.cgi?id=54048

- rhp

Comment 28

[Peter Trudelle]

PDT marking nsbeta3-

Comment 29

[rhp (gone)]

I have a 3 line fix in hand and this is really bad. Please reconsider.

- rhp

Comment 30

[rhp (gone)]

Just some more info. It is a miracle we don't crash every time an I18N message 
with images is read by messenger. I have the fix ready to roll in both the 
branch and the tip so I'm asking again :-)

- rhp

Comment 31

[(not reading, please use [e-mail] instead)]

removing my "assertions galore" comment in the summary.  

the real problem is we frequently fail to load inline images in mail and news
messages.

selmer, can you grease some palms with the PDT to get this one plussed?

Comment 32

[selmer (gone)]

What I can do right now is give this an rtm+.  The pdt still needs to review
these and give rtm++ before this can be checked in on the branch.

Comment 33

[(not reading, please use [e-mail] instead)]

sent mail asking for re-eval of nsbeta3++ since this block blocks a basic
functional test.

from http://slip/projects/seamonkey/mail/tests/sea_mn_basic_functional.html

"Select a message with a .gif attachment.  Verify that the message can be
displayed."

Comment 34

[Phil Peterson]

nsbeta3++ per email thread

Comment 35

[rhp (gone)]

The fix is in :-) for both the tip and the branch.

- rhp

Comment 36

[pmock]

Verified as fixed on win32, linux, and macos using the following builds:
 win32 commercial seamonkey build 2000-092809-mn6 installed on P500 Win98
 linux commercial seamonkey build 2000-092810-mn6 installed on P200 RedHat 6.2
 macos commercial seamonkey build 2000-092812-mn6 installed on G3/400 OS 9.04