612291 - crash [@ nsMsgSaveAsListener::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned int, unsigned int)]

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsMsgSaveAsListener::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned int, unsigned int)]
currently ranked a topcrash. but many are multiples per person

bp-8f3cef60-2aef-4185-b39f-347652100908 (p)
EXCEPTION_ACCESS_VIOLATION
0x0
0	thunderbird.exe	nsMsgSaveAsListener::OnDataAvailable	mailnews/base/util/nsMsgMailNewsUrl.cpp:895
1	thunderbird.exe	nsStreamListenerTee::OnDataAvailable	netwerk/base/src/nsStreamListenerTee.cpp:108
2	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
3	xpcom_core.dll	nsProxyObjectCallInfo::Run	xpcom/proxy/src/nsProxyEvent.cpp:181
4	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:527
5	xpcom_core.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:250
6	thunderbird.exe	nsXULWindow::ShowModal	xpfe/appshell/src/nsXULWindow.cpp:416
7	thunderbird.exe	nsContentTreeOwner::ShowAsModal	xpfe/appshell/src/nsContentTreeOwner.cpp:528

Comment 1

[Wayne Mery (:wsmwk)]

comment from bp-8f3cef60-2aef-4185-b39f-347652100908
Select multiple messages, save to file (had saved some of them before already)

other comments:
Trying to upload 7 messages and it crashed again
Uploading IMAP email messages to network share. Crashes trying to upload 24 messages
trying to export mail from Google to a Network share using IMAP. This client keeps crashing when trying to copy to the network share.
copying about 7000 mail items from a local search folder to a regular hard drive folder

Comment 2

[timeless]

   939 nsresult rv = MsgNewBufferedFileOutputStream(getter_AddRefs(m_outputStream),
   940    localFile, -1, 00600);
   941  NS_ENSURE_SUCCESS(rv, rv); 
somehow we expect to have a null pointer for m_outputStream:
   943  if (m_outputStream && addDummyEnvelope)

we're crashing because m_outputStream is null:
   895              rv = m_outputStream->Write(start, end-start, &writeCount);

Comment 3

[Wayne Mery (:wsmwk)]

> we're crashing because m_outputStream is null:
>    895              rv = m_outputStream->Write(start, end-start, &writeCount);

thanks timeless.

bienvenu, do we need anything else to produce a patch?

most crash comments mention saving multiple messages, but I couldn't reproduce. bp-64092f53-dd90-4700-845a-752052101201 (rainer) has a reporter if we need a tester.  I am hoping he will respond.

Comment 4

[timeless]

Attachment: patch

Comment 5

[Wayne Mery (:wsmwk)]

rainer says "it did work directly from imap when I saved the mails
separately or only a few (< 10) at once." but selecting more causes crash.  

should m_outputStream be null under such circumstances?

Comment 7

[Wayne Mery (:wsmwk)]

Makoto in bug 616972 wrote
After SetupMsgWriteStream returns an error at first, when OnDataAvailable is
called, this crash will occurs.  m_writtenData should not set PR_TRUE if
SetupMsgWriteStream returns error.

Comment 8

[Mark Banner (:standard8)]

Checked in: http://hg.mozilla.org/comm-central/rev/e40c2f627634

Comment 9

[Mark Banner (:standard8)]

Comment on attachment 494969 [details] [diff] [review]
patch

We should consider this for 3.1.8.

Comment 10

[Mark Banner (:standard8)]

Checked in: http://hg.mozilla.org/releases/comm-1.9.2/rev/b62871cabd13

Comment 11

[Martin Stránský [:stransky] (ni? me)]

Attachment: 1.8 version