61412 - N601 crash #3 [@ mime_subclass_p]

Status: VERIFIED FIXED

(MailNews Core :: MIME, defect, P2)

Description

[Jay Patel [:jay]]

This is the #5 topcrasher with the official RTM build for Windows.  I have not
been able to reproduce it, but below is the stack trace and some user comments
from talkback that might help others reproduce:

Incident ID 21906644
mime_subclass_p [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimei.cpp, line 683]
mime_typep [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimei.cpp, line 693]
CountTotalMimeAttachments
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, line 210]
CountTotalMimeAttachments
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, line 215]
CountTotalMimeAttachments
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, line 215]
MimeGetAttachmentList
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, line 435]
mime_display_stream_complete
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, line 906]
nsStreamConverter::OnStopRequest
[d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 956]
nsDocumentOpenInfo::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 277]
nsMsgProtocol::OnStopRequest
[d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp, line 230]
nsMailboxProtocol::OnStopRequest
[d:\builds\seamonkey\mozilla\mailnews\local\src\nsMailboxProtocol.cpp, line 200]
nsFileChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\file\src\nsFileChannel.cpp, line 649]
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 302]
nsStreamListenerEvent::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 106]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 581]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 517]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1051]
KERNEL32.DLL + 0x245af (0xbff945af)
0x00658b52
-------------
CrashDate: 2000-11-27 UptimeMinutes: 1  Total: 951 OS: Windows 98  4.10 build
67766222
	 Incident ID: http://climate/reports/stackcommentemail.cfm?dynamicBBID=21901884
Comment: checking an e-mail in trash bin which conained a jpeg file
--------------
CrashDate: 2000-11-27 UptimeMinutes: 21  Total: 2889 OS: Windows 98  4.90 build
73010104
	 Incident ID: http://climate/reports/stackcommentemail.cfm?dynamicBBID=21900763
Comment: Just finished creating mail subfolders
---------------
CrashDate: 2000-11-27 UptimeMinutes: 95  Total: 95 OS: Windows 98  4.10 build
67766222
	 Incident ID: http://climate/reports/stackcommentemail.cfm?dynamicBBID=21890529
Comment: I had just clicked on an e-mail with an attached exe I had sent to
myself from another location.
----------------
CrashDate: 2000-11-27 UptimeMinutes: 8  Total: 65 OS: Windows NT  5.0 build 2195
	 Incident ID: http://climate/reports/stackcommentemail.cfm?dynamicBBID=21894564
Comment: I find that if I move an email with a JPEG attachment
-----------------
Here are just user comments so that the my comments don't take up too much room
in this bug:

Comment: I was clicking through mail that had email attachments.
Comment: Clicked on a message saved in a new local folder while in the mail app.
Comment: deleting messages from the trash folder.
Comment: Reading mail; moving mail pieces from place to place.
Comment: I was trying to open a file with an attachment to save the file on mi HD
Comment: Dragging and dropping an e-mail from one folder to another.

Comment 1

[Jay Patel [:jay]]

Adding crash, topcrash keywords and [@ mime_subclass_p]
 for tracking.  This crash seems to be occurring at the following location:

Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/mime/src/mimei.cpp
line : 683

Comment 2

[scottputterman]

cc'ing myself.

Comment 3

[scottputterman]

nominating mail2.

Comment 4

[scottputterman]

marking nsbeta1+ and moving to mozilla0.8

Comment 5

[scottputterman]

*** Bug 64409 has been marked as a duplicate of this bug. ***

Comment 6

[scottputterman]

reassigning to ducarroz

Comment 7

[Jean-Francois Ducarroz]

too bad, I cannot reproduce this crash.

The only thing I can do is to protect the function mime_subclass_p() against a
null child parameter. But I am pretty sure that if an mime object doesn't have a
clazz (which will lead to have child == null), mime will not survive anyway.

Comment 8

[scottputterman]

Esther, I don't know who tests this area. Perhaps we can look at the talkback
reports and try to figure out some test cases. If we could get an email that
causes this crash, we'd be in good shape for fixing this.

Comment 9

[Jean-Francois Ducarroz]

Ok, I found a way to reproduce this crash:
1) send to yourself a message with a jpg attached
2) retreive the message
3) move or copy into your LOCAL trash folder
4) open the local trash
5) select the message and copy it again into the local trash folder
6) now you have two copy of it in the trash. Click into the new one
7) --> CRASH

The problem is due to a database corruption that has been just fixed 2 days ago
(see bug 66956) but despite the fix, the DB still corrupted therefore I need to
find a way into mime to support this corruption.

Comment 10

[Jean-Francois Ducarroz]

Fixed and checked in

Comment 11

[Jean-Francois Ducarroz]

*** Bug 53447 has been marked as a duplicate of this bug. ***

Comment 12

[Jay Patel [:jay]]

since no one has verified this fixed, i am reopening.  this is the #3 topcrasher
with N601.  here is the lastest info:

mime_subclass_p   305 	 61412 	 RESO 	 FIXE
     First BBID :
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=26103719 Last BBID  :
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=26579153 Min Runtime :70
     Max Runtime :451354
     Min seconds since last crash :10
     Max seconds since last crash :287180
     First Appearance Date : 2001-02-10
     Last Appearance Date : 2001-02-19

Stack Trace:

	 mime_subclass_p
[d:\builds\6.01\mozilla\mailnews\mime\src\mimei.cpp  line 683]
	 mime_typep
[d:\builds\6.01\mozilla\mailnews\mime\src\mimei.cpp  line 693]
	 CountTotalMimeAttachments
[d:\builds\6.01\mozilla\mailnews\mime\src\mimemoz2.cpp  line 210]
	 CountTotalMimeAttachments
[d:\builds\6.01\mozilla\mailnews\mime\src\mimemoz2.cpp  line 215]
	 CountTotalMimeAttachments
[d:\builds\6.01\mozilla\mailnews\mime\src\mimemoz2.cpp  line 215]
	 MimeGetAttachmentList
[d:\builds\6.01\mozilla\mailnews\mime\src\mimemoz2.cpp  line 435]
	 mime_display_stream_complete
[d:\builds\6.01\mozilla\mailnews\mime\src\mimemoz2.cpp  line 906]
	 nsStreamConverter::OnStopRequest
[d:\builds\6.01\mozilla\mailnews\mime\src\nsStreamConverter.cpp  line 956]
	 nsDocumentOpenInfo::OnStopRequest
[d:\builds\6.01\mozilla\uriloader\base\nsURILoader.cpp  line 277]
	 nsMsgProtocol::OnStopRequest
[d:\builds\6.01\mozilla\mailnews\base\util\nsMsgProtocol.cpp  line 230]
	 nsMailboxProtocol::OnStopRequest
[d:\builds\6.01\mozilla\mailnews\local\src\nsMailboxProtocol.cpp  line 200]
	 nsFileChannel::OnStopRequest
[d:\builds\6.01\mozilla\netwerk\protocol\file\src\nsFileChannel.cpp  line 649]
	 nsOnStopRequestEvent::HandleEvent
[d:\builds\6.01\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp  line 302]
	 nsStreamListenerEvent::HandlePLEvent
[d:\builds\6.01\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp  line 106]
	 PL_HandleEvent
[d:\builds\6.01\mozilla\xpcom\threads\plevent.c  line 581]
	 PL_ProcessPendingEvents
[d:\builds\6.01\mozilla\xpcom\threads\plevent.c  line 517]
	 _md_EventReceiverProc
[d:\builds\6.01\mozilla\xpcom\threads\plevent.c  line 1051]
	 KERNEL32.DLL + 0x24407 (0xbff94407)
	 0x00658b5e

 	Source File : d:/builds/6.01/mozilla/mailnews/mime/src/mimei.cpp line : 683

Comment 13

[Jean-Francois Ducarroz]

I don't understand why you have reopened this bug!!! The build used in the last
two talback reports are from January 31 while the fix get checked in on February
2nd. Please reopnen it only if you see the crash with a build from after
February 2nd. Close it again.

Comment 14

[Asa Dotzler [:asa]]

reopening for crash seen on 030714 linux and 030704 win32 with matching stack
trace. the crash comes from bug 64601. 

Comment 15

[Asa Dotzler [:asa]]

*** Bug 64601 has been marked as a duplicate of this bug. ***

Comment 16

[(not reading, please use [e-mail] instead)]

I've seen something similar (but not the same stack) with news on the
performance branch.  (it is probably on the trunk too, but I haven't checked.)

the following message has a bogus attachment:
news://news.mozilla.org/[e-mail]

I often crash when loading it.  In my case, it crashes because mOriginalListener
is null in nsCachedNetData.cpp.

perhaps this crasher is similar?  on a bad attachment, the protocol instances
goes away, but someone is still holding on to it?

Comment 17

[selmer (gone)]

Adding nscatfood assigning crash car.

Comment 18

[Jean-Francois Ducarroz]

Can somebody reproduce this crash?

Comment 19

[[e-mail] (gone - use [e-mail] instead)]

I tried the newsposting that Seth put a link to in this bug, and didn't crash on
build 2001-04-02-04 on Win2K, but I may not be reproducing it correctly.  

Comment 20

[scottputterman]

moving to mozilla0.9.  The priority of this crash has gone down based on the 
fact that it used to be the #3 crasher and now it's not even showing up in the 
list of top 0.8.1 crashers

Comment 21

[scottputterman]

moving to future milestone.  I did a search of talkback, there are no crashes
listed for this that aren't from  NS 6.01 or 6.0.  This used to show up in the
top crashes of post 6.01 builds so either this bug is gone or it's happening
infrequently enough that it's not a problem anymore.  If the reports start to
pick up or nsbeta1 proves differently then we can continue looking into this.

Comment 22

[Jan Carpenter]

mime_subclass_p is no longer showing up on M09 or trunk crash reports.  Also, 
I'm not able to reproduce it, so I'm calling this fixed.  If someone else is 
getting it to happen, please reopen this report.

Comment 23

[fenella]

Unable to reproduce this bug using these builds.
Linux (2001-007-11-05-0.9.2)
Win32 (2001-007-11-06-0.9.2)
Mac (2001-007-11-08-0.9.2)