Closed Bug 6699 Opened 25 years ago Closed 25 years ago

[PP]Mac only-Crash while trying to render msg with web attachment

Categories

(MailNews Core :: MIME, defect, P3)

Product:
MailNews Core
Component:
MIME
Platform:
PowerPC
Other
Type:
defect

Tracking

(Not tracked)

Status:
VERIFIED DUPLICATE of bug 2537

People

(Reporter: pmock, Assigned: peterl-retired)

References

(
URL
)

Details

(Whiteboard: CSS problem) 

Background:
 Bug originated with bug 6099 ([PP] Mac, nsCOMPtr ownership doc sent as
attachment crashes in PICS code)

 According to Neeti@netscape.com in bug 6099,
"On windows, this bug was crashing in pics.dll. PICS is not enabled on the
mac.There is no pics.dll on mac. So, I am not sure if this is same bug as it was
on windows..."

Build:
 Mac May 17 Seamonkey build (1999051709) running on a PPC 8500/180 and PPC Duo
2300c, OS 8.5.1
 Win32 May 18 Seamonkey build (1999051809) running on Gateway P200, Win98
 Linux May 18 Seamonkey build (1999051809) running on Compaq P200, Red Hat 5.2

Problem:
 Messenger crashes when trying to render a mail message that contains an
attached web page with URL http://www.mozilla.org/projects/xpcom/Ownership.html.
It crashes consistently on Mac but does not crash on Linux or win32.

Note: can not test on todays Mac May 18 build (1999051809) because of bug 6680.

Talkback Tracking IDs are: ERN59CNG, ERO07TMI, and ERP01DVH

Steps to reproduce problem:
1) From Communicator, open a browser window
2) Go to URL - http://www.mozilla.org/projects/xpcom/Ownership.html
3) Send this page to yourself
4) Retrieve the mail message in Communicator
5) View message to ensure it has it file attachment
6 [details]) Copy the message to a local mail box
7) Exit Communicator
8) Copy this mail box to your Seamonkey mail folder
9) Start Seamonkey
10) Open Messenger from the task bar
11) Double click on the mail server to expand folder
12) Select your folder
13) Select the message that has this web attachment
    Crash to Macsbug

Macsbug log consistently crashes in the same location.
------------
The ÒapprunnerÓ heap at 018CD380 is ok
 Totaling the ÒapprunnerÓ heap at 018CD380
                                 Total Blocks    Total of Block Sizes
  Free                           00A0     #160   00214E50     #2182736
  Nonrelocatable                 00F8     #248   00724D5C     #7490908
  Relocatable                    0366     #870   00058B10      #363280
    Locked                       0003       #3   00049480      #300160
    Purgeable and not locked     0000       #0   00000000           #0
  Heap size                      04FE    #1278   009926BC    #10036924
 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  06A04D38
  022AB8C0    PPC  06A03E30  main+006C4
  022AB730    PPC  0670BDD0  nsAppShellService::Run()+00018
  022AB6F0    PPC  05F99754  nsAppShell::Run()+00038
  022AB670    PPC  05F9A0D0  nsMacMessagePump::DoMessagePump()+0003C
  022AB620    PPC  05F9A364  nsMacMessagePump::DispatchEvent(int,
EventRecord*)+00158
  022AB5D0    PPC  06878150  Repeater::DoRepeaters(const EventRecord&)+00030
  022AB590    PPC  068707A8  TimerPeriodical::RepeatAction(const
EventRecord&)+00048
  022AB540    PPC  06870304  TimerImpl::Fire()+00024
  022AB500    PPC  067E8B0C  nsNetlibService::NetPollSocketsCallback(nsITimer*,
void*)+0001C
  022AB4C0    PPC  067C3960  NET_PollSockets+0002C
  022AB470    PPC  067BF294  NET_ProcessNet+003C4
  022AB0E0    PPC  067CC294  net_ProcessFile+000DC
  022AB090    PPC  067CB968  net_read_file_chunk+00258
  022AB040    PPC  068024C4  plugin_stream_write(_NET_StreamClass*, const char*,
long)+0001C
  022AB000    PPC  061EF180  MimePluginInstance::Write(const char*, unsigned
int, unsigned in
t*)+000C4
  022AABB0    PPC  061FCF10  mime_display_stream_write+0004C
  022AAB70    PPC  06203558  MimeObject_parse_buffer(char*, int,
MimeObject*)+0003C
  022AAB30    PPC  061F4000  mime_LineBuffer+001C0
  022AAAD0    PPC  061F3DE8  convert_and_send_buffer(char*, int, int, int
(*)(char*, unsigned
 int, void*), void*)+000BC
  022AAA90    PPC  06200248  MimeMessage_parse_line(char*, int,
MimeObject*)+00170
  022AAA30    PPC  06203558  MimeObject_parse_buffer(char*, int,
MimeObject*)+0003C
  022AA9F0    PPC  061F3ECC  mime_LineBuffer+0008C
  022AA990    PPC  061F3DE8  convert_and_send_buffer(char*, int, int, int
(*)(char*, unsigned
 int, void*), void*)+000BC
  022AA950    PPC  062022E0  MimeMultipart_parse_line(char*, int,
MimeObject*)+0024C
  022AA900    PPC  06202D2C  MimeMultipart_parse_child_line(MimeObject*, char*,
int, int)+001
C4
  022AA8A0    PPC  061FB620  MimeLeaf_parse_buffer(char*, int,
MimeObject*)+00084
  022AA860    PPC  06204D40  MimeInlineText_parse_decoded_buffer(char*, int,
MimeObject*)+000
84
  022AA820    PPC  061F3ECC  mime_LineBuffer+0008C
  022AA7C0    PPC  061F3DE8  convert_and_send_buffer(char*, int, int, int
(*)(char*, unsigned
 int, void*), void*)+000BC
  022AA780    PPC  06204EE4  MimeInlineText_rotate_convert_and_parse_line(char*,
int, MimeObj
ect*)+00140
  022AA720    PPC  06205294  MimeInlineTextHTML_parse_line(char*, int,
MimeObject*)+00050
  022AA6E0    PPC  061FA9CC  MimeObject_write(MimeObject*, char*, int,
int)+00074
  022AA690    PPC  061FA8EC  MimeOptions_write(MimeDisplayOptions*, char*, int,
int)+00118
  022AA620    PPC  061FCDE4  mime_output_fn(char*, int, void*)+00058
  022AA5E0    PPC  066C648C  nsMimeEmitter::WriteBody(const char*, unsigned int,
unsigned int
*)+00014
  022AA5A0    PPC  066C669C  nsMimeEmitter::Write(const char*, unsigned int,
unsigned int*)+0
0184
  022AA540    PPC  0680311C  nsNetConverterStream::Write(const char*, unsigned
int, unsigned
int*)+0002C
  022AA4F0    PPC  067EC8F0  stub_put_block(_NET_StreamClass*, const char*,
long)+00080
  022AA4A0    PPC  0661ABF0  nsDocumentBindInfo::OnDataAvailable(nsIURL*,
nsIInputStream*, un
signed int)+00074
  022AA450    PPC  0654B334  nsParser::OnDataAvailable(nsIURL*, nsIInputStream*,
unsigned int
)+001A8
  022AA3F0    PPC  0654AD94  nsParser::ResumeParse(nsIDTD*)+000CC
  022AA3A0    PPC  0654AED4  nsParser::BuildModel()+0006C
  022AA360    PPC  06538E84  CNavDTD::BuildModel(nsIParser*, nsITokenizer*,
nsITokenObserver*
, nsIContentSink*)+0009C
  022AA300    PPC  06539490  CNavDTD::HandleToken(CToken*, nsIParser*)+0025C
  022AA2A0    PPC  065490D4  CTokenHandler::operator()(CToken*, nsIDTD*)+0002C
  022AA260    PPC  06538278  NavDispatchTokenHandler(CToken*, nsIDTD*)+0005C
  022AA210    PPC  0653ABF8  CNavDTD::HandleStartToken(CToken*)+0021C
  022AA0F0    PPC  0653D9F4  CNavDTD::AddHeadLeaf(nsIParserNode&)+000C8
  022AA0A0    PPC  0653D8D8  CNavDTD::AddLeaf(const nsIParserNode&)+00058
  022AA060    PPC  062A634C  HTMLContentSink::AddLeaf(const
nsIParserNode&)+000BC
  022AA020    PPC  062A8184  HTMLContentSink::ProcessLINKTag(const
nsIParserNode&)+003EC
  022A9DD0    PPC  062A7CBC  HTMLContentSink::ProcessStyleLink(nsIHTMLContent*,
const nsStrin
g&, const nsString&, const nsString&, const nsString&, const nsString&,
int)+002C8
 Closing log
Stack Trace from Talkback.  The crash on line 2790 of CNavDTD.cpp is consistent
in all three talkback logs.  The last people to update this file was in 3/17/99
by ftang, harishd, and richg.

-----
Trigger Type:  Program Crash
Trigger Reason:  PowerPC unmapped memory exception
 Call Stack:    (Signature = 0x4c50616c 547c7aca)
   0x4c50616c
   layout.shlb + 0x3504c (0x05c1ecbc)
   layout.shlb + 0x35514 (0x05c1f184)
   layout.shlb + 0x336dc (0x05c1d34c)
   CNavDTD::AddLeaf()                     [CNavDTD.cpp, line 2790]
   CNavDTD::AddHeadLeaf()                 [CNavDTD.cpp, line 2822]
   CNavDTD::HandleStartToken()            [CNavDTD.cpp, line 1422]
   NavDispatchTokenHandler()              [CNavDTD.cpp, line 249]
   .__cl__13CTokenHandlerFP6CTokenP6nsIDTD [nsTokenHandler.cpp, line 80]
   CNavDTD::HandleToken()                 [CNavDTD.cpp, line 675]
   CNavDTD::BuildModel()                  [CNavDTD.cpp, line 514]
   nsParser::BuildModel()                 [nsParser.cpp, line 892]
   nsParser::ResumeParse()                [nsParser.cpp, line 844]
   nsParser::OnDataAvailable()            [nsParser.cpp, line 1056]
   nsDocumentBindInfo::OnDataAvailable()  [nsDocLoader.cpp, line 1498]
   stub_put_block()                       [nsStubContext.cpp, line 833]
JF,
Might this be a problem including style sheets that don't exist? Just wondering
because I see this in the stack trace:

PPC  062A7CBC  HTMLContentSink::ProcessStyleLink(nsIHTMLContent*,
const nsString&, const nsString&, const nsString&, const nsString&, const
nsString&, int)+002C8

- rhp
JF,
Might this be a problem including style sheets that don't exist? Just wondering
because I see this in the stack trace:

PPC  062A7CBC  HTMLContentSink::ProcessStyleLink(nsIHTMLContent*,
const nsString&, const nsString&, const nsString&, const nsString&, const
nsString&, int)+002C8

- rhp
QA Contact: lchiang → pmock
In the optimized June 8 Mac build (1999-06-08-08-m7).  It still crashes viewing
this URL.

Here is the MacsBug log:

 The “apprunner” heap at 07E46C60 is ok
 Totaling the “apprunner” heap at 07E46C60
                                 Total Blocks    Total of Block Sizes
  Free                           009A     #154   0021EF20     #2223904
  Nonrelocatable                 00FF     #255   0073054C     #7537996
  Relocatable                    02C4     #708   00043250      #275024
    Locked                       0005       #5   0002B3C0      #177088
    Purgeable and not locked     0000       #0   00000000           #0
  Heap size                      045D    #1117   009926BC    #10036924
 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  1896FF80
  088251C0    PPC  1896F100  main+00904
  08824FC0    PPC  18744250  nsAppShellService::Run()+00018
  08824F80    PPC  186745D0  nsAppShell::Run()+00038
  08824F00    PPC  18674F8C  nsMacMessagePump::DoMessagePump()+0003C
  08824EB0    PPC  18675244  nsMacMessagePump::DispatchEvent(int, EventRecord*)+
00158
  08824E60    PPC  188BB024  Repeater::DoRepeaters(const EventRecord&)+00030
  08824E20    PPC  188BAB44  TimerPeriodical::RepeatAction(const EventRecord&)+
00048
  08824DD0    PPC  188BA6A0  TimerImpl::Fire()+00024
  08824D90    PPC  1889F2F0  nsNetlibService::NetPollSocketsCallback(nsITimer*,
void*)+0001C
  08824D50    PPC  1887EDE4  NET_PollSockets+0002C
  08824D00    PPC  1887A718  NET_ProcessNet+003C4
  08824970    PPC  18887710  net_ProcessFile+000DC
  08824920    PPC  18886DE4  net_read_file_chunk+00258
  088248D0    PPC  188B8844  plugin_stream_write(_NET_StreamClass*, const char*,
long)+0001C
  08824890    PPC  17F85168  MimePluginInstance::Write(const char*, unsigned int,
unsigned in
t*)+000C4
  08824440    PPC  17F9386C  mime_display_stream_write+0004C
  08824400    PPC  17F9A314  MimeObject_parse_buffer(char*, int, MimeObject*)+
0003C
  088243C0    PPC  17F8A998  mime_LineBuffer+001C0
  08824360    PPC  17F8A780  convert_and_send_buffer(char*, int, int, int (*
)(char*, unsigned
 int, void*), void*)+000BC
  08824320    PPC  17F9701C  MimeMessage_parse_line(char*, int, MimeObject*)+
0016C
  088242D0    PPC  17F9A314  MimeObject_parse_buffer(char*, int, MimeObject*)+
0003C
  08824290    PPC  17F8A864  mime_LineBuffer+0008C
  08824230    PPC  17F8A780  convert_and_send_buffer(char*, int, int, int (*
)(char*, unsigned
 int, void*), void*)+000BC
  088241F0    PPC  17F990A4  MimeMultipart_parse_line(char*, int, MimeObject*)+
00248
  088241A0    PPC  17F99AEC  MimeMultipart_parse_child_line(MimeObject*, char*,
int, int)+001
C4
  08824140    PPC  17F91F98  MimeLeaf_parse_buffer(char*, int, MimeObject*)+00084
  08824100    PPC  17F9BAE8  MimeInlineText_parse_decoded_buffer(char*, int,
MimeObject*)+000
84
  088240C0    PPC  17F8A864  mime_LineBuffer+0008C
  08824060    PPC  17F8A780  convert_and_send_buffer(char*, int, int, int (*
)(char*, unsigned
 int, void*), void*)+000BC
  08824020    PPC  17F9BC8C  MimeInlineText_rotate_convert_and_parse_line(char*,
int, MimeObj
ect*)+00140
  08823FD0    PPC  17F9C038  MimeInlineTextHTML_parse_line(char*, int,
MimeObject*)+00050
  08823F90    PPC  17F9134C  MimeObject_write(MimeObject*, char*, int, int)+00074
  08823F40    PPC  17F9126C  MimeOptions_write(MimeDisplayOptions*, char*, int,
int)+00118
  08823ED0    PPC  17F93740  mime_output_fn(char*, int, void*)+00058
  08823E90    PPC  17F33474  nsMimeEmitter::WriteBody(const char*, unsigned int,
unsigned int
*)+00014
  08823E50    PPC  17F33684  nsMimeEmitter::Write(const char*, unsigned int,
unsigned int*)+0
0184
  08823DF0    PPC  188B949C  nsNetConverterStream::Write(const char*, unsigned
int, unsigned
int*)+0002C
  08823DA0    PPC  188A3140  stub_put_block(_NET_StreamClass*, const char*,
long)+00080
  08823D50    PPC  184B2C88  nsDocumentBindInfo::OnDataAvailable(nsIURL*,
nsIInputStream*, un
signed int)+00074
  08823D00    PPC  185AA6DC  nsParser::OnDataAvailable(nsIURL*, nsIInputStream*,
unsigned int
)+001A8
  08823CA0    PPC  185AA120  nsParser::ResumeParse(nsIDTD*)+0008C
  08823C50    PPC  185AA268  nsParser::BuildModel()+00070
  08823C00    PPC  18597F44  CNavDTD::BuildModel(nsIParser*, nsITokenizer*,
nsITokenObserver*
, nsIContentSink*)+0009C
  08823BA0    PPC  185985A4  CNavDTD::HandleToken(CToken*, nsIParser*)+0025C
  08823B40    PPC  185A8308  CTokenHandler::operator()(CToken*, nsIDTD*)+0002C
  08823B00    PPC  18597318  NavDispatchTokenHandler(CToken*, nsIDTD*)+0005C
  08823AB0    PPC  18599D50  CNavDTD::HandleStartToken(CToken*)+001E4
  088239B0    PPC  1859C9F4  CNavDTD::AddHeadLeaf(nsIParserNode&)+000C8
  08823960    PPC  1859C8D8  CNavDTD::AddLeaf(const nsIParserNode&)+00058
  08823920    PPC  18173214  HTMLContentSink::AddLeaf(const nsIParserNode&)+000BC
  088238E0    PPC  181751FC  HTMLContentSink::ProcessLINKTag(const nsIParserNode&
)+003EC
  08823700    PPC  18174CF8  HTMLContentSink::ProcessStyleLink(nsIHTMLContent*,
const nsStrin
g&, const nsString&, const nsString&, const nsString&, const nsString&)+00378
  08823580    PPC  183ADD9C  CSSLoaderImpl::LoadStyleLink(nsIContent*, nsIURL*,
const nsStrin
g&, const nsString&, int, nsIParser*, int&)+00264
  088234F0    PPC  183AD868  CSSLoaderImpl::LoadSheet(URLKey&, SheetLoadData*)+
00070
 Closing log
Severity: normal → major
Assignee: rhp → ducarroz
Status: ASSIGNED → NEW
I will take a look at it...
Status: NEW → ASSIGNED
Rich, do have have any idea which css file are we espected to get at this point?
Whiteboard: Investigating...
The problem occurs only if the attached web page contains a link to a css file like it's the case for http://
www.mozilla.org/projects/xpcom/Ownership.html. CSSLoaderImpl::DidLoadStyle failed loading the css page because
it try to find it localy. On Mac we crash but on Windows we just get a message in the output window but we don't
crash:

CSSLoaderImpl::DidLoadStyle: Load of URL 'file://c/:temp/<css filename here>' failed. Error code 1

I am still investigating...
Assignee: ducarroz → peterl
Status: ASSIGNED → NEW
Whiteboard: Investigating... → CSS problem
We crash because the loader in nsCSSLoader.cpp is deleted twice. At this point I don't if an ADDREF is missing or if
a RELEASE is called when it should not. Reassign this pug to peterl.
more info:

the loader is first destroyed by the NS_RELEASE at the end of DoneLoadingStyle() and then by NS_IF_RELEASE at the
end of nsDocumentBindInfo::OnStopBinding().
Status: NEW → RESOLVED
Closed: 25 years ago
Resolution: --- → DUPLICATE
As far as I can tell, the loader is getting bad calls from netlib.

*** This bug has been marked as a duplicate of 2537 ***
Status: RESOLVED → VERIFIED
Verified as a duplicate of bug 2537.

Wow ... reading bug 2537, there has been a number of instances of this bug
(duplicate bug 5206, 6757, 2621)
Product: MailNews → Core
Product: Core → MailNews Core
You need to log in before you can comment on or make changes to this bug.