Last Comment Bug 687848 - crash in TB when import email from outlook 2007 due to OOM
: crash in TB when import email from outlook 2007 due to OOM
[GS][need message that causes the crash]
: crash, testcase-wanted
Product: MailNews Core
Classification: Components
Component: Import (show other bugs)
: Trunk
: x86 All
: -- critical (vote)
: Thunderbird 11.0
Assigned To: Mike Kaganski
Depends on:
  Show dependency treegraph
Reported: 2011-09-20 08:18 PDT by colin
Modified: 2011-11-17 03:16 PST (History)
7 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---

[bug] MSG that triggers the crash; it cannot be imported from Outlook (108.50 KB, text/plain)
2011-11-08 07:39 PST, Hugues
no flags Details
Fix improper unescape guard; fix double release of an interface (1.72 KB, patch)
2011-11-08 22:22 PST, Mike Kaganski
mozilla: review-
Details | Diff | Splinter Review
Addressing David's comments (1.06 KB, patch)
2011-11-11 21:30 PST, Mike Kaganski
mozilla: review+
Details | Diff | Splinter Review

Description colin 2011-09-20 08:18:58 PDT
User Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.24

Steps to reproduce:

tried again

Actual results:

its crashed again

Expected results:

should have worked
Comment 1 Ludovic Hirlimann [:Usul] 2011-09-20 08:23:22 PDT
Can you give us the crash ID ? (see
Comment 2 Makoto Kato [:m_kato] 2011-09-20 19:02:51 PDT
This is OOM.
Comment 3 Wayne Mery (:wsmwk, NI for questions) 2011-09-21 07:15:07 PDT
0	mozalloc.dll	mozalloc_abort	memory/mozalloc/mozalloc_abort.cpp:78
1	mozalloc.dll	mozalloc_handle_oom	memory/mozalloc/mozalloc_oom.cpp:54
2	mozalloc.dll	moz_xmalloc	memory/mozalloc/mozalloc.cpp:102
3	xul.dll	nsLocalFile::Clone	xpcom/io/nsLocalFileWin.cpp:842
4	xul.dll	nsDirectoryService::Get	xpcom/io/nsDirectoryService.cpp:431
5	xul.dll	nsPrefBranch::GetComplexValue	modules/libpref/src/nsPrefBranch.cpp:310
6	xul.dll	nsMsgIncomingServer::GetFileValue	mailnews/base/util/nsMsgIncomingServer.cpp:474
7	xul.dll	nsMsgIncomingServer::GetLocalPath	mailnews/base/util/nsMsgIncomingServer.cpp:936
8	xul.dll	nsMsgDBFolder::parseURI	mailnews/base/util/nsMsgDBFolder.cpp:3194
9	xul.dll	nsMsgDBFolder::GetFilePath	mailnews/base/util/nsMsgDBFolder.cpp:4668
10	xul.dll	nsMsgDBFolder::GetFolderCacheKey	mailnews/base/util/nsMsgDBFolder.cpp:1282
11	xul.dll	nsMsgDBFolder::ReadDBFolderInfo	mailnews/base/util/nsMsgDBFolder.cpp:650
12	xul.dll	nsMsgDBFolder::SetFlag	mailnews/base/util/nsMsgDBFolder.cpp:4217
13	xul.dll	nsMsgIdentity::setFolderPref	mailnews/base/util/nsMsgIdentity.cpp:421
14	xul.dll	nsMsgIdentity::getFolderPref	mailnews/base/util/nsMsgIdentity.cpp:328
15	xul.dll	nsMsgIdentity::GetFccFolder	mailnews/base/util/nsMsgIdentity.cpp:190
16	xul.dll	GetFolderURIFromUserPrefs	mailnews/compose/src/nsMsgCompUtils.cpp:1994
17	xul.dll	nsMsgComposeAndSend::InitCompositionFields	mailnews/compose/src/nsMsgSend.cpp:2923
18	xul.dll	nsMsgComposeAndSend::Init	mailnews/compose/src/nsMsgSend.cpp:3405
19	xul.dll	nsMsgComposeAndSend::CreateAndSendMessage	mailnews/compose/src/nsMsgSend.cpp:4285
Comment 4 Mike Kaganski 2011-09-22 16:32:01 PDT
Note that the two crash reports:
occur when importing from different sources: the first one is from Outlook Express, while the second is from Outlook.

These may be the same problem in some core module, or two different bugs in the respective import modules.

Anyway, it would be helpful fo get the message that causes the crash. (Personally I could try to asist in tracking this problem in Outlook.) Unfortunately, I cannot suggest any other method but to create a new folder in Outlook, that would be named alphabetically prior to the crashing one, and try to move there some messages until you find the problem mail.

If you will succeed, then please save that mail as .MSG file, and attach it here.

I think that some similar approach could be used to find the offending message in OE.
Comment 5 Wayne Mery (:wsmwk, NI for questions) 2011-09-23 06:50:02 PDT
There are also people importing and crashing with mozalloc_abort(char const* const) | mozalloc_handle_oom() | moz_xmalloc 
with nsLocalFile::nsLocalFileConstructor or something similar in the stack, ref: bug 613439, bug 609039 

for example
bp-3b20798b-9945-4467-b723-7951a2110828 (allan)
Comment 6 Vincent (caméléon) 2011-10-18 06:33:00 PDT
another exemple on Thunderbird 7 and Win7:
I don't know why its crash report is not linked to this bug report...
Comment 7 Wayne Mery (:wsmwk, NI for questions) 2011-11-07 10:47:30 PST
*Note: this crash is #1 outlook issue in getsatisfaction* as far as I can tell

(In reply to caméléon from comment #6)
> another exemple on Thunderbird 7 and Win7:
> 262332111018
> I don't know why its crash report is not linked to this bug report...

This is Hugues' crash reported at and has a different signature mozalloc_abort(char const* const) | mozalloc_handle_oom() | moz_xmalloc | nsLocalFile::nsLocalFileConstructor(nsISupports*, nsID const&, void**)
Comment 8 Hugues 2011-11-08 07:39:32 PST
Created attachment 572809 [details]
[bug] MSG that triggers the crash; it cannot be imported from Outlook

I identified which message caused ThunderBird to crash during import of messages from Outlook. When I deleted this message, all imports went well.
Comment 9 Jorg K (GMT+1) 2011-11-08 08:31:23 PST
Could you please attach the message as MS Outlook .MSG file (or a .ZIP containing the message file).
Comment 10 Mike Kaganski 2011-11-08 13:58:37 PST
(In reply to Jorg K from comment #9)
> Could you please attach the message as MS Outlook .MSG file (or a .ZIP
> containing the message file).

This appears to be a correct .MSG file, but its MIME type chosen improperly (text/plain). When downloaded using some descent download manager, it opens in Outlook correctly, and does cause crash. I am going to try to debug this shortly.
Comment 11 Mike Kaganski 2011-11-08 22:22:38 PST
Created attachment 573094 [details] [diff] [review]
Fix improper unescape guard; fix double release of an interface

Hugues, thank you very much for your sample.
I found the cause of this error. This patch should fix this.
Comment 12 David :Bienvenu 2011-11-10 17:40:08 PST
I don't have access to Outlook 2007, and I didn't crash with Outlook 2010, after dragging the .msf file into Outlook. So I'm at a bit of a loss as to how to verify this fix. Any ideas?

Also, you shouldn't just comment out the tmp file lines. They should simply be removed.  Or, I think it might make more sense to simply null out tmp_file, after releasing it, i.e.,

*tmp_file = 0;

that would prevent the caller from being able to release it, I think.
Comment 13 David :Bienvenu 2011-11-10 17:43:09 PST
sorry, that should read "dragging the .msg file into Outlook 2010"

Perhaps a pst file from Outlook 2007 with the msg(s) would cause the crash w/ Outlook 2010?
Comment 14 Mike Kaganski 2011-11-10 18:50:44 PST
I use Outlook 2010 now, and importing the message from it does cause the crash. (Well, I don't know why, but first time I tried, my TB didn't crash, too, but after restarting both Outlook and TB, the crash on my system is guaranteed.)

I'll post updated patch when I'll be at development PC. I think that the second option is more correct and clear.
Comment 15 David :Bienvenu 2011-11-10 20:02:06 PST
My 8.0 shipping build does crash in import, but my trunk debug build doesn't. I'll see if a trunk release build crashes...
Comment 16 David :Bienvenu 2011-11-11 08:14:54 PST
Comment on attachment 573094 [details] [diff] [review]
Fix improper unescape guard; fix double release of an interface

minusing while a new patch addressing comments is prepared.

The Check() change looks OK to me, even if I can't recreate the crash in a version I build...
Comment 17 Mike Kaganski 2011-11-11 21:30:29 PST
Created attachment 574000 [details] [diff] [review]
Addressing David's comments
Comment 18 David :Bienvenu 2011-11-12 07:20:53 PST
Comment on attachment 574000 [details] [diff] [review]
Addressing David's comments

thx, Mike.
Comment 19 Mark Banner (:standard8, afk until Dec) 2011-11-17 03:16:01 PST
Checked in:

Note You need to log in before you can comment on or make changes to this bug.