70505 - App crashes when attempting to compose a message

Reporter

Description

•

24 years ago

Download the 2001-02-28-08-Mtrunk linux nightly tarball.  Run mailnews, click on
any post, and click 'Reply To Newsgroup'.  It flashes the compose window right
before the app crashes.  This is on a fairly stock RH6.2+updates box.

Bah.  Of course, as I try this in a local debug build, it doesn't crash.  A
local opt build does crash.  Here's the trace:


(gdb) bt
#0  0x4125984f in MimeInlineText_rotate_convert_and_parse_line ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#1  0x4125d95f in convert_and_send_buffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#2  0x4125dacd in mime_LineBuffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#3  0x4125973e in MimeInlineText_parse_decoded_buffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#4  0x41253663 in MimeLeaf_parse_buffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#5  0x4125ceb6 in MimeUntypedText_parse_line ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#6  0x4125d95f in convert_and_send_buffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#7  0x4125dacd in mime_LineBuffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#8  0x412582f3 in MimeObject_parse_buffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#9  0x4125591a in MimeMessage_parse_line ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#10 0x4125d95f in convert_and_send_buffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#11 0x4125dacd in mime_LineBuffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
---Type <return> to continue, or q <return> to quit---
#12 0x412582f3 in MimeObject_parse_buffer ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#13 0x4125f6aa in mime_display_stream_write ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#14 0x41269962 in nsStreamConverter::OnDataAvailable ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmime.so
#15 0x4104e580 in ?? ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmsgnews.so
#16 0x4104e801 in ?? ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmsgnews.so
#17 0x41055175 in ?? ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libmsgnews.so
#18 0x4101baa5 in ?? ()
   from /usr/cls/moz/main/obj-opt/dist/bin/libmsgbaseutil.so
#19 0x4084712e in nsOnDataAvailableEvent::HandleEvent ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libnecko.so
#20 0x40846422 in nsStreamObserverEvent::HandlePLEvent ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libnecko.so
#21 0x400c3129 in PL_HandleEvent ()
   from /usr/cls/moz/main/obj-opt/dist/bin/libxpcom.so
#22 0x400c3039 in PL_ProcessPendingEvents ()
   from /usr/cls/moz/main/obj-opt/dist/bin/libxpcom.so
#23 0x400c3f7b in nsEventQueueImpl::ProcessPendingEvents ()
   from /usr/cls/moz/main/obj-opt/dist/bin/libxpcom.so
#24 0x404e9df9 in event_processor_callback ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libwidget_gtk.so
#25 0x404e9b86 in our_gdk_io_invoke ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libwidget_gtk.so
#26 0x40683aca in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0
#27 0x40685186 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#28 0x40685751 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#29 0x406858f1 in g_main_run () from /usr/lib/libglib-1.2.so.0
#30 0x405ad5b9 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#31 0x404ea38a in nsAppShell::Run ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libwidget_gtk.so
#32 0x40388340 in nsAppShellService::Run ()
   from /usr/cls/moz/main/obj-opt/dist/bin/components/libnsappshell.so
#33 0x804e282 in main1 ()
#34 0x804ec1c in main ()
#35 0x4024f9cb in ?? () from /lib/libc.so.6

Jean-Francois Ducarroz

Comment 1

•

24 years ago

jgmyers, any idea?

cls

Reporter

Updated

•

24 years ago

Keywords: crash, smoketest

cls

Reporter

Comment 2

•

24 years ago

After multiple attempt at recreating the bug on a debug build, it finally
crashed.  Here's the trace with line numbers:

#0  0x426f1aca in MimeInlineText_rotate_convert_and_parse_line (
    line=0x9d92b08 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", length=75, obj=0x92cb9d8)
    at ../../../../mozilla/mailnews/mime/src/mimetext.cpp:332
#1  0x426f7144 in convert_and_send_buffer (
    buf=0x9d92b08 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", length=75, convert_newlines_p=1, 
    per_line_fn=0x426f1938 <MimeInlineText_rotate_convert_and_parse_line(char *,
int, MimeObject *)>, closure=0x92cb9d8)
    at ../../../../mozilla/mailnews/mime/src/mimebuf.cpp:168
#2  0x426f7393 in mime_LineBuffer (
    net_buffer=0x9d91698 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", net_buffer_size=75, bufferP=0x92cba00, 
    buffer_sizeP=0x92cba08, buffer_fpP=0x92cba10, convert_newlines_p=1, 
    per_line_fn=0x426f1938 <MimeInlineText_rotate_convert_and_parse_line(char *,
int, MimeObject *)>, closure=0x92cb9d8)
    at ../../../../mozilla/mailnews/mime/src/mimebuf.cpp:255
#3  0x426f1921 in MimeInlineText_parse_decoded_buffer (
    buf=0x9d91698 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", size=75, obj=0x92cb9d8)
    at ../../../../mozilla/mailnews/mime/src/mimetext.cpp:271
#4  0x426e819a in MimeLeaf_parse_buffer (
    buffer=0x9d91698 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", size=75, obj=0x92cb9d8)
    at ../../../../mozilla/mailnews/mime/src/mimeleaf.cpp:153
#5  0x426f6124 in MimeUntypedText_parse_line (
    line=0x9d91698 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", length=75, obj=0x9d7daf8)
    at ../../../../mozilla/mailnews/mime/src/mimeunty.cpp:177
#6  0x426f7144 in convert_and_send_buffer (
    buf=0x9d91698 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", length=75, convert_newlines_p=1, 
    per_line_fn=0x426f5e28 <MimeUntypedText_parse_line(char *, int, MimeObject
*)>, closure=0x9d7daf8) at ../../../../mozilla/mailnews/mime/src/mimebuf.cpp:168
#7  0x426f7393 in mime_LineBuffer (
    net_buffer=0x9d91290 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", net_buffer_size=75, bufferP=0x9d7db20, 
    buffer_sizeP=0x9d7db28, buffer_fpP=0x9d7db30, convert_newlines_p=1, 
    per_line_fn=0x426f5e28 <MimeUntypedText_parse_line(char *, int, MimeObject
*)>, closure=0x9d7daf8) at ../../../../mozilla/mailnews/mime/src/mimebuf.cpp:255
#8  0x426efba1 in MimeObject_parse_buffer (
    buffer=0x9d91290 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", size=75, obj=0x9d7daf8)
    at ../../../../mozilla/mailnews/mime/src/mimeobj.cpp:255
#9  0x426eb58f in MimeMessage_parse_line (
    line=0x9d91290 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", length=75, obj=0x9bb6500)
    at ../../../../mozilla/mailnews/mime/src/mimemsg.cpp:210
#10 0x426f7144 in convert_and_send_buffer (
    buf=0x9d91290 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n", length=75, convert_newlines_p=1, 
    per_line_fn=0x426eb2b8 <MimeMessage_parse_line(char *, int, MimeObject *)>,
closure=0x9bb6500) at ../../../../mozilla/mailnews/mime/src/mimebuf.cpp:168
#11 0x426f7393 in mime_LineBuffer (
    net_buffer=0x9d8f9b0 "On Tue, 27 Feb 2001 10:00:23 -0800, rsnavale
<rsnavale@hotmail.com> wrote:\n>Thanks for posting the \"Writing A Mozilla
Protocol Handler\" doc on\n>mozilla site.\n\nNote that this is out of date -
there wer"..., 
    net_buffer_size=455, bufferP=0x9bb6528, buffer_sizeP=0x9bb6530, 
    buffer_fpP=0x9bb6538, convert_newlines_p=1, 
    per_line_fn=0x426eb2b8 <MimeMessage_parse_line(char *, int, MimeObject *)>,
closure=0x9bb6500) at ../../../../mozilla/mailnews/mime/src/mimebuf.cpp:255
#12 0x426efba1 in MimeObject_parse_buffer (
    buffer=0x9d8f7e0 "Path: secnews.netscape.com!bbaetz\nFrom:
bbaetz@cs.mcgill.ca (Bradley Baetz)\nNewsgroups:
netscape.public.mozilla.netlib\nSubject: Re: protocol handler, finger\nDate: 28
Feb 2001 00:24:25 GMT\nOrganization"..., 
    size=919, obj=0x9bb6500)
    at ../../../../mozilla/mailnews/mime/src/mimeobj.cpp:255
#13 0x426f977d in mime_display_stream_write (stream=0x9d10fc0, 
    buf=0x9d8f7e0 "Path: secnews.netscape.com!bbaetz\nFrom: bbaetz@cs.mcgill.ca
(Bradley Baetz)\nNewsgroups: netscape.public.mozilla.netlib\nSubject: Re:
protocol handler, finger\nDate: 28 Feb 2001 00:24:25 GMT\nOrganization"...,
size=919)
    at ../../../../mozilla/mailnews/mime/src/mimemoz2.cpp:906
#14 0x427078d1 in nsStreamConverter::OnDataAvailable (this=0x92f0070, 
    request=0x969a56c, ctxt=0x9c230a0, aIStream=0x9c75cb0, sourceOffset=0, 
    aLength=919)
    at ../../../../mozilla/mailnews/mime/src/nsStreamConverter.cpp:877
#15 0x4201df98 in nsNNTPProtocol::DisplayArticle (this=0x969a560, 
    inputStream=0x86879e0, length=999)
    at ../../../../mozilla/mailnews/news/src/nsNNTPProtocol.cpp:2446
#16 0x4201e479 in nsNNTPProtocol::ReadArticle (this=0x969a560, 
    inputStream=0x86879e0, length=999)
    at ../../../../mozilla/mailnews/news/src/nsNNTPProtocol.cpp:2516
#17 0x420287b4 in nsNNTPProtocol::ProcessProtocolState (this=0x969a560, 
    url=0x9232b04, inputStream=0x86879e0, sourceOffset=12632, length=999)
    at ../../../../mozilla/mailnews/news/src/nsNNTPProtocol.cpp:5129
#18 0x420ea865 in nsMsgProtocol::OnDataAvailable (this=0x969a568, 
    request=0x969cc88, ctxt=0x9232b00, inStr=0x86879e0, sourceOffset=12632, 
    count=999) at ../../../../mozilla/mailnews/base/util/nsMsgProtocol.cpp:218
#19 0x40d123f5 in nsOnDataAvailableEvent::HandleEvent (this=0x42a01200)
    at ../../../../mozilla/netwerk/base/src/nsStreamListenerProxy.cpp:161
#20 0x40d110ef in nsStreamObserverEvent::HandlePLEvent (aEvent=0x42a01200)
    at ../../../../mozilla/netwerk/base/src/nsStreamObserverProxy.cpp:78
#21 0x4012fd71 in PL_HandleEvent (self=0x42a01200)
    at ../../../mozilla/xpcom/threads/plevent.c:576
#22 0x4012fb60 in PL_ProcessPendingEvents (self=0x80b2b68)
    at ../../../mozilla/xpcom/threads/plevent.c:509
#23 0x40131c6c in nsEventQueueImpl::ProcessPendingEvents (this=0x80b2b40)
    at ../../../mozilla/xpcom/threads/nsEventQueue.cpp:361
#24 0x407fce53 in event_processor_callback (data=0x80b2b40, source=8, 
    condition=GDK_INPUT_READ)
    at ../../../../mozilla/widget/src/gtk/nsAppShell.cpp:158
#25 0x407fca55 in our_gdk_io_invoke (source=0x8204fa0, condition=G_IO_IN, 
    data=0x821b2b0) at ../../../../mozilla/widget/src/gtk/nsAppShell.cpp:58
#26 0x409ccaca in ?? () from /usr/lib/libglib-1.2.so.0
#27 0x409ce186 in ?? () from /usr/lib/libglib-1.2.so.0
#28 0x409ce751 in ?? () from /usr/lib/libglib-1.2.so.0
#29 0x409ce8f1 in ?? () from /usr/lib/libglib-1.2.so.0
#30 0x408f65b9 in ?? () from /usr/lib/libgtk-1.2.so.0
#31 0x407fd5c5 in nsAppShell::Run (this=0x80ba0d0)
    at ../../../../mozilla/widget/src/gtk/nsAppShell.cpp:350
#32 0x405cd0be in ?? ()
   from /usr/cls/moz/main/obj/dist/bin/components/libnsappshell.so
#33 0x8057326 in main1 (argc=1, argv=0xbffff804, nativeApp=0x0)
    at ../../../mozilla/xpfe/bootstrap/nsAppRunner.cpp:1004
#34 0x8058131 in main (argc=1, argv=0xbffff804)
    at ../../../mozilla/xpfe/bootstrap/nsAppRunner.cpp:1295

cls

Reporter

Comment 3

•

24 years ago

Attached patch Proposed fix — Details — Splinter Review

John G. Myers

Assignee

Comment 4

•

24 years ago

Either obj is null, obj->options is null, or obj->options->override_charset is 
PR_TRUE at the same time obj->options->default_charset is NULL.  The latter case 
is never supposed to happen.

Ok to check in the proposed workaround, but please don't close the bug.

Jean-Francois Ducarroz

Comment 5

•

24 years ago

thanks for taking care so quickly of that cls. Reassign to jgmyers

Assignee: ducarroz → jgmyers

John G. Myers

Assignee

Comment 6

•

24 years ago

Filed bug 70513 to investigate the underlying cause of the problem.
r=jgmyers on the workaround.  Will close this bug once I get the workaround 
super-reviewed and landed.

cls

Reporter

Comment 7

•

24 years ago

Oops.  Sorry, got an approval from leaf and checked in the fix based upon your
previous comment.

Status: NEW → RESOLVED

Closed: 24 years ago

Resolution: --- → FIXED

J.J. Enser

Comment 8

•

24 years ago

*** Bug 70500 has been marked as a duplicate of this bug. ***

John G. Myers

Assignee

Comment 9

•

24 years ago

cls: That's even better.  Thanks.

Tracy Walker [:tracy]

Comment 10

•

24 years ago

verified fixed linux commercial build 2001-03-01-05-mtrunk

Status: RESOLVED → VERIFIED

Myk Melez [:myk] [@mykmelez]

Updated

•

20 years ago

Product: MailNews → Core

Nobody; OK to take it and work on it

Updated

•

16 years ago

Product: Core → MailNews Core

Bugzilla

Quick Search

App crashes when attempting to compose a message

Categories

(MailNews Core :: Composition, defect)

Tracking

(Not tracked)

People

(Reporter: cls, Assigned: jgmyers)

References

Details

(Keywords: crash, smoketest)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Comment 1

Updated

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Comment 8

Comment 9

Comment 10

Updated

Updated

Attachment

General

Description

File Name

Content Type