809504 - Crash in Thunderbird (64-bit) Send to Mail recipient

Status: RESOLVED DUPLICATE of bug 393302

(Thunderbird :: OS Integration, defect)

Description

[Wesley Hardman]

Thunderbird 64-bit crashes (Windows' "Program has stopped working." dialog) when using "Send to" > "Mail recipient" from the windows context menu (right click a file in Windows Explorer).	

Line 336 > if (mNativeCallbackPending && mEventloopNestingLevel == 1)
	
First-chance exception at 0x77c240f2 (ntdll.dll) in thunderbird.exe: 0xC0000374: A heap has been corrupted.
Unhandled exception at 0x77c240f2 (ntdll.dll) in thunderbird.exe: 0xC0000374: A heap has been corrupted.
	
Tested with the latest daily (2012-11-06)

The stack trace below is not from the latest nightly (I can't get a stack trace from it).  The stack trace if from a version I compiled.
	
	ntdll.dll!RtlReportCriticalFailure()  + 0x62 bytes	
 	ntdll.dll!RtlpReportHeapFailure()  + 0x26 bytes	
 	ntdll.dll!RtlpHeapHandleError()  + 0x12 bytes	
 	ntdll.dll!RtlpLogHeapFailure()  + 0xa4 bytes	
 	ntdll.dll!string "Enabling heap debug options\n"()  - 0x19d71 bytes	
 	ole32.dll!CoTaskMemFree(void * pv)  Line 475	C++
 	rpcrt4.dll!NdrpFreeParams()  + 0x1fa bytes	
 	rpcrt4.dll!NdrStubCall2()  + 0x852 bytes	
 	ole32.dll!CStdStubBuffer_Invoke(IRpcStubBuffer * This, tagRPCOLEMESSAGE * prpcmsg, IRpcChannelBuffer * pRpcChannelBuffer)  Line 1559	C++
 	ole32.dll!SyncStubInvoke(tagRPCOLEMESSAGE * pMsg, const _GUID & riid, CIDObject * pID, void * pVtableAddress, IRpcChannelBuffer * pChnl, IRpcStubBuffer * pStub, unsigned long * pdwFault)  Line 1187 + 0x16 bytes	C++
 	ole32.dll!StubInvoke(tagRPCOLEMESSAGE * pMsg, CStdIdentity * pStdID, IRpcStubBuffer * pStub, IRpcChannelBuffer * pChnl, tagIPIDEntry * pIPIDEntry, unsigned long * pdwFault)  Line 1396 + 0x3f bytes	C++
 	ole32.dll!CCtxComChnl::ContextInvoke(tagRPCOLEMESSAGE * pMessage, IRpcStubBuffer * pStub, tagIPIDEntry * pIPIDEntry, unsigned long * pdwFault)  Line 1262 + 0x21 bytes	C++
 	ole32.dll!STAInvoke(tagRPCOLEMESSAGE * pMsg, unsigned long CallCatIn, IRpcStubBuffer * pStub, IInternalChannelBuffer * pChnl, void * pv, tagIPIDEntry * pIPIDEntry, unsigned long * pdwFault)  Line 1923 + 0x51 bytes	C++
 	ole32.dll!AppInvoke(CMessageCall * pCall, CRpcChannelBuffer * pChannel, IRpcStubBuffer * pStub, void * pv, void * pStubBuffer, tagIPIDEntry * pIPIDEntry, LocalThis * pLocalb)  Line 1081 + 0x46 bytes	C++
 	ole32.dll!ComInvokeWithLockAndIPID(CMessageCall * pCall, tagIPIDEntry * pIPIDEntry)  Line 1727	C++
 	ole32.dll!ComInvoke(CMessageCall * pCall)  Line 1469	C++
 	ole32.dll!ThreadDispatch(void * param)  Line 298 + 0x8 bytes	C++
 	ole32.dll!ThreadWndProc(HWND__ * window, unsigned int message, unsigned __int64 wparam, __int64 params)  Line 654	C++
 	user32.dll!UserCallWinProcCheckWow()  + 0x11d bytes	
 	user32.dll!DispatchMessageWorker()  + 0x12a bytes	
>	xul.dll!nsAppShell::ProcessNextNativeEvent(bool mayWait)  Line 333	C++
 	xul.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr, bool mayWait, unsigned int recursionDepth)  Line 298 + 0x23 bytes	C++
 	xul.dll!nsThread::ProcessNextEvent(bool mayWait, bool * result)  Line 589	C++
 	xul.dll!NS_ProcessNextEvent_P(nsIThread * thread, bool mayWait)  Line 217 + 0xe bytes	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate)  Line 117	C++
 	xul.dll!MessageLoop::RunHandler()  Line 202	C++
 	xul.dll!MessageLoop::Run()  Line 176	C++
 	xul.dll!nsBaseAppShell::Run()  Line 165	C++
 	xul.dll!nsAppStartup::Run()  Line 258	C++
 	xul.dll!XREMain::XRE_mainRun()  Line 3805	C++
 	xul.dll!XREMain::XRE_main(int argc, char * * argv, const nsXREAppData * aAppData)  Line 3871 + 0xd bytes	C++
 	xul.dll!XRE_main(int argc, char * * argv, const nsXREAppData * aAppData, unsigned int aFlags)  Line 3947 + 0x12 bytes	C++
 	thunderbird.exe!do_main(const char * exePath, int argc, char * * argv)  Line 112	C++
 	thunderbird.exe!NS_internal_main(int argc, char * * argv)  Line 200 + 0x12 bytes	C++
 	thunderbird.exe!wmain(int argc, wchar_t * * argv)  Line 102	C++
 	thunderbird.exe!__tmainCRTStartup()  Line 552 + 0x19 bytes	C
 	kernel32.dll!BaseThreadInitThunk()  + 0xd bytes	
 	ntdll.dll!RtlUserThreadStart()  + 0x21 bytes

Comment 1

[Makoto Kato [:m_kato]]

not core/widget.  Maybe, MAPI code causes heap corruption, then crash in message loop.

Comment 2

[Wayne Mery (:wsmwk)]

Wesley, does this crash with 32bit thunderbird?

iirc, this is a duplicate

Comment 3

[Wesley Hardman]

(In reply to Wayne Mery (:wsmwk) from comment #2)
> Wesley, does this crash with 32bit thunderbird?

No, this only happens in 64-bit.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Wesley Hardman from comment #3)
> No, this only happens in 64-bit.

OK, I think I found it in https://bugzilla.mozilla.org/buglist.cgi?type1-0-0=substring;list_id=5413055;field0-0-0=short_desc;value0-0-2=64;chfieldfrom=2y;value0-0-1=64bit%2064-bit%20x64%2064;type0-0-0=anywordssubstr;value0-0-0=64bit%2064-bit%20x64%2064;type0-0-2=substring;type0-0-1=anywordssubstr;field0-0-1=status_whiteboard;type1-0-1=substring;value1-0-1=mapi;classification=Client%20Software;classification=Components;chfieldto=Now;query_format=advanced;value1-0-0=mapi;field0-0-2=keywords;field1-0-0=short_desc;product=MailNews%20Core;product=Thunderbird;field1-0-1=longdesc

dupe of bug 393302?  And probably some of the others