85097 - Crash when shutting down - nsMsgComposeAndSend is alive after mailsession is freed

Status: VERIFIED DUPLICATE of bug 84544

(MailNews Core :: Composition, defect)

Description

[Håkan Waara]

nsMsgComposeAndSend::GetDefaultPrompt(nsMsgComposeAndSend * const 0x056c0b40, 
nsIPrompt * * 0x006efa40) line 227 + 38 bytes
nsMsgComposeAndSend::NotifyListenerOnStopCopy(nsMsgComposeAndSend * const 
0x056c0b40, unsigned int 2147549183) line 3281 + 36 bytes
nsMsgComposeAndSend::DoFcc() line 3161
nsMsgComposeAndSend::DoDeliveryExitProcessing(nsIURI * 0x056c13f4, unsigned int 
0, int 0) line 3092 + 8 bytes
nsMsgComposeAndSend::DeliverAsNewsExit(nsMsgComposeAndSend * const 0x056c0b40, 
nsIURI * 0x056c13f4, unsigned int 0) line 3119
SendDeliveryCallback(nsIURI * 0x056c13f4, unsigned int 0, nsMsgDeliveryType 
nsNewsDelivery, nsISupports * 0x056c0b40) line 2702
nsMsgDeliveryListener::OnStopRunningUrl(nsMsgDeliveryListener * const 
0x056c1a60, nsIURI * 0x056c13f4, unsigned int 0) line 81 + 33 bytes
nsUrlListenerManager::BroadcastChange(nsIURI * 0x056c13f4, nsUrlNotifyType 
nsUrlNotifyStopRunning, unsigned int 0) line 97
nsUrlListenerManager::OnStopRunningUrl(nsUrlListenerManager * const 0x056c1e20, 
nsIMsgMailNewsUrl * 0x056c13f4, unsigned int 0) line 110 + 18 bytes
nsMsgMailNewsUrl::SetUrlState(nsMsgMailNewsUrl * const 0x056c13f4, int 0, 
unsigned int 0) line 114
nsNNTPProtocol::CleanupAfterRunningUrl() line 5357
nsNNTPProtocol::CloseSocket() line 5395
nsNNTPProtocol::OnStopRequest(nsNNTPProtocol * const 0x04ba34fc, nsIRequest * 
0x04ba4a60, nsISupports * 0x04ba3a00, unsigned int 2152398850) line 1164
nsOnStopRequestEvent::HandleEvent() line 161
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x04ad8234) line 64
PL_HandleEvent(PLEvent * 0x04ad8234) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00d608f0) line 520 + 9 bytes
nsEventQueueImpl::ProcessPendingEvents(nsEventQueueImpl * const 0x00d609c0) 
line 374 + 12 bytes
nsEventQueueImpl::ProcessPendingEvents(nsEventQueueImpl * const 0x03b08630) 
line 381
nsEventQueueImpl::ProcessPendingEvents(nsEventQueueImpl * const 0x054560d0) 
line 381
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 480
main(int 1, char * * 0x00a24ce0) line 1434 + 8 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! bff8b560()
KERNEL32! bff8b412()
KERNEL32! bff89dd5()

I had closed all browser windows, and all mail windows except one - the 
msgcompose window which was in the process of being sent. Now, when I closed 
that the whole program tried to shut down.

However, just as it had shut down the nsMsgComposeAndSend object did something 
strange and crashed.

It tried to use the mailsession, but the mailsession was already freed (all the 
windows was closed) so the nsMsgComposeAndSend object was alone. It tried to 
dereference the mailsession, which was null and I crashed.

There are two solutions to this problem:

1. We let the mailsession take down the nsMsgComposeAndSend object(s) upon 
destruction. Since this service is always alive, I think that's a good solution.
2. We nullcheck where I crashed to prevent others from crashing.

Comment 1

[Håkan Waara]

keywords

Comment 2

[scottputterman]

dup of 84544

*** This bug has been marked as a duplicate of 84544 ***

Comment 3

[Håkan Waara]

verified dup.