858035 - TB crashes, then hangs, when click a mailto: link in the mail

Status: RESOLVED WORKSFORME

(Thunderbird :: Untriaged, defect)

Description

[Lu Wei]

Attachment: SEMI PV Daily News 04_01_13.eml

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:20.0) Gecko/20100101 Firefox/20.0
Build ID: 20130326150557

Steps to reproduce:

click a mailto: link in the mail, as showed in the screen captured attachment, the link circled by the read ellipse.


Actual results:

TB quits without any message


Expected results:

TB should open a new mail

Comment 2

[Lu Wei]

Attachment: captured screen

captured screen

Comment 3

[Lu Wei]

Sorry to have created bug 858037 by mistake. Can I just delete it?

Comment 4

[:aceman]

Can you copy the link target (the URL address) to Firefox and see if it works fine?

Comment 5

[Lu Wei]

Yes, the link can be opened through Firefox, in fact it can be opened through TB too -- the link "mailto:[e-mail]?subject=退订" in a new test mail can be opened correctly. So the problem seems in that particular mail. Please open that eml attachment and see if you can click that link.

Comment 6

[Lu Wei]

I may found the cause. I should have checked it first -- in safe mode TB do not quit, opens a new draft message window correctly, but a new tab is opened too in the background, showing "loading" but blank. This makes me suspect some URL handling, and yes, after disabling foxyproxy (an addon for auto-switching proxy for different URL patterns), the problem do not occur. But I think foxyproxy is not the only culprit -- what is that blank tab in the back? Does TB treat that link as http?

Comment 7

[Georg Koppen]

While it is true that FoxyProxy can't handle links in Thunderbird properly at the moment (that is a bug) it is not responsible for the issue at hand. I can reproduce the problem without FoxyProxy being installed if I click twice on the link in question. gdb says that Thunderbird closed normally, though. I tested with the latest stable version (17.0.5).

Comment 8

[Lu Wei]

You are right, but TB 17.0.5 behaves a little different here. In safe mode, clicking the link once will not crash TB, except that strange blank "loading" tab. Then clicking the link twice will make that blank tab more blank -- the title "loading" disappeared. Then clicking the link the third time will crash TB. 

And, if that "loading" tab is closed before every click, TB will not crash.

When Foxyproxy is enabled, things are a little different. I noticed a exception notification by Foxyproxy appeared, stating something like determining host, and draft window opened like in safe mode; but TB crashes when click the link twice. And after restarting TB, the notification do not appear again -- TB crashes at first click.

Comment 9

[Lu Wei]

TB 24.0beta3 safe mode still has this problem. Click twice 退订 will crash TB.

Comment 10

[Wayne Mery (:wsmwk)]

Please get a stacktrace using instructions https://developer.mozilla.org/en/how_to_get_a_stacktrace_with_windbg and attach the file to this bug. Where you see "Firefox" substitute "Thunderbird"

Comment 11

[Lu Wei]

Attachment: thunderbird-debug_5138_2013-09-16_09-13-56-640.log

I managed to get through this lengthy process (hardly believe a normal non-tech user can do this). What I did was exactly following the instructions on the page. Run parameter is thunderbird.exe -safe-mode. After opening, I noticed a series of error message in Windbg just as have noticed before in another Bug 772420, so I checked error console. Then I opened the eml file attached, clicked "退订" link, the log file line 211 starts, clicked the link again, TB crash. 
I also created a minidump file as instructed, but it is very big (115MB). If it is also needed I can upload it to the place you specify.

Comment 12

[Lu Wei]

sorry, "log file line 211" should be "log file line 210"

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to Georg Koppen from comment #7)
> While it is true that FoxyProxy can't handle links in Thunderbird properly
> at the moment (that is a bug) it is not responsible for the issue at hand. I
> can reproduce the problem without FoxyProxy being installed if I click twice
> on the link in question. gdb says that Thunderbird closed normally, though.
> I tested with the latest stable version (17.0.5).

Are you able to reproduce with both current version 24 and newer beta http://www.mozilla.org/en-US/thunderbird/channel/ ?

Comment 14

[Lu Wei]

(In reply to Wayne Mery (:wsmwk) from comment #13)
> (In reply to Georg Koppen from comment #7)
> > While it is true that FoxyProxy can't handle links in Thunderbird properly
> > at the moment (that is a bug) it is not responsible for the issue at hand. I
> > can reproduce the problem without FoxyProxy being installed if I click twice
> > on the link in question. gdb says that Thunderbird closed normally, though.
> > I tested with the latest stable version (17.0.5).
> 
> Are you able to reproduce with both current version 24 and newer beta
> http://www.mozilla.org/en-US/thunderbird/channel/ ?

With current version 24.5.0, Yes: 
start TB in safe mode, input master password, open error console, there are two errors already:

Could not read chrome manifest 'file:///C:/Program%20Files/Mozilla%20Thunderbird/chrome.manifest'.
While creating services from category 'profile-after-change', could not create service for entry 'Disk Space Watcher Service', contract ID '@mozilla.org/toolkit/disk-space-watcher;1' 

then open that eml file, click that "退订" link, one error message appeared in the error console:

No chrome package registered for chrome://navigator/content/navigator.xul

click it again, the same message appeared again;
click it the third time, TB crashed.

Do you need me download a beta copy and try again?

Comment 15

[Wayne Mery (:wsmwk)]

yes, please try beta

> Could not read chrome manifest 'file:///C:/Program%20Files/Mozilla%20Thunderbird/chrome.manifest'.

this can be ignored. but, also I think it should go away by using the beta

Comment 16

[Lu Wei]

With current beta 30.0b1:
start TB in safe mode, input master password, open error console, there are two errors already, the second being different from the release version:

Could not read chrome manifest 'file:///C:/Program%20Files/Mozilla%20Thunderbird/chrome.manifest'.

Timestamp: 2014-5-26 10:46:38
Warning: mutating the [[Prototype]] of an object will cause your code to run very slowly; instead create the object with the correct initial [[Prototype]] value using Object.create
Source File: resource://gre/components/steelApplication.js
Line: 783

then open that eml file, click that "退订" link, the same error message appeared in the error console:

No chrome package registered for chrome://navigator/content/navigator.xul

click it again, the same message appeared again;
click it the third time, TB crashed.

Comment 17

[Georg Koppen]

Seems it is still reproducible which means no need for me trying to reproduce the problem, too, at the moment...

Comment 18

[:aceman]

I tried the email in TB32 on Win XP. I got NO crash. I can confirm the link opens the empty tab and a proper compose window with the recipient and subject filled in fine (as far as I can visually distinguish Chinese chars). I suspect the blank tab is created due to the target=_blank attribute on the link. Maybe TB should just ignore that one for mailto: links. There is another link in the email that does not have target and behaves normally. I have clicked the link in question 10 times in a row (always closing the compose window) and got NO crash.

So we would really need your crash id: https://support.mozillamessaging.com/en-US/kb/Mozilla-Crash-Reporter#w_viewing-crash-reports

Comment 19

[Lu Wei]

(In reply to :aceman from comment #18)
> I tried the email in TB32 on Win XP. I got NO crash. I can confirm the link
> opens the empty tab and a proper compose window with the recipient and
> subject filled in fine (as far as I can visually distinguish Chinese chars).
> I suspect the blank tab is created due to the target=_blank attribute on the
> link. Maybe TB should just ignore that one for mailto: links. There is
> another link in the email that does not have target and behaves normally. I
> have clicked the link in question 10 times in a row (always closing the
> compose window) and got NO crash.

The link do not open a empty tab here. And thanks for your hint, I did a experiment. I opened that eml file with notepad++, deleted target="_blank" in line 1074, saved and open it with TB again, and TB does not crash anymore. So could the problem be located?
> 
> So we would really need your crash id:
> https://support.mozillamessaging.com/en-US/kb/Mozilla-Crash-
> Reporter#w_viewing-crash-reports

TB does not create a crash ID. I have created a stacktrace before in attachment.

Comment 20

[Wayne Mery (:wsmwk)]

please try a current version and attach a new stacktrace using 
~* kp;!analyze -v -f;lm

ref: https://developer.mozilla.org/en-US/docs/How_to_get_a_stacktrace_with_WinDbg

Comment 21

[Lu Wei]

Attachment: thunderbird-debug_0b38_2015-02-27_22-26-05-328.log

TB31.5，-safe-mode, first click the link, line 177 of the log begins, second click, TB crash.

Comment 22

[Wayne Mery (:wsmwk)]

Thanks for the stack. Before we pass this to the next step, do you also see the problem with 38 beta from http://www.mozilla.org/en-US/thunderbird/channel/ ?

Comment 23

[Lu Wei]

Tested TB38beta, TB still crashes (window disappear). The following results are reproducible:

Safe mode, click the link " <a href="mailto:[e-mail]?subject=退订" target="_blank">退订</a> " for the first time:
A new mail window opens, a blank tab created in the TB with the title "loading...", which seems normal.  
Click the link for the second time，the new mail window remains, and the blank tab's title becomes blank.
Click the link for the third time, All TB window disappear, thunderbird.exe process remains in the task manager list and can only be killed.

If the new mail window and the blank tab is closed before clicking the second time, then everything is OK. 

If only the new mail window is closed before clicking the second time, then TB will disappear at the second click.

If only the blank tab is closed before clicking the second time, then a second new mail window will open and a new blank tab is created. Close the new blank tab and click the third time, and doing so on will be OK too.

Hope these permutations give some clue.

Comment 24

[Wayne Mery (:wsmwk)]

Odd. It would be nice to get a mozilla crash report.
I am unable to reproduce the crash using currently nightly build on windows 7 pro.

Are you still running on XP, and still see this crash?

Comment 25

[Lu Wei]

(In reply to Wayne Mery (:wsmwk, use Needinfo for questions) from comment #24)
> Odd. It would be nice to get a mozilla crash report.
> I am unable to reproduce the crash using currently nightly build on windows
> 7 pro.
> 
> Are you still running on XP, and still see this crash?

Yes. WindowsXPSP3, TB 38.5.1.

Open the eml file, click the link, TB crashes immediately.

Start TB in safe mode. The initial error console:

Could not read chrome manifest 'file:///C:/Program%20Files/Mozilla%20Thunderbird/chrome.manifest'.

/* lots of line 2790 errors, reported in another bug 772420:
Timestamp: 2016-1-21 9:21:35
Error: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIMsgFolder.getStringProperty]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://messenger/content/folderPane.js :: getSmartFolderName :: line 2790"  data: no]
Source File: chrome://messenger/content/folderPane.js
Line: 2792

Timestamp: 2016-1-21 9:16:41
Error: [Exception... "Component returned failure code: 0x80070057 (NS_ERROR_ILLEGAL_VALUE) [nsIMsgFolder.getStringProperty]"  nsresult: "0x80070057 (NS_ERROR_ILLEGAL_VALUE)"  location: "JS frame :: chrome://messenger/content/folderPane.js :: getSmartFolderName :: line 2790"  data: no]
Source File: chrome://messenger/content/folderPane.js
Line: 2792
*/

Timestamp: 2016-1-21 9:17:19
Error: path is null
Source File: resource://gre/modules/osfile/ospath_win.jsm
Line: 220

Then open the eml file, click the link:

Timestamp: 2016-1-21 9:18:24
Error: TypeError: tabmail is null
Source File: chrome://messenger/content/mailWindow.js
Line: 582
No chrome package registered for chrome://navigator/content/navigator.xul
No chrome package registered for chrome://navigator/content/navigator.xul

Click the link again, the three errors reproduce;

Click the link the 3rd time, TB crashes.

All crashes leave a process in the process list, and could killed by task manager.

Comment 26

[Lu Wei]

When "Open the eml file, click the link, TB crashes immediately." I mean open eml file without TB already running.

Comment 27

[Wayne Mery (:wsmwk)]

It seems unlikely that what I encountered is the same issue ... but some considerable time after I was testing this bug, I hit Bug 1241069 - Thunderbird shut down unexpectedly (crash?) then hung

Comment 28

[Wayne Mery (:wsmwk)]

Reproduce using steps of comment 0 - hang on second click - using version 45 in newish profile. It hangs with zero CPU, does not crash.
JavaScript Error: "TypeError: tabmail is null" {file: "chrome://messenger/content/mailWindow.js" line: 591}]
nsBrowserAccess.prototype.openURI@chrome://messenger/content/mailWindow.js:591:9

No chrome package registered for chrome://navigator/content/navigator.xul
No chrome package registered for chrome://navigator/content/navigator.xul
[JavaScript Error: ": Component returned failure code: 0x8046001e [nsIWindowWatcher.openWindow]" {file: "resource://gre/components/nsMailDefaultHandler.js" line: 344}]
[JavaScript Error: ": Component returned failure code: 0x8046001e [nsIWindowWatcher.openWindow]" {file: "resource://gre/components/nsMailDefaultHandler.js" line: 344}]


Not able to repproduce using version 50 nightly and new profile :(   But I see
No chrome package registered for chrome://navigator/content/navigator.xul
No chrome package registered for chrome://navigator/content/navigator.xul
[JavaScript Error: "TypeError: tabmail is null" {file: "chrome://messenger/content/mailWindow.js" line: 590}]
nsBrowserAccess.prototype.openURI@chrome://messenger/content/mailWindow.js:590:9

Comment 29

[Wayne Mery (:wsmwk)]

Attachment: TB windbg stacktrace bug 858035.txt

(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #28)
> Reproduce using steps of comment 0 - hang on second click - using version 45
> in newish profile. It hangs with zero CPU, does not crash.
>

hang at mozilla::widget::WinUtils::WaitForMessage

mailto:[e-mail]?subject=%E9%80%80%E8%AE%A2

I tried many times to reproduce with version 50 and none fail.

Comment 30

[Wayne Mery (:wsmwk)]

Can you reproduce with nightly code?
https://archive.mozilla.org/pub/thunderbird/nightly/latest-comm-central/

Comment 32

[Lu Wei]

(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #30)
> Can you reproduce with nightly code?
> https://archive.mozilla.org/pub/thunderbird/nightly/latest-comm-central/

I download thunderbird-50.0a1.en-US.win32.zip to test. Yes, this time clicking the link does not crash TB, but leaves error message:

TypeError: tabmail is null[Learn More]			mailWindow.js:590:9
nsBrowserAccess.prototype.openURI 		      chrome://messenger/content/mailWindow.js:590:9
No chrome package registered for chrome://navigator/content/navigator.xul

So have this bug been fixed quietly?

Comment 33

[Wayne Mery (:wsmwk)]

> So have this bug been fixed quietly?

We can hope! :)