919941 - Two or more trailing spaces in the second line of a multiline subject drops last two characters of the second line.

Status: NEW

(MailNews Core :: Backend, defect)

Description

[YUKI "Piro" Hiroshi]

Attachment: testcase.eml

Steps to reproduce:
1. Receive a mail with "Subject" header like:
------------------------------------------------
Subject: ABC\r\n
 DEF  \r\n <= this line has two trailing spaces.
 GHI\r\n
------------------------------------------------
2. Select the folder which have the mail.
3. See the "Subject" column.

Actual result:
Thunderbird shows "ABC D GHI" as the subject.

Expected result:
Thunderbird shows "ABC DEF GHI" as the subject.

Additional info:
This seems a bug of nsParseMailMessageState::ParseHeaders().
http://mxr.mozilla.org/comm-central/source/mailnews/local/src/nsParseMailbox.cpp#927
This is caused by the logic around "SEARCH_NEWLINE:". I've translated the code to JavaScript and it reproduces same issue:
-------------------------------------------------------
var subject = ('ABC\r\n' +
               ' DEF  \r\n' +
               ' GHI').split('');

var buf = 0;
var buf_end = subject.length;
var writeOffset = 0;

while (true) {
  while (buf <= buf_end && subject[buf] != '\r' && subject[buf] != '\n')
  {
    if (writeOffset)
      subject[buf - writeOffset] = subject[buf];
    buf++;
  }

  if ((buf + 2 < buf_end && (subject[buf+0] == '\r' && subject[buf+1] == '\n') &&
                            (subject[buf+2] == ' ' || subject[buf+2] == '\t')) ||
      (buf + 1 < buf_end && (subject[buf+0] == '\r' || subject[buf+0] == '\n') &&
                            (subject[buf+1] == ' ' || subject[buf+1] == '\t')))
  {
    let foldedSpace = buf;
    while (subject[foldedSpace - 1] == ' ' || subject[foldedSpace - 1] == '\t')
      foldedSpace--;

    subject[foldedSpace - writeOffset] = ' ';
    writeOffset += (buf - foldedSpace);
    buf++;

    while (buf < buf_end &&
            (subject[buf] == '\n' || subject[buf] == '\r' || subject[buf] == ' ' || subject[buf] == '\t'))
    {
      buf++;
      writeOffset++;
    }
    continue;
  }
  break;
}
subject = subject.slice(0, buf_end - writeOffset);
alert(subject.join(''));
-------------------------------------------------------
(This can be run on the scratchpad of Firefox.)

Comment 1

[Jorg K (CEST = GMT+2)]

Is this still an issue? We reworked this code in the meantime.