97246 - Mozilla Mail crashes when trying to delete corrupted (?) mails [@ nsMailboxProtocol::OnStopRequest]

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Gabriel Seah]

I got a HTML mail from a Yahoo Groups group and it was empty. Viewing the
source, I saw that the content was somehow not visible. After I extracted the
content of the mail, I tried to delete it and Mozilla Mail crashed. I restarted,
tried moving it and it crashed again. Trying a third time to manipulate the
mail, I caused Mozilla to crash yet again.

I've had this problem once before (also with HTML mail) but dismissed it as an
anomaly. However, the problem has cropped up again...

Comment 1

[Gabriel Seah]

Attachment: Source of the problem mail in question

Comment 2

[Håkan Waara]

Gabriel, can you send this exact email to me?

Comment 3

[Håkan Waara]

Stack is:

nsMailboxProtocol::OnStopRequest(nsMailboxProtocol * const 0x03ce2380,
nsIRequest * 0x03ce5b54, nsISupports * 0x03ce7a70, unsigned int 0) line 269 + 21
bytes
nsOnStopRequestEvent::HandleEvent() line 162
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x03cd0a74) line 65
PL_HandleEvent(PLEvent * 0x03cd0a74) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00d628f0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00000ef4, unsigned int 55322, unsigned int 0,
long 14035184) line 1071 + 9 bytes
KERNEL32! bff7363b()
KERNEL32! bff94407()
006e89da()


I'm investigating now.

Comment 4

[Håkan Waara]

*** Bug 97308 has been marked as a duplicate of this bug. ***

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The duplicate bug explains which variable is null.

Comment 6

[Scott MacGregor]

re-assigning to naving. 

Comment 7

[Navin Gupta]

I am not crashing when i delete this problem email using build 08-28-03 on
winNT. I will continue investigating.. 

Comment 8

[Navin Gupta]

Attachment: check for null

Comment 9

[Håkan Waara]

I debugged this, and am a little worried naving's null-fix will cause the msg to
not be moved let alone deleted to the trash since it makes us skip that code.

Just a thought...

Comment 10

[Navin Gupta]

I am not crashing. Moreover, m_runningUrl should be checked for null as it 
is done before this if statement. 

Comment 11

[Navin Gupta]

hwaara, if m_runningUrl is null, you can't do much because we get all the 
info moveIndex, numMoves etc from m_runningUrl. Please look at the code more 
closely.  

Comment 12

[Håkan Waara]

> Please look at the code more closely. 

I did... thanks. :(

Comment 13

[Scott MacGregor]

Naving, do we know why m_runningUrl is suddenly coming up null in this routine?
I wonder what changed to have introduced this scenario.

Comment 14

[Navin Gupta]

Well, I have seen the talkback reports with the same stack from the beginning of 
this month. I'm not sure what is causing this because I am not able to 
reproduce it. However, I can say the fix is the right thing to do.

Comment 15

[Jay Patel [:jay]]

This has creeped up from 29 to 15 on the MozillaTrunk topcrash list.  Here is
the latest info from the Talkback reports:

nsMailboxProtocol::OnStopRequest   18
			 97246 	 ASSI 	  	 [e-mail] mozilla0.9.4
			 97308 	 VERI 	 DUPL 	 [e-mail] --- 
     First BBID :34413609
     Last BBID  :34630139
     Min Runtime :15
     Max Runtime :220620
     First Appearance Date : 2001-08-23
     Last Appearance Date : 2001-08-28
     First BuildID : 2001082015
     Last BuildID : 2001082706

Stack Trace: 

	 nsMailboxProtocol::OnStopRequest
[d:\builds\seamonkey\mozilla\mailnews\local\src\nsMailboxProtocol.cpp  line 270]
	 nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 162]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 KERNEL32.DLL + 0x24407 (0xbff94407)
	 0x00688b5a
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/local/src/nsMailboxProtocol.cpp
line : 270
     (34595976)	Comments: I was selecting about ~15 messages at a time from Inbox and
clicking on the Delete key.  The crash happened about on the 5 time I hit the
Delete key.
     (34595627)	Comments: I was attempting to delete messages from Inbox a few at a time
when the crash happened.  I was hilighting a few messages (~15 at a time) and
deleting them.
     (34541620)	Comments: Trying to delete a message
     (34541581)	Comments: Reading web-based email again
     (34481986)	Comments: Compacting all mail folders while displaying Inbox.
     (34459529)	Comments: I was trying to erase a spam email!

Comment 16

[Navin Gupta]

I am able to reproduce this crasher using the test case in bugscape 
bug 8979. The problem is that when the copy operation fails we close the socket
and set m_runningUrl to null. The OnStopRequest event gets immediately after 
this and it tries to use m_runningUrl and hence it crashes. 

I have discussed this patch with mscott and he has sr'ed this patch. 

Comment 17

[Suresh]

r=suresh

Comment 18

[Asa Dotzler [:asa]]

a=asa on behalf of drivers

Comment 19

[Navin Gupta]

fix checked in. 

Comment 20

[esther]

Verified, tested with scenario in bugscape bug 8979.