This happens when I click on a newsgroup link (ie news://news.uoregon.edu/uo.classes.cis.315) and answering if I want to subscribe to the newsgroup. If I am already subscribed to that newsgroup upon selecting it in the Mail & Newsgroup reader Mozilla crashes. The newsgroup works fine if I go to it directly by opening Mail & Newsgroup or subscribe to a newsgroup for the first time. The same problem occured with Mozilla 0.9.8 and 0.9.9.

Did you install a Talkback-enabled build? If so, do you have an incident number? Thanks.

nsMsgKeySet::GetLastMember [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp, line 391] nsMsgKeySet::SetLastMember [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp, line 410] nsNNTPNewsgroupList::GetRangeOfArtsToDownload [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPNewsgroupList.cpp, line 227] nsNNTPProtocol::FigureNextChunk [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 3494] nsNNTPProtocol::ProcessProtocolState [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 5198] nsMsgProtocol::OnDataAvailable [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp, line 306] nsOnDataAvailableEvent::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 202] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 597] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 530] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1078] KERNEL32.DLL + 0x242e7 (0xbff942e7) 0x00648bfa Slightly different stack than bug 127707, but that's because you are using build 2002-04-19-14. Try a later build. Can you try this with a nightly build? The stack may have changed. Thanks.

Here's a new incident ID from build #2002050108: TB5836706G

Confirming. http://climate/reports/VeryFastSearchStackSigNEW.cfm?stacksig=nsMsgKeySet%3A%3AGetLastMember Says this is still happening on the 5-13 trunk. When I have time, I'll investigate.

This one has a few incidents on the Trunk and quite a few on M1RC2, but none in M1RC3. It has made the early Topcrash reports for N70PR1. A couple of the comments also mention crshing after trying to submit feedback for themes beta testing.

This is currently the #13 topcrash for PR1.

reporter: are you able to reproduce this with news://news.mozilla.org? I'm not having any luck reproducing this yet.

Topcrash in M1RC3. Adding to summary for tracking. Count Offset Real Signature [ 4 nsMsgKeySet::GetLastMember 66ac3e7e - nsMsgKeySet::GetLastMember ] [ 3 nsMsgKeySet::GetLastMember 1a25ba2a - nsMsgKeySet::GetLastMember ] [ 2 nsMsgKeySet::GetLastMember 18cb501b - nsMsgKeySet::GetLastMember ] [ 1 nsMsgKeySet::GetLastMember e5b7d7f7 - nsMsgKeySet::GetLastMember ] Crash date range: 2002-05-24 to 2002-05-27 Min/Max Seconds since last crash: 61 - 100287 Min/Max Runtime: 61 - 100287 Keyword List : Count Platform List 4 Windows NT 5.1 build 2600 3 Windows NT 5.0 build 2195 3 Windows 98 4.10 build 67766446 Count Build Id List 10 2002052308 No of Unique Users 10 Stack trace(Frame) nsMsgKeySet::GetLastMember [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp line 391] nsMsgKeySet::SetLastMember [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp line 410] nsNNTPNewsgroupList::GetRangeOfArtsToDownload [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPNewsgroupList.cpp line 227] nsNNTPProtocol::FigureNextChunk [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp line 3495] nsNNTPProtocol::ProcessProtocolState [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp line 5199] nsMsgProtocol::OnDataAvailable [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp line 306] nsOnDataAvailableEvent::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp line 203] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 597] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 530] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 1078] USER32.dll + 0x3c076 (0x77d7c076) USER32.dll + 0x3c076 (0x77d7c076) _except_handler3() kernel32.dll + 0x3bb86 (0x77e9bb86) (6690561) Comments: I clicked on a newsgroup link in the browser.The mozilla news reader opened (I had never used it before).The account wizard ran. I entered my information. The final panel of the wizard showed some information which looked odd to me so I canceled the (6690561) Comments: wizard.I went back to the browser and clicked on the newsgroup link again.The wizard came up showed its first panel then the Application Error occured. (6642005) URL: www.mozilla.org (6642005) Comments: I clicked on the news link on mozilla webpage for mozilla wishlist which opened the mail/news window...I didn't have any news accounts set up so I entered my information into the dialog...when it asked for my news server I didn't know if it meant for (6642005) Comments: this one newsgroup or for "in general" so I entered "news.frontier.net" (my local isp)I just now tried to ping news.frontier.net and got no response so that may be the problem (6641038) Comments: viewing a newsgroup Also a topcrash in N70PR1: Count Offset Real Signature [ 34 nsMsgKeySet::GetLastMember 66ac3e7e - nsMsgKeySet::GetLastMember ] [ 11 nsMsgKeySet::GetLastMember 7b383eaf - nsMsgKeySet::GetLastMember ] [ 7 nsMsgKeySet::GetLastMember 0c6eb103 - nsMsgKeySet::GetLastMember ] [ 6 nsMsgKeySet::GetLastMember 888a4b91 - nsMsgKeySet::GetLastMember ] [ 4 nsMsgKeySet::GetLastMember 45f40909 - nsMsgKeySet::GetLastMember ] [ 3 nsMsgKeySet::GetLastMember 4effddc7 - nsMsgKeySet::GetLastMember ] [ 2 nsMsgKeySet::GetLastMember e5b7d7f7 - nsMsgKeySet::GetLastMember ] [ 2 nsMsgKeySet::GetLastMember 521473e7 - nsMsgKeySet::GetLastMember ] [ 2 nsMsgKeySet::GetLastMember 18cb501b - nsMsgKeySet::GetLastMember ] Crash date range: 2002-05-22 to 2002-05-28 Min/Max Seconds since last crash: 65 - 66225 Min/Max Runtime: 144 - 118362 Keyword List : news(12), subscrib(8), theme(16), Count Platform List 40 Windows NT 5.1 build 2600 15 Windows NT 5.0 build 2195 11 Windows 98 4.10 build 67766446 4 Windows 98 4.90 build 73010104 1 Windows NT 4.0 build 1381 Count Build Id List 71 2002051220 No of Unique Users 69 Stack trace(Frame) nsMsgKeySet::GetLastMember [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp line 391] nsMsgKeySet::SetLastMember [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp line 410] nsNNTPNewsgroupList::GetRangeOfArtsToDownload [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPNewsgroupList.cpp line 227] nsNNTPProtocol::FigureNextChunk [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp line 3495] nsNNTPProtocol::ProcessProtocolState [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp line 5199] nsMsgProtocol::OnDataAvailable [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp line 306] nsOnDataAvailableEvent::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp line 203] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 597] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 530] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 1078] USER32.dll + 0x3c076 (0x77d7c076) USER32.dll + 0x3c076 (0x77d7c076) _except_handler3() kernel32.dll + 0x3bb86 (0x77e9bb86) (6776819) Comments: getting new themes (6775507) URL: www.netscape.com (6775507) Comments: looking for themes (6773610) Comments: newsgroups (6743926) URL: Netscape.com (6743926) Comments: Trying to subscribe to themes. (6736119) URL: www.netscape.com (6736119) Comments: I was getting new themes. (6734180) Comments: trying to download themes. I was asked if I wanted to subscribe to a newsgroup and I hit [OK] (6733483) Comments: filling in registration form. (6729795) Comments: getting Themes (6728208) Comments: The browser crashed after it asked me to turn notifications of crashes on or off....LOL sorry for the bad news.Thanks Nick (6725895) Comments: Subscribing to Secnews.netscape.net themes newsgroup (6714913) Comments: getting new themes (6714153) Comments: subscribing to a newsgroup (6713870) Comments: subscribing to theme park (6685647) Comments: trying to download themes (6681268) Comments: Adding my ISP's newsgroup server (6676039) Comments: I was trying to get a new theme from the regular theme service (6668418) Comments: requested new themes... went to news and mail... then crashed (6653243) Comments: attempting to set up a newsgroup (6653187) Comments: Was regerstering. (6632901) Comments: subscribing to Netscape Themes newsgroup. Last actions were accepted my news server and requested confirmation for the particular newsgroup.I found a dialog to accept Acrobat (first use with this application) was still open in the background. Dunno if (6632901) Comments: this was related but it may have been the cause of an earlier crash. (6623547) Comments: Trying to subscribe for new themes (6605434) Comments: Trying to get new thems the beta feedback window pops up then I had to fill in the requested data fields to continue. Once completed a window comes up then the erro report. (6603630) Comments: trying to download more themes I was signing up for the themes beta testing (6581540) Comments: opening the theme news group (6567333) Comments: Trying to sign on to default Netscape news group (6553813) Comments: subscribing to newsgroups.

reassigning to cavin

Lowering impact to [ADT2 RTM], per ADT triage.

I know we're having trouble reproducing this. This is currently the #15 topcrash with 100 crashes. Stephen, have you had any luck with this? Any chance checking a null ptr will fix this? Have you tried reading the themes newsgroup (I don't know what this is but apparently a lot of people are trying it).

Cavin and I tried at great length the other to reproduce this (I hear Seth has, too). So, I decided to try the most comment case ('resubscribing to a previous group, and it crashed'). To no avail. I even ran this scenario under Purify a couple of times, checking for free memory mismatches, unit'd memory read, etc. All I found was a small 20 byte leak in another global method of the nsMsgKetSet function. I'll keep banging on this, but as I've been on the feedback newsgroups before, I don't believe there's anything special, except for the fact the newsgroups are much more accessible, since they're linked from some of the Help menu items...

If anyone can provide a set of setps to reproduce this problem it'll help to get the problem resolved sooner.

Ok, I think I found some solid steps to reproduce. I was able to crash twice so far with a recent Trunk build (with a different stack signature and trace) and with Netscape 7.0 PR1. Here are my incidents (look at my comments for steps to reproduce): MozillaTrunk crash: Incident ID 7082165 Stack Signature MSVCRT.dll + 0xd269 (0x7800d269) c67d9ebf Email Address jpatel@netscape.com Product ID MozillaTrunk Build ID 2002060508 Trigger Time 2002-06-06 15:01:41 Platform Win32 Operating System Windows NT 4.0 build 1381 Module MSVCRT.dll URL visited netscape.com User Comments I went to Themes site, went to get new themes...and was prompted to setup the news server to access the newgroup. One I had completed dialog, I downloaded the default 500 headers and everytime I clicked ont he newgroup it would try to resubscibe me to the newsgroup. I did this a few times and then just selected on of the messages in the newsgroup and boom! Trigger Reason Access violation Source File Name Trigger Line No. Stack Trace MSVCRT.dll + 0xd269 (0x7800d269) MSVCRT.dll + 0xcc3f (0x7800cc3f) nsMsgKeySet::Optimize [nsMsgKeySet.cpp, line 581] nsMsgKeySet::Add [nsMsgKeySet.cpp, line 765] nsNewsDatabase::SetHdrReadFlag [nsNewsDatabase.cpp, line 381] Netscape 7.0 PR1 crash: Incident ID 7082301 Stack Signature nsMsgKeySet::GetLastMember 4effddc7 Email Address jpatel@netscape.com Product ID Gecko1.0 Build ID 2002051220 Trigger Time 2002-06-06 15:06:31 Platform Win32 Operating System Windows NT 5.0 build 2195 Module msgbsutl.dll URL visited User Comments trying to reproduce bug 141299. here are the steps: 1. View->Apply Theme->Get New Themes, 2. Click on Get New Themes from the Themes page, 3. Setup news server and get subscribed to the netscape.public.beta.feedback.themes newgroup., 4. I think the crash occurred after I confirmed my subscription to the newgroup. Trigger Reason Access violation Source File Name d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp Trigger Line No. 391 Stack Trace nsMsgKeySet::GetLastMember [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp, line 391] nsMsgKeySet::SetLastMember [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgKeySet.cpp, line 410] nsNNTPNewsgroupList::GetRangeOfArtsToDownload [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPNewsgroupList.cpp, line 227] nsNNTPProtocol::FigureNextChunk [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 3495] nsNNTPProtocol::ProcessProtocolState [d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 5199] nsMsgProtocol::OnDataAvailable [d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp, line 306] nsOnDataAvailableEvent::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 203] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 597] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 530] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1078] nsAppShellService::Run [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 451] main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1473] main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1808] WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1826] WinMainCRTStartup() KERNEL32.DLL + 0x17d08 (0x77e97d08) If anyone wants to reproduce, make sure that you don't already have a news account setup for the themes newsgroup...b/c it won't allow you to complete the news server setup dialog if you already have that particular news server setup in mail/news. Adding testcase and topcrash+ keywords.

Here's the theme newsgroup in question: news://secnews.netscape.com/netscape.public.beta.feedback.themes note, still no luck on my end, continuing to investigate

OK, I think I know what's going on here, and how to fix it. The news db, the news folder, and the nntpgrouplist all have a pointer to the read set (which is owned by the news folder). When the news folder deletes its read set, the db and the nntpgroup list end up holding onto a pointer to invalid memory. We could fix this by reference counting the read set, or by making the nntpgrouplist be a db change announcer, so that when the db gets closed, the nntpgroup list would get notified and clear its pointer to the read set. I suspect the latter is the easier fix - I'll try to attach a patch later that does this.

Great finding, David.

Here's what I had in mind - this will need to be tested once we come up with reproducible case to verify that this fixes the problem.

this patch doesn't fix the problem - still investigating.

What I'm seeing is that when you run a url to subscribe to a newsgroup, the second one gets added to two different news hosts (e.g., I get the mozdev.org news host, and then the news.mozilla.org, and if I subscribe to a group on news.mozilla.org, it gets put under both the mozdev.org host and the news.mozilla.org host. If I click on the group under mozdev.org, that's when the crash happens. What's happening is that we delete the read set here: nsMsgNewsFolder::SetReadSetFromStr(nsMsgNewsFolder * const 0x0553327c, const char * 0x03577296) line 1522 nsMsgNewsFolder::AddNewsgroup(nsMsgNewsFolder * const 0x04ef1514, const char * 0x0012b9b4, const char * 0x03577296, nsIMsgFolder * * 0x0012b9a0) line 241 + 36 bytes nsMsgNewsFolder::CreateSubfolder(nsMsgNewsFolder * const 0x04ef146c, const unsigned short * 0x055742b0, nsIMsgWindow * 0x00000000) line 580 + 63 bytes nsNntpIncomingServer::SubscribeToNewsgroup(nsNntpIncomingServer * const 0x0552aaa4, const char * 0x0543fab0) line 783 + 38 bytes nsNNTPProtocol::LoadUrl(nsIURI * 0x055d24c4, nsISupports * 0x00000000) line 1145 + 51 bytes nsNNTPProtocol::LoadNewsUrl(nsNNTPProtocol * const 0x055e7298, nsIURI * 0x055d24c4, nsISupports * 0x00000000) line 663 + 23 bytes nsNntpService::RunNewsUrl(nsIURI * 0x055d24c4, nsIMsgWindow * 0x05495028, nsISupports * 0x00000000) line 1179 + 31 bytes nsNntpService::GetNewNews(nsNntpService * const 0x04f2ad40, nsINntpIncomingServer * 0x04decd74, const char * 0x0556c058, int 0x00000000, nsIUrlListener * 0x05533240, nsIMsgWindow * 0x05495028, nsIURI * * 0x0012bcb8) line 1210 + 23 bytes nsMsgNewsFolder::GetNewsMessages(nsIMsgWindow * 0x05495028, int 0x00000000, nsIUrlListener * 0x00000000) line 1015 + 102 bytes nsMsgNewsFolder::GetNewMessages(nsMsgNewsFolder * const 0x055331d4, nsIMsgWindow * 0x05495028, nsIUrlListener * 0x00000000) line 987 nsMsgNewsFolder::UpdateFolder(nsMsgNewsFolder * const 0x055331d4, nsIMsgWindow * 0x05495028) line 435 + 21 bytes but I believe the db is still holding onto old read set. The fix might be to clear the db's pointer to the read set in nsMsgNewsFolder::SetReadSetFromStr.

That’s correct, David. This morning I was able to get it to crash twice and the symptom I saw is that the address space of an nsMsgKeySet object, say 0x42556c8, was referenced after it had been freed. I had two break points set at the constructor and destructor of nsMsgKeySet so I was able to confirm this. I’ll see which one you suggested would fix the problem better. Thanks for the help.

> this patch doesn't fix the problem - still investigating. > Oops, I did not see this one. So I won't try it then.

A patch is coming to fix the problem (thanks to David's help).

In nsMsgNewsFolder::SetReadSetFromStr(), after 'mReadSet' is recreated store the new pointer in the db as well.

Here are the steps to reproduce the problem: 1. Run the browser on an existing profile (or you can create a new profile, doesn't matter either way). 2. Click on View->Apply Theme->Get New Themes menu item. 3. Click on Get New Themes link from the Themes page (the one underneath FAQ link), click OK on "Would you liked to subscribe to the netscape.public.beta.feedback.themes?" prompt. 4. Then Account Wizard shows up, enter something in the fields as they don't have to be valid (for example, Newsgroup server can be 'news.a1.com'). Click Finish button at the last page. Then Click OK again on the second "Would you liked to subscribe to the netscape.public.beta.feedback.themes?" prompt. If the profile doesn't already have this news account set up, then close the mailnews window (using the upper right hand corner X button) and repeat steps #2 and #3 again (ie, go back to browser and click on Get New Themes menu item ). In this case, you will have to enter a different Newsgroup server than the one you used the first time (like news.a2.com). Otherwise, it may crash in three different ways: a. Right after the OK button in step #3 is clicked. b. It prompts you for how many msgs to download at a time dialog, just click Download and it crashes. c. It downloads 500 msgs fine but if you then close the mailnews window it crashes.

Comment on attachment 86863 [details] [diff] [review] The right fix, v1 r=naving

Comment on attachment 86863 [details] [diff] [review] The right fix, v1 sr=bienvenu

nice fix! getting on adt and drivers radar for the 1.0.1 branch. I think you should try to get this on the trunk, too.

Comment on attachment 86863 [details] [diff] [review] The right fix, v1 a=asa (on behalf of drivers) for checkin to the 1.1 trunk.

Fix checked into the trunk.

*** Bug 147703 has been marked as a duplicate of this bug. ***

adt1.0.1+ (on adt's behalf) approval for checkin th the 1.0 branch, pending Drivers' approval. pls check this in asap, then add the "fixed1.0.1" keyword.

Comment on attachment 86863 [details] [diff] [review] The right fix, v1 Please land this on the 1.0.1 branch. Once there, remove the "mozilla1.0.1+" keyword, and add the "fixed1.0.1"

Fix checked in to the branch.

Using http://bugzilla.mozilla.org/show_bug.cgi?id=141299#c26 as my testcase, along with Talkback's logs: Verified FIXED with: 2002-06-17-08 trunk and 2002-06-17-1.0 builds (all commercial). The last time a submitted talkback crash occured was on 2002-06-07-04 MozillaTrunk Linux 2.4.7-timesys-3.1.214 Talkback alone is certainly not conclusive - as the last crash known was 4 days before the fix would've even been in a build, so the comment #26 testcase will have to stand as the conclusive word. Since I verified this on trunk *and* branch concurrently, marking VERIFIED and replacing FIXED1.0.1 keyword with VERIFIED1.0.1 to indicate branch happiness. Should anyone see this stack again, please do reopen. Thanks!