To read the original message source, one can ask the Messenger for the respective message service, from which one can then stream the message. This works fine for mailbox-message://, but when a file:// URL is used that points to a saved e-mail (.eml format), Thunderbird crashes (talkback report TB18391440X). messageURI = "file:///C:/foo.eml?type=application/x-message-display"; stream = Components.classes["@mozilla.org/network/sync-stream-listener;1"] .createInstance() .QueryInterface(Components.interfaces.nsIInputStream); messenger.messageServiceFromURI(messageURI) .streamMessage(messageURI, stream, msgWindow, null, false, null); This was discovered with the MessageFaces extension, which I built without thinking that I might have to handle EML files in a different way than mailbox messages. If the messenger.messageServiceFromURI returned null for file:// URLs, and/or the message service streamMessage() implementations failed cleanly, other extensions with the same error would still be broken, but things would look way better :-)

fwiw: .createInstance() .QueryInterface(Components.interfaces.nsIInputStream); can be replaced with: .createInstance(Components.interfaces.nsIInputStream); it's cheaper. While i'm handing out notes SyncStream = Components.Constructor("@mozilla.org/network/sync-stream-listener;1", Components.interfaces.nsIInputStream); ... stream = new SyncStream; Anyway, patch for your bug in a moment.

Incident ID: 18391440 Stack Signature nsMailboxService::FetchMessage 83c42599 Product ID Thunderbird15 Build ID 2006030803 Trigger Time 2006-05-07 01:19:23.0 Platform Win32 Operating System Windows NT 5.0 build 2195 Module thunderbird.exe + (004efec0) URL visited User Comments Since Last Crash 1514 sec Total Uptime 31547 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 259 Stack Trace nsMailboxService::FetchMessage [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 259] nsMailboxService::StreamMessage [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mailnews/local/src/nsMailboxService.cpp, line 309] XPTC_InvokeByIndex [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102] XPCWrappedNative::CallMethod [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152] XPC_WN_CallMethod [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444] js_Invoke [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177] js_Interpret [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562] js_Execute [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424] obj_eval [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1266] js_Invoke [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177] js_Interpret [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562] js_Execute [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424] obj_eval [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1266] js_Invoke [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177] js_Interpret [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562] js_Invoke [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197] js_Interpret [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562] js_Invoke [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197] js_InternalInvoke [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1274] JS_CallFunctionValue [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4171] nsJSContext::CallEventHandler [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1411] nsGlobalWindow::RunTimeout [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6360] nsGlobalWindow::TimerCallback [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6723] nsAppStartup::Run [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151] main [c:/builds/tinderbox/Tb-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/mail/app/nsMailApp.cpp, line 62] KERNEL32.DLL + 0x11af6 (0x77e81af6)

timeless, would this be suitable for the 1.8 branch? I noticed that you ported other patches to that file back to the branch, but not this one... (Come to think of it, this might even be a candidate for a 1.8.0.x Gecko, as it's clearly stability-improving)

Comment on attachment 221153 [details] [diff] [review] look before leaping mozilla/mailnews/local/src/nsMailboxService.cpp 1.122

Seems kind of scary that this function can return success without touching aURL.

Comment on attachment 221153 [details] [diff] [review] look before leaping MOZILLA_1_8_BRANCH: mozilla/mailnews/local/src/nsMailboxService.cpp 1.114.8.6

i filed bug 343398 for dbaron. i'm using this bug simply to fix the crash, which i believe i did. if anyone wants to do anything else (including object to my fixing this bug) then they're free to use any bug that isn't assigned to me.

Comment on attachment 221153 [details] [diff] [review] look before leaping approved for 1.8.0 branch, a=dveditz for drivers

Comment on attachment 221153 [details] [diff] [review] look before leaping MOZILLA_1_8_0_BRANCH: mozilla/mailnews/local/src/nsMailboxService.cpp 1.114.8.3.2.2

Jens: I am wondering if you have a suggestion as to an easy way I can verify that the patch fixes the crash.

(In reply to comment #11) > Jens: I am wondering if you have a suggestion as to an easy way I can verify > that the patch fixes the crash. The following line crashes Thunderbird 1.5.0.5 when evaluated in the JS console: messageURI = "file:///C:/foo.eml?type=application/x-message-display"; stream = Components.classes["@mozilla.org/network/sync-stream-listener;1"].createInstance(Components.interfaces.nsIInputStream); Components.classes['@mozilla.org/messenger;1'].getService(Components.interfaces.nsIMessenger).messageServiceFromURI(messageURI).streamMessage(messageURI,stream,null, null, false, null); The original code passed a non-null value for msgWindow to streamMessage(), but getting one from the JS console did not seem easy. I guess it is still a sufficient test case.

verified fixed 1.8.1.3 with Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.0 ID:2007032620 using Talkback Data and the testcase from comment #12