+++ This bug was initially created as a clone of Bug #651002 +++ > [...] When you are reading a mail message (particularly in the three-pane > window) that has a CC field with just a single comma in it, you get the > following behavior: > > 1) In the bottom view pane, Thunderbird always "fills in" the recipients > that were CC'ed on the last message you read before this one. [...] > > 2) There's often the same effect with the Subject line - in the bottom view > pane, it replaces the legitimate Subject line of the email you're viewing > with the Subject line of your last viewed message. I thought this was fixed for good but then came across http://gsfn.us/t/3vvk2 which made me retest bug 651002 to verify that it didn't regress. Well, so the testcase in attachment 528111 [details] still works, but when adding a "Reply-To:" heading as suggested by the GS thread it fails. That's different than the original issue, though. The error console reads (on 17.0.5, but also showing on 22.0a1 builds): Error: NS_ERROR_OUT_OF_MEMORY: Component returned failure code: 0x8007000e (NS_ERROR_OUT_OF_MEMORY) [nsIMsgHeaderParser.extractHeaderAddressMailboxes] Source File: chrome://messenger/content/msgHdrViewOverlay.js Line: 555 or 559 That's on Windows 7, I don't see any entry on Linux (testing trunk only). Reproducible also on 3.1.20, so this has been in there for a while. Thus, while the issue in bug 651002 was caused by a missing zero-check in the code for building the header pane, in this case the problem apparently happens in the header-parsing code. It's confusing that it depends on the Reply-To header being present and one header having a "," value only, given that all functions (on the parsing and the display sides) should be the same for either header.

This mbox contains three testcases: 1. The original testcase from bug 651002 attachment 528111 [details] (works) 2. The same message with a valid Reply-To: header added (fails) 3. Now with a valid To: but single-',' Reply-To: header (fails)

Looking at the code, nsMsgHeaderParser::ExtractHeaderAddressMailboxes() lives in mailnews/mime/src/nsMsgHeaderParser.cpp and seems to report the out-of-memory exception. This happens when messageHeaderSink.processHeaders() asks for parsing the "To:" or "Reply-To:" headings, depending on which one has the single comma. Tentatively moving to MailNews Core / MIME based on this initial analysis.

I could reproduce on the Windows April 3 23.0a1 nightly as well, however without seeing a message in the Error Console. I'm unable to reproduce on SeaMonkey, it displays the message with an empty "Reply-to:" heading. Thus, this may be a Thunderbird-specific issue after all, just manifesting itself in the MIME code.

Assuming that Joshua's reimplementation of nsIMsgHeaderParser may solve the issue here in the process, I'm setting a dependency to his bug 842632.