173545 - crash at shutdown in nsMsgFolderCache::~nsMsgFolderCache() after a quick search

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[(not reading, please use [e-mail] instead)]

in ~nsMsgFolderCache, m_cacheElements is 0xcdcdcdcd (already deleted?)

nsMsgFolderCache::~nsMsgFolderCache() line 70 + 26 bytes
nsMsgFolderCache::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsMsgFolderCache::Release(nsMsgFolderCache * const 0x09a6f4b8) line 90 + 174 
bytes
nsCOMPtr<nsIMsgFolderCache>::~nsCOMPtr<nsIMsgFolderCache>() line 491
nsMsgAccountManager::~nsMsgAccountManager() line 175 + 198 bytes
nsMsgAccountManager::`scalar deleting destructor'() + 15 bytes
nsMsgAccountManager::Release(nsMsgAccountManager * const 0x031a51f8) line 144 + 
151 bytes
nsCOMPtr_base::assign_assuming_AddRef(nsISupports * 0x00000000) line 436
nsCOMPtr_base::assign_with_AddRef(nsISupports * 0x00000000) line 74
nsCOMPtr<nsISupports>::operator=(nsISupports * 0x00000000) line 796
FreeServiceContractIDEntryEnumerate(PLDHashTable * 0x0027ce0c, PLDHashEntryHdr 
* 0x01288bc8, unsigned int 711, void * 0x00000000) line 1926
PL_DHashTableEnumerate(PLDHashTable * 0x0027ce0c, int (PLDHashTable *, 
PLDHashEntryHdr *, unsigned int, void *)* 0x1006a1c0 
FreeServiceContractIDEntryEnumerate(PLDHashTable *, PLDHashEntryHdr *, unsigned 
int, void *), void * 0x00000000) line 601 + 34 bytes
nsComponentManagerImpl::FreeServices() line 1938 + 19 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 723
main(int 2, char * * 0x00276f30) line 1892 + 8 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e8d326()

Comment 1

[(not reading, please use [e-mail] instead)]

david asked me if I had enable the junk purging code.

it is on for one of my servers:

user_pref("mail.server.server4.purgeSpam", true);
user_pref("mail.server.server4.purgeSpamInterval", 99);

Comment 2

[(not reading, please use [e-mail] instead)]

all the prefs for this server:

user_pref("mail.server.server4.allows_specialfolders_usage", false);
user_pref("mail.server.server4.capability", 49697);
user_pref("mail.server.server4.directory", "C:\\Documents and 
Settings\\Administrator\\Application 
Data\\Mozilla\\Profiles\\sspitzer\\js48p4bs.slt\\ImapMail\\imap.mail.aol-
4.com");
user_pref("mail.server.server4.hostname", "imap.mail.aol.com");
user_pref("mail.server.server4.max_cached_connections", 5);
user_pref("mail.server.server4.moveOnSpam", true);
user_pref("mail.server.server4.moveTargetMode", 1);
user_pref("mail.server.server4.name", "AOL Mail - sspitzernscp2");
user_pref("mail.server.server4.namespace.personal", "\"\"");
user_pref("mail.server.server4.purgeSpam", true);
user_pref("mail.server.server4.purgeSpamInterval", 99);
user_pref("mail.server.server4.server_sub_directory", "");
user_pref
("mail.server.server4.spamActionTargetAccount", "imap://[e-mail].
aol.com");
user_pref("mail.server.server4.spamActionTargetFolder", "mailbox://nobody@Local%
20Folders/Trash");
user_pref("mail.server.server4.spamLevel", 100);
user_pref("mail.server.server4.timeout", 29);
user_pref("mail.server.server4.type", "imap");
user_pref("mail.server.server4.userName", "sspitzernscp2");
user_pref("mail.server.server4.whiteListAbURI", "moz-
abmdbdirectory://history.mab");

Comment 3

[David :Bienvenu]

The junk folder purging is a recent change involving the folder cache and might
have exposed some other problem with the ref-counting in the folder cache. I
don't see anything wrong with the folder cache stuff that's being used by the
junk folder stuff, so it might be some unfortunate side-effect.

Comment 4

[Navin Gupta]

I can take a look if you want.

Comment 5

[(not reading, please use [e-mail] instead)]

in case this helps:

for this account, my junk folder is my trash folder on local folders

it was non empty, but there was no junk in it.

Comment 6

[David :Bienvenu]

this stack trace shows what's probably going on: - we're in the process of
shutting down, and unfortunately, end up loading all the accounts after having
cleaned them up. In this stack, the problem is that the search session calls
GetMailPath() trying to cleanup the scope. And that causes all the accounts to
get loaded, which causes the purge service to try to start up again. The quick
and dirty fix is to just initialize m_cacheElements as null and check for null
where we deref it (I'll attach a patch that does this in a sec). But the better
fix is to avoid having the accounts get reloaded on shutdown like this.

nsHashtable::Get(nsHashKey * 0x0012f038) line 310 + 3 bytes
nsSupportsHashtable::Get(nsHashKey * 0x0012f038) line 971 + 12 bytes
nsMsgFolderCache::GetCacheElement(nsMsgFolderCache * const 0x03b9d068, const
char * 0x03c605d8, int 0x00000001, nsIMsgFolderCacheElement * * 0x0012f0b8) line
361 + 16 bytes
nsMsgDBFolder::WriteToFolderCache(nsMsgDBFolder * const 0x03d851ac,
nsIMsgFolderCache * 0x03b9d068, int 0x00000000) line 1050 + 48 bytes
nsMsgDBFolder::FlushToFolderCache() line 1026 + 30 bytes
nsImapMailFolder::UpdateSummaryTotals(nsImapMailFolder * const 0x03d851ac, int
0x00000001) line 1489
nsImapMailFolder::GetDatabase(nsIMsgWindow * 0x00000000) line 622
nsImapMailFolder::GetDBFolderInfoAndDB(nsImapMailFolder * const 0x03d851ac,
nsIDBFolderInfo * * 0x0012f2e4, nsIMsgDatabase * * 0x0012f2dc) line 1784 + 17 bytes
nsMsgDBFolder::GetStringProperty(nsMsgDBFolder * const 0x03d851ac, const char *
0x0351db7c, char * * 0x06ab51e8) line 1657 + 63 bytes
nsMsgPurgeService::AddServer(nsIMsgIncomingServer * 0x067b9710) line 184 + 73 bytes
nsMsgPurgeService::OnServerLoaded(nsMsgPurgeService * const 0x03beae84,
nsIMsgIncomingServer * 0x067b9710) line 236
nsMsgAccountManager::NotifyServerLoaded(nsMsgAccountManager * const 0x03297180,
nsIMsgIncomingServer * 0x067b9710) line 1775
nsMsgAccount::createIncomingServer() line 172
nsMsgAccount::GetIncomingServer(nsMsgAccount * const 0x06b101a8,
nsIMsgIncomingServer * * 0x0012f65c) line 109 + 8 bytes
nsMsgAccountManager::LoadAccounts(nsMsgAccountManager * const 0x03297180) line
1456 + 62 bytes
nsMsgAccountManager::GetAllServers(nsMsgAccountManager * const 0x03297180,
nsISupportsArray * * 0x0012f7dc) line 1271 + 12 bytes
nsMsgAccountManager::InternalFindServer(const char * 0x0677d810, const char *
0x0012fabc, const char * 0x042a06b4, int 0x00000000, nsIMsgIncomingServer * *
0x0012faa8) line 1852 + 36 bytes
nsMsgAccountManager::FindServer(nsMsgAccountManager * const 0x03297180, const
char * 0x0677d810, const char * 0x0012fabc, const char * 0x042a06b4,
nsIMsgIncomingServer * * 0x0012faa8) line 1891
nsImapURI2Path(const char * 0x0429368c kImapRootURI, const char * 0x03b93e48,
nsFileSpec & {...}) line 126 + 84 bytes
nsImapMailFolder::GetPath(nsImapMailFolder * const 0x03797c74, nsIFileSpec * *
0x0012fb5c) line 5479 + 27 bytes
nsMsgSearchScopeTerm::GetMailPath(nsMsgSearchScopeTerm * const 0x06f16400,
nsIFileSpec * * 0x0012fb5c) line 1466 + 48 bytes
nsMsgSearchOfflineMail::CleanUpScope() line 873 + 42 bytes
nsMsgSearchOfflineMail::~nsMsgSearchOfflineMail() line 334
nsMsgSearchOfflineMail::`scalar deleting destructor'(unsigned int 0x00000001) +
15 bytes
nsMsgSearchAdapter::Release(nsMsgSearchAdapter * const 0x076f1530) line 99 + 174
bytes
nsMsgSearchOfflineMail::Release(nsMsgSearchOfflineMail * const 0x076f1530) line
322 + 12 bytes
nsCOMPtr<nsIMsgSearchAdapter>::~nsCOMPtr<nsIMsgSearchAdapter>() line 491
nsMsgSearchScopeTerm::~nsMsgSearchScopeTerm() line 1444 + 22 bytes
nsMsgSearchScopeTerm::`scalar deleting destructor'(unsigned int 0x00000001) + 15
bytes
nsMsgSearchSession::DestroyScopeList() line 633 + 31 bytes
nsMsgSearchSession::~nsMsgSearchSession() line 75
nsMsgSearchSession::`scalar deleting destructor'() + 15 bytes
nsMsgSearchSession::Release(nsMsgSearchSession * const 0x0770ba58) line 54 + 178
bytes
XPCJSRuntime::GCCallback(JSContext * 0x07955910, JSGCStatus JSGC_END) line 546 +
18 bytes
DOMGCCallback(JSContext * 0x07955910, JSGCStatus JSGC_END) line 1641 + 23 bytes
js_GC(JSContext * 0x07955910, unsigned int 0x00000000) line 1399 + 12 bytes
js_ForceGC(JSContext * 0x07955910, unsigned int 0x00000000) line 993 + 13 bytes
JS_GC(JSContext * 0x07955910) line 1659 + 11 bytes
nsDOMSOFactory::Observe(nsDOMSOFactory * const 0x01310684, nsISupports *
0x0027e554, const char * 0x1010f1f8, const unsigned short * 0x00000000) line 227
+ 10 bytes
nsObserverService::NotifyObservers(nsObserverService * const 0x01263708,
nsISupports * 0x0027e554, const char * 0x1010f1f8, const unsigned short *
0x00000000) line 213
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 694
main(int 0x00000001, char * * 0x00278040) line 1892 + 8 bytes

Comment 7

[David :Bienvenu]

Attachment: proposed fix

init m_cacheElements to null, and check for it before using it.

Comment 8

[Navin Gupta]

I think waterson had a patch to fix this problem correctly. I don't remember the
bug#

Comment 9

[(not reading, please use [e-mail] instead)]

testing david's patch

david figure out how to reproduce this.

start up, do a QS, exit.

he's on vacation, so I'll drive the patch for him.

testing now...

Comment 10

[(not reading, please use [e-mail] instead)]

Comment on attachment 102520 [details] [diff] [review]
proposed fix

sr=sspitzer

fixes my crasher, too.

Comment 11

[(not reading, please use [e-mail] instead)]

want for 1.2 beta...

Comment 12

[Navin Gupta]

Comment on attachment 102520 [details] [diff] [review]
proposed fix

r=naving

Comment 13

[Asa Dotzler [:asa]]

Comment on attachment 102520 [details] [diff] [review]
proposed fix

a=asa for checkin to 1.2beta (on behalf of drivers)

Comment 14

[(not reading, please use [e-mail] instead)]

fixed.

thanks for the fix, david

Comment 15

[David :Bienvenu]

*** Bug 148236 has been marked as a duplicate of this bug. ***