75296 - Trunk crash [@ nsUInt32Array::InsertAt]

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect, P1)

Description

[Håkan Waara]

(I don't really know where this belongs, if it's a DB issue, news issue, 
backend issue etc. so I'm cc'ing some relevant people. I excuse the spam if 
this is not yours.)

I crashed when I closed the 3pane window while a news message was being sent. I 
don't think the sending was done.

InsertAt() tried to use a variable, of the current class while *this was null.

nsUInt32Array::InsertAt(nsUInt32Array * const 0x00000000, unsigned int 
4294967295, unsigned int 11092, unsigned int 1) line 212 + 9 bytes
nsMsgThreadedDBView::OnNewHeader(nsMsgThreadedDBView * const 0x00000000, 
unsigned int 11092, unsigned int 11091, int -1) line 476
nsMsgDBView::OnKeyAdded(nsMsgDBView * const 0x02deb224, unsigned int 11092, 
unsigned int 11091, int 65552, nsIDBChangeListener * 0x00000000) line 3247
nsMsgDatabase::NotifyKeyAddedAll(nsMsgDatabase * const 0x01c7a080, unsigned int 
11092, unsigned int 11091, int 65552, nsIDBChangeListener * 0x00000000) line 438
nsMsgDatabase::AddNewHdrToDB(nsMsgDatabase * const 0x00002b54, nsIMsgDBHdr * 
0x00002b53, int 1) line 2570 + 17 bytes
nsNNTPNewsgroupList::ParseLine(nsNNTPNewsgroupList * const 0x00000000, char * 
0x00010010, unsigned int * 0x01c224ea) line 616
nsNNTPNewsgroupList::ProcessXOVERLINE(nsNNTPNewsgroupList * const 0x023873c0, 
const char * 0x01c226d0, unsigned int * 0x0070fa14) line 638
nsNNTPProtocol::ReadXover(nsNNTPProtocol * const 0x00000000, nsIInputStream * 
0x01d9a0cc, unsigned int 272) line 3472
nsNNTPProtocol::ProcessProtocolState(nsNNTPProtocol * const 0x00000000, nsIURI 
* 0x02c5a834, nsIInputStream * 0x01d9a0cc, unsigned int 196, unsigned int 272) 
line 5046
nsMsgProtocol::OnDataAvailable(nsMsgProtocol * const 0x02c5fa08, nsIRequest * 
0x01d9bfd0, nsISupports * 0x02c5a834, nsIInputStream * 0x01d9a0cc, unsigned int 
196, unsigned int 272) line 235 + 20 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x02c5fa08) 
line 161 + 30 bytes
nsStreamObserverEvent::HandlePLEvent(PLEvent * 0x01c25c44) line 79
PL_HandleEvent(PLEvent * 0x01c25c44) line 589
PL_ProcessPendingEvents(PLEventQueue * 0x1000813a) line 518 + 6 bytes
_md_EventReceiverProc(HWND__ * 0x98478b5c, unsigned int 38983, unsigned int 0, 
long -1074325064) line 1070
KERNEL32! bff94407()
00708b56()

Comment 1

[Håkan Waara]

This is probably just a matter of some null-checking/bullet-proofing. But I may 
be wrong.

Comment 2

[Jay Patel [:jay]]

Added topcrash keyword, updated summary with Trunk and [@ 
nsUInt32Array::InsertAt] for tracking. here is some Talkback info from today's 
topcrash report:

nsUInt32Array::InsertAt   39 
     First BBID :28914266
     Last BBID  :29250410
     Min Runtime :256
     Max Runtime :257602
     First Appearance Date : 2001-04-10
     Last Appearance Date : 2001-04-17
     First BuildID : 2001040906
     Last BuildID : 2001041612

Stack Trace: 

         nsUInt32Array::InsertAt        
[d:\builds\seamonkey\mozilla\mailnews\base\util\nsUInt32Array.cpp  line 213] 
         nsMsgThreadedDBView::OnNewHeader       
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgThreadedDBView.cpp  line 
476] 
         nsMsgDBView::OnKeyAdded        
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgDBView.cpp  line 3247] 
         nsMsgDatabase::NotifyKeyAddedAll       
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgDatabase.cpp  line 438] 
         nsMsgDatabase::AddNewHdrToDB   
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgDatabase.cpp  line 2574] 
         nsNNTPNewsgroupList::ParseLine 
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPNewsgroupList.cpp  line 
616] 
         nsNNTPNewsgroupList::ProcessXOVERLINE  
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPNewsgroupList.cpp  line 
638] 
         nsNNTPProtocol::ReadXover      
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp  line 3472] 
         nsNNTPProtocol::ProcessProtocolState   
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp  line 5046] 
         nsMsgProtocol::OnDataAvailable 
[d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp  line 236] 
         nsOnDataAvailableEvent::HandleEvent    
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp  line 
183] 
         PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  
line 589] 
         PL_ProcessPendingEvents        
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 522] 
         _md_EventReceiverProc  
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1070] 
         KERNEL32.DLL + 0x242e7 (0xbff942e7)  
         0x00688b5a  
 
        Source File : 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/base/util/nsUInt32A
rray.cpp line : 213
     (29240160) Comments: dl mail
     (29235465) Comments: trying to fill out the employee survey
     (29183948) URL: http://blackboard.com/courses/CMIS320
     (29183948) Comments: getting message from a news server.
     (29175095) URL: http://blackboard.com/courses/CMIS320
     (29175095) Comments: posting a message to a news group.
     (29057531) Comments: I was receiving mails and at the same time
     (29045007) Comments: I war reading mail on IMAP.
     (29042454) Comments: nothing!
     (29021318) Comments: getting new messages for one of my new accounts
     (29001962) Comments: Read borland.public.delphi.non-technical on 
newsgroups.borland.com. Posted a message and then pressed the Get Msg button.
     (28979161) Comments: not sure
     (28963531) Comments: I was reading mail thru IMAP. Application failed after 
checking for new mail (sound vas played and reader crashed)
     (28957643) Comments: Reading mail 
     (28955039) Comments: I was reading mail thru IMAP client
     (28914266) URL: http://divx.euro.ru/
     (28914266) Comments: Crashed downloading news articles.

Comment 3

[Håkan Waara]

Looks like a news-issue, seth?

Comment 4

[David :Bienvenu]

I see what's going on here - a trivial way to reproduce it is get into unread
messages only view, send yourself a message that will be it's own unique thread,
get new mail, reply to the msg, and press get new mail again.

Comment 5

[David :Bienvenu]

Attachment: proposed fix

Comment 6

[David :Bienvenu]

The problem was that we were trying to insert the new msg in threaded view at
index -1, which crashed. The fix was to correctly figure out where the new msg
should go in the thread, which meant implementing GetInsertInfoForNewHdr, which
basically iterates over the msgs in a thread looking for the place to put the
last child at a particular level. It's guaranteed not to return index -1.

I also fixed nsMsgDBView::GetIndexForThread, which was supposed to be looking at
the 0'th level msgs (i.e., the threads) instead of the non-threads (I looked at
the 4.x code to verify this).

Nominating for beta

Comment 7

[Håkan Waara]

It looks like you attached the diffs tonsMsgDBView.cpp by accident - I don't see
what those fixes have to do with the rest of the fix?

Comment 8

[David :Bienvenu]

no, I attached that diff on purpose, and in fact described the relevant change
to nsMsgDBView::GetIndexForThread in my comment above.

Comment 9

[(not reading, please use [e-mail] instead)]

sr=sspitzer

hwaara might be referring to this:

+  if (mOutliner) 
+    mOutliner->RowCountChanged(0, -GetSize());

which are part of another fix, right?

Comment 10

[Håkan Waara]

Indeed, that was what I was referring to.

Comment 11

[Håkan Waara]

+    PRInt32 level;
[...]
+      level = m_levels[insertIndex];
+      if (level <= parentLevel)

can be reduced to:

+      if (m_levels[insertIndex] <= parentLevel)

r=hwaara

Comment 12

[David :Bienvenu]

right, as I explained privately to hwarra, that is part of another fix in the
same file (nsMsgDBView.cpp) as part of the fix for this bug. It has no effect on
this bug.

Comment 13

[David :Bienvenu]

fix checked in.

Comment 14

[esther]

Using build 2001-05-14 one win, mac and linux and the original scenario as well 
as the scenario on 4-23 I don't crash.  Verified.  Note: to see the bug I 
downloaded the 4-10 build on windows and I saw the bug when closing the 3-pane 
window while a posting to news was in progress.  
Verified. 

Comment 15

[timeless]

*** Bug 80539 has been marked as a duplicate of this bug. ***