114900 - Mail reader crashes for me every single time I try to read e-mail.

Status: VERIFIED FIXED

(MailNews Core :: Database, defect)

Description

[Javier Delgadillo]

For some reason unknown to me, Netscape 6.2 started crashing for me when trying 
to read e-mail.  I can't bring up Messenger at all without the client crashing.

I was forced to start using Communicator 4.78 again since even trunk builds will 
crash.


There are 2 Talkback ID's for me with the same stack trace 35810 and 348603

morkZone::zone_grow_at [d:\builds\seamonkey\mozilla\db\mork\src\morkZone.cpp, 
line 188] 
morkZone::zone_new_chip [d:\builds\seamonkey\mozilla\db\mork\src\morkZone.cpp, 
line 306] 
morkZone::ZoneNewRun [d:\builds\seamonkey\mozilla\db\mork\src\morkZone.cpp, line 
383] 
morkPool::NewCells [d:\builds\seamonkey\mozilla\db\mork\src\morkPool.cpp, line 
257] 
morkPool::AddRowCells [d:\builds\seamonkey\mozilla\db\mork\src\morkPool.cpp, 
line 296] 
morkRow::TakeCells [d:\builds\seamonkey\mozilla\db\mork\src\morkRow.cpp, line 
397] 
morkBuilder::FlushBuilderCells 
[d:\builds\seamonkey\mozilla\db\mork\src\morkBuilder.cpp, line 562] 
morkBuilder::OnRowEnd [d:\builds\seamonkey\mozilla\db\mork\src\morkBuilder.cpp, 
line 585] 
morkParser::ReadRow [d:\builds\seamonkey\mozilla\db\mork\src\morkParser.cpp, 
line 730] 
morkParser::ReadContent [d:\builds\seamonkey\mozilla\db\mork\src\morkParser.cpp, 
line 1405] 
morkParser::ReadGroup [d:\builds\seamonkey\mozilla\db\mork\src\morkParser.cpp, 
line 1207] 
morkParser::ReadAt [d:\builds\seamonkey\mozilla\db\mork\src\morkParser.cpp, line 
1239] 
morkParser::ReadContent [d:\builds\seamonkey\mozilla\db\mork\src\morkParser.cpp, 
line 1436] 
morkParser::OnPortState [d:\builds\seamonkey\mozilla\db\mork\src\morkParser.cpp, 
line 1453] 
morkParser::ParseLoop [d:\builds\seamonkey\mozilla\db\mork\src\morkParser.cpp, 
line 1509] 
morkParser::ParseMore [d:\builds\seamonkey\mozilla\db\mork\src\morkParser.cpp, 
line 1546] 
morkThumb::DoMore_OpenFileStore 
[d:\builds\seamonkey\mozilla\db\mork\src\morkThumb.cpp, line 433] 
morkThumb::DoMore [d:\builds\seamonkey\mozilla\db\mork\src\morkThumb.cpp, line 
356] 
orkinThumb::DoMore [d:\builds\seamonkey\mozilla\db\mork\src\orkinThumb.cpp, line 
230] 
nsMsgDatabase::OpenMDB 
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgDatabase.cpp, line 909] 
nsImapMailDatabase::Open 
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsImapMailDatabase.cpp, line 
101] 
nsMsgDatabase::OpenFolderDB 
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgDatabase.cpp, line 833] 
nsImapMailFolder::GetDatabase 
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 558] 
nsImapMailFolder::UpdateFolder 
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 604] 
nsImapMailFolder::GetNewMessages 
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 2102] 
nsImapIncomingServer::PerformBiff 
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapIncomingServer.cpp, line 
892]

Comment 1

[David :Bienvenu]

what's the latest trunk build you've tried? You're using IMAP, right? It looks
like your Inbox.msf is corrupt - you need to move it away (please don't delete
it) and restart. If this fixes your problem, then could you send me your
Inbox.msf file to look at? Also, if your trunk build is more than a few days
old, you should try a build from this week.

Comment 2

[Javier Delgadillo]

I'm running build 2001121103 (yesterday's trunk build) and I get the crash even 
if I move Inbox.msf and nsmail-2.msf out of the way before launching the app.

I'm running SSL/IMAP to the company IMAP server with 2 other SSL/IMAP accounts 
in the same profile.

Comment 3

[David :Bienvenu]

with that exact same stack trace? That seems unlikely since you'll only get that
stack trace if you have an Inbox.msf file there. Are you sure you moved away the
correct Inbox.msf? Since this is biff that's running, it could be any of the
Inbox.msf files for any of your imap accounts.

Comment 4

[Javier Delgadillo]

I figured out which msf file causes the crash, but I'm slightly wary of 
attaching it to a bug that can be seen by anyone in the world.  It does have 
some content from my Inbox.

Comment 5

[David :Bienvenu]

that's why I suggested you send it to me. I won't look at the contents, I promise.

Comment 6

[scottputterman]

Javi, were you able to get the .msf file to David?  If so, was anything able to
be determined?

Comment 7

[Javier Delgadillo]

I sent it to him, not sure what became of it.

Comment 8

[David :Bienvenu]

I believe it's a corrupted .msf file - it crashes in mork in a place I've never
seen crash before. It looks like corrupted memory of some sort, so I'm going to
have to try to run under purify. It's not a crash I can fix with just a null
check. There's casting going on from void *'s, so it's hard to tell where things
are going wrong, since I've never had occasion to learn this code.

Comment 9

[David :Bienvenu]

I still suspect that this .msf file is corrupted somehow. I've tracked the crash
down to code that never normally executes, as near as I can tell: in
morkZone::zone_grow_at, when it's looking for space, it iterates over this
linked list of blocks, trying to find one with space. It normally never finds
one, but in this case, it does. It then pokes the length of the block into a
field that's supposed to be a pointer, so I suspect the code is just broken and
was never right. I don't know what the right way to fix this, but a trivial fix
would be to just bypass the code that looks for existing space and just go
straight to the code that allocates a new hunk of memory.

Comment 10

[David :Bienvenu]

Attachment: proposed fix

need to use the morkOldRun * cast to set the size. Works much better :-)

Comment 11

[(not reading, please use [e-mail] instead)]

Comment on attachment 64221 [details] [diff] [review]
proposed fix

sr=sspitzer

Comment 12

[David :Bienvenu]

fix checked in.

Comment 13

[[e-mail] (gone - use [e-mail] instead)]

2001-12-21-09 was the latest build to exhibit this crash.  

http://climate/reports/searchstacksignature.cfm?stacksig=morkZone%3A%3Azone_grow_at

Verified FIXED