126855 - Freeing mismatched memory in PR_Free

Status: VERIFIED DUPLICATE of bug 143035

(SeaMonkey :: MailNews: Address Book & Contacts, defect)

Description

[[e-mail] (gone - use [e-mail] instead)]

Build ID: latest win32 trunk, under Purify.

Steps to reproduce:

Steps to Reproduce:

1. With an empty addressbook, do: File | Import.
2. Click on Address Book, then Next.
3. Click on the LDIF (.csv and .txt) choice.
4. When the dialog comes up choose an LDIF file.
5. Click Finish when done.

[E] FMM: Freeing mismatched memory in PR_Free {1 occurrence}
        Address 0x08808950 points into a C++ new block in heap 0x02710000
        Location of free attempt
            PR_Free        [prmem.c:430]
            nsMemoryImpl::Free(void *) [nsMemoryImpl.obj:341]
            nsMemory::Free(void *) [nsMemory.cpp:99]
                    if (!ENSURE_ALLOCATOR)
                        return;
                
             =>     gMemory->Free(ptr);
                }
                
                NS_EXPORT nsresult
            nsImportModuleList::ClearList(void) [nsImportService.cpp:759]
                            m_pList[i] = nsnull;
                        }
                        m_count = 0;
             =>         nsMemory::Free( m_pList);
                        m_pList = nsnull;
                        m_alloc = 0;
                    }
            nsImportService::~nsImportService(void) [nsImportService.cpp:211]
                    gImportService = nsnull;
                
                    if (m_pModules != nsnull)
             =>         delete m_pModules;
                
                    IMPORT_LOG0( "* nsImport Service Deleted\n");
                
            nsImportService::`scalar deleting destructor'(UINT) [import.dll]
            nsImportService::Release(void) [nsImportService.cpp:219]
                
                
                
             => NS_IMPL_THREADSAFE_ISUPPORTS1(nsImportService, nsIImportService)
                
                
                NS_IMETHODIMP nsImportService::DiscoverModules( void)
            nsCOMPtr_base::assign_with_AddRef(nsISupports *) [nsCOMPtr.cpp:73]
            PL_DHashTableEnumerate [pldhash.c:601]
            nsComponentManagerImpl::FreeServices(void) 
[nsComponentManager.cpp:1919]
        Allocation location
            new(UINT)      [MSVCRT.DLL]
            nsImportModuleList::AddModule(nsID const&,char const*,WORD 
const*,WORD const*) [nsImportService.cpp:770]
                {
                    if (m_pList == nsnull) {
                        m_alloc = 10;
             =>         m_pList = new ImportModuleDesc *[m_alloc];
                        m_count = 0;
                        memset( m_pList, 0, sizeof( ImportModuleDesc *) * 
m_alloc);
                    }
            nsImportService::LoadModuleInfo(char const*,char const*) 
[nsImportService.cpp:677]
                        theDescription.Assign(NS_LITERAL_STRING("Unknown 
description"));
                
                    // call the module to get the info we need
             =>     m_pModules->AddModule( clsId, pSupports, theTitle.get(), 
theDescription.get());
                
                    module->Release();
                
            nsImportService::DoDiscover(void) [nsImportService.cpp:626]
                        nsXPIDLCString    supportsStr;
                        rv = catMan->GetCategoryEntry( "mailnewsimport", 
contractIdStr, getter_Copies( supportsStr));
                        if (NS_SUCCEEDED( rv)) {
             =>             LoadModuleInfo( contractIdStr, supportsStr);
                        }
                        rv = e->GetNext( getter_AddRefs( contractid));
                    }
            nsImportService::GetModuleCount(char const*,int *) 
[nsImportService.cpp:416]
                    if (! _retval)
                        return NS_ERROR_NULL_POINTER;
                
             =>     DoDiscover();
                
                    if (m_pModules != nsnull) {
                        ImportModuleDesc *    pDesc;
            XPTC_InvokeByIndex [xptcinvoke.cpp:105]
            XPCWrappedNative::CallMethod
(XPCCallContext&,CallMode::XPCWrappedNative) [xpcwrappednative.cpp:1998]
            XPC_WN_CallMethod(JSContext *,JSObject *,UINT,long *,long *) 
[xpcwrappednativejsops.cpp:1266]
            js_Invoke      [jsinterp.c:788]
            js_Interpret   [jsinterp.c:2745]
            js_Invoke      [jsinterp.c:805]
            js_InternalInvoke [jsinterp.c:880]
            JS_CallFunctionValue [jsapi.c:3380]
            nsJSContext::CallEventHandler(void *,void *,UINT,void *,int *,int) 
[nsJSEnvironment.cpp:1016]
            nsJSEventListener::HandleEvent(nsIDOMEvent *) 
[nsJSEventListener.cpp:180]
            nsEventListenerManager::HandleEventSubType(nsListenerStruct 
*,nsIDOMEvent *,nsIDOMEventTarget *,UINT,UINT) [nsEventListenerManager.cpp:1217]
            nsEventListenerManager::HandleEvent(nsIPresContext *,nsEvent 
*,nsIDOMEvent * *,nsIDOMEventTarget *,UINT,nsEventStatus *) 
[nsEventListenerManager.cpp:1890]
            GlobalWindowImpl::HandleDOMEvent(nsIPresContext *,nsEvent 
*,nsIDOMEvent * *,UINT,nsEventStatus *) [nsGlobalWindow.cpp:684]
            DocumentViewerImpl::LoadComplete(UINT) [nsDocumentViewer.obj:1298]
            nsDocShell::EndPageLoad(nsIWebProgress *,nsIChannel *,UINT) 
[nsDocShell.cpp:3734]

Comment 1

[Peter A Jonsson]

Attachment: Patch.

The memory is allocated with new [], use delete [].

Comment 2

[David Bradley]

Comment on attachment 74437 [details] [diff] [review]
Patch.

r=dbradley
Oddly enough it does use delete [] in the other freeing of m_pList.

Comment 3

[Cavin Song]

*** This bug has been marked as a duplicate of 143035 ***

Comment 4

[[e-mail] (gone - use [e-mail] instead)]

verified dup