Open Bug 1400432 Opened 2 years ago Updated Last month

Crash in nsImapCancelProxy::Run

Categories

(MailNews Core :: Networking: IMAP, defect, critical)

x86
All
defect
Not set
critical

Tracking

(thunderbird_esr6063+ fixed, thunderbird63 fixed, thunderbird64 fixed)

REOPENED
Thunderbird 64.0
Tracking Status
thunderbird_esr60 63+ fixed
thunderbird63 --- fixed
thunderbird64 --- fixed

People

(Reporter: wsmwk, Unassigned)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Crash rate is low and doesn't happen with a recent build (most recent is bp-686a2b42-8bc7-42dc-8539-a628b0170912 	2017-09-12 56.0b3 buildid 20170819123318) but I'll forget about it later so it needs to be rechecked some period of time after nightly updates resume.

First crash on record in last 6 months is  bp-ed6c3706-e9b1-49bb-95d5-85c8d0170526 buildid 20170518114447 54.0b1
 0 	xul.dll	nsImapCancelProxy::Run()	C:/builds/moz2_slave/tb-rel-c-beta-w32_bld-00000000/build/mailnews/imap/src/nsImapProtocol.cpp:1063
1 	xul.dll	nsThreadSyncDispatch::Run()	xpcom/threads/nsThreadSyncDispatch.h:38
2 	xul.dll	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp:1264
3 	xul.dll	NS_ProcessNextEvent(nsIThread*, bool)	xpcom/threads/nsThreadUtils.cpp:389
4 	xul.dll	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)	ipc/glue/MessagePump.cpp:96
Flags: needinfo?(vseerror)
class nsImapCancelProxy : public mozilla::Runnable {
public:
  nsImapCancelProxy(nsICancelable *aProxyRequest)
    : mozilla::Runnable("nsImapCancelProxy"), m_proxyRequest(aProxyRequest) {
  }
  NS_IMETHOD Run() {
    m_proxyRequest->Cancel(NS_BINDING_ABORTED); <==
    return NS_OK;
  }
private:
  nsCOMPtr<nsICancelable> m_proxyRequest;
};

should crash there since this is only called when 'm_proxyRequest' wasn't null.
I've checked the first tree reports and they all crash here:
  comm/mailnews/imap/src/nsImapProtocol.cpp:1040
which is the line shown in comment #1.

I'll submit a patch now.
Flags: needinfo?(jorgk)
I also renamed m_proxyRequest since the protocol already has a member with that name.

I'm not sure that it helps since this is only called if m_proxyRequest is already non-null. Perhaps Magnus can spot something.
Attachment #9014102 - Flags: review?(mkmelin+mozilla)
Comment on attachment 9014102 [details] [diff] [review]
1400432-proxy-crash.patch

Review of attachment 9014102 [details] [diff] [review]:
-----------------------------------------------------------------

Let's try it. r=mkmelin
Attachment #9014102 - Flags: review?(mkmelin+mozilla) → review+
Pushed by mozilla@jorgk.com:
https://hg.mozilla.org/comm-central/rev/37c79adc0b98
Fix crash in nsImapCancelProxy::Run(). r=mkmelin
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → Thunderbird 64.0
Attachment #9014102 - Flags: approval-comm-esr60?
Attachment #9014102 - Flags: approval-comm-beta+
Attachment #9014102 - Flags: approval-comm-esr60? → approval-comm-esr60+

There are still crashes at line 1040. But perhaps a different cause?

bp-a8142738-59ac-4d86-b1ce-c527e0190806 60.8.0
bp-b5b253ed-11e6-4b17-96ea-8f98f0190717 60.7.2
bp-48641e7c-3dd2-464c-b7f8-46f1d0190614 60.7.0

Flags: needinfo?(jorgk)
Regressed by: 1344538

Well, we weren't sure whether the "fix" would help. It didn't.

  NS_IMETHOD Run() {
    if (mRequest)
1040   mRequest->Cancel(NS_BINDING_ABORTED);

So we know mRequest isn't null, but it's stale, so dereferencing crashes. That's harder to fix.

Status: RESOLVED → REOPENED
Flags: needinfo?(jorgk)
Resolution: FIXED → ---
You need to log in before you can comment on or make changes to this bug.