141162 - Bringing up mail window hangs in nsStrPrivate::GrowCapacity () of the latest build of mozilla 2002043009

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Mitch]

Bringing up the mail window either using "mozilla -mail" commandline
or clicking on the mail icon in the bottom left corner of the main browser
window or using "Window->Mail & Window" menu option makes the whole mozilla
process hang (no multithreadness either).

I have attached both a "pstack" and a "backtrace" from gdb on the hanging
process which shows it's hanging in (short backtrace included here)

(gdb) bt
#0  0xff130a5c in nsStrPrivate::GrowCapacity ()
#1  0xff133b04 in nsCString::SetCapacity ()
#2  0xff133a98 in nsCString::SetLength ()


Doesn't happen with yesterday's build !! Seems to be a regression somewhere.

Comment 1

[Mitch]

Attachment: Process stack (mangled) from the hang

Comment 2

[Mitch]

Attachment: Stacktrace from gdb of a hung mozilla mail process

Comment 3

[Tuukka Tolvanen (sp3000)]

Mail startup hangs on linux too (current cvs). With a new profile, the mail
config wizard runs, and hang happens on clicking 'Finish'. Gilles on
#mozillazine says 2002-04-29-22 cvs build hangs. Linux nightly 2002-04-29-10
works ok.

Comment 4

[Patrick]

on my xp pro i get a 

"the procedure entry point ?Mid@nsAString@@QBEIAAVI@II@Z could not be located in
the dynamic link library xpcom.dll"

Comment 5

[Tuukka Tolvanen (sp3000)]

bug 139633?

Comment 6

[Mitch]

Possibly bug 139633, but that was reported a while ago, and yesterday's build 
from the 29th works fine. It would be easy to verify since the problem is
100% reproduceable and if the patch is integrated tomorrow in the CVS tree,
then we'll find out soon enough.

Comment 7

[R.K.Aa.]

bug 141165 and bug 141182 are likely dups

Comment 8

[Frederic Bezies]

*** Bug 141182 has been marked as a duplicate of this bug. ***

Comment 9

[Robert Kaiser]

Dave: what Tuuka probably meant is that the fix for bug 139633, which was
checked into cvs at 04/29/2002 13:29, might have caused this bug.

Comment 10

[Alec Flett]

was this on a depend build? I've noticed some wierdness on my depend build with
some of these, but a clobber helped.

I'm looking into this anyway..

Comment 11

[Alec Flett]

also, it would be interesting to see if this could be fixed with Substring()

Comment 12

[Mitch]

Assuming a "depend" build is a build without a make clobber,
then no, the cvs build we do on a daily basis is from a make clobber(ed)
build.

Comment 13

[R.K.Aa.]

*** Bug 141196 has been marked as a duplicate of this bug. ***

Comment 14

[Mike Pinkerton (not reading bugmail)]

happens on macos as well.

Comment 15

[R.K.Aa.]

WinXP Pro, clean installations of installer-sea.exe:
2002042908 is fine. 2002043003 feels slow and will freeze when attempting to
start mailnews.

Comment 16

[Alec Flett]

can we get a few other backtraces? I'm still waiting on my build and I'm pretty
sure we'll be stuck in a few other functions as well (I don't think GrowCapacity
is the actual culprit)

Comment 17

[Alec Flett]

Attachment: switch to Substring()

no idea if this will work, but someone want to give this a try?

Comment 18

[Alec Flett]

The only while loop I see in GrowCapacity is the 
      while ( newCapacity < aNewLength )
        newCapacity <<= 1;
loop

can someone tell me if newCapacity is 0? That might help me figure this out.

Comment 19

[Alec Flett]

By the way, a simple fix would be to just back out the changes to string from
bug 139633. I'm still investigating (my builds are almost done) but that can be
the backout plan if we don't find a fix in the next 30 minutes or so

Comment 20

[Alec Flett]

Attachment: make sure newCapacity != 0

how about this? someone want to give this a try?

Comment 21

[Mitch]

Alec: I could get some more backtraces, but they're all the
same and happen immediately once i bring up the mail so i
dunno if that will help much...

I'm trying a build now with the attached patch. Will update
bug as soon as i try it.

Comment 22

[Alec Flett]

yeah, with pinkerton's help, we found that the while loop was due to capacity
being 0... that is particularily strange though.

Comment 23

[Mitch]

Same problem and stack with fix #81680 below.
                                             
#0  0xff130a58 in nsStrPrivate::GrowCapacity ()
#1  0xff133b04 in nsCString::SetCapacity ()    
#2  0xff133a98 in nsCString::SetLength ()  
#3  0xff12797c in nsACString::do_AssignFromReadable ()
#4  0xff127758 in nsACString::AssignFromReadable ()   
#5  0xff187608 in nsACString::Assign () at ./cp/tinfo2.cc:300
#6  0xff192594 in nsCAutoString::operator= () at ./cp/tinfo2.cc:300
#7  0xfb45c838 in NS_MsgCreatePathStringFromFolderURI ()           
#8  0xfb435fac in nsMsgFolder::parseURI ()              
#9  0xfb435458 in nsMsgFolder::GetServer ()

etc....

Comment 24

[Alec Flett]

ah! the problem is that the value being passed in is > 2^31, which means no
matter what newCapacity starts out as, it will eventually overflow and become 0.

I'm trying to figure out how the length would be set to something so high. it
kind of looks like the length is -1, which means its being cast to an unsigned
integer and set to 0xFFFFFFFF

Comment 25

[Mitch]

With patch #81681 applied (along with 81680), my new rebuild hangs with
the same stack...                                                      
                 
Can i get any more infor for you guys ?

Comment 26

[David :Bienvenu]

that uri parsing code is very suspect - it's passing in -1 or -2 at times.

Comment 27

[Oliver Klee]

*** Bug 141213 has been marked as a duplicate of this bug. ***

Comment 28

[David :Bienvenu]

Attachment: proposed fix

this fixes the hang for me.

Comment 29

[Alec Flett]

Comment on attachment 81689 [details] [diff] [review]
proposed fix

ah! I figured it out!


oh. I see bienvenu did too..

this is EXACTLY my fix too. the problem was that oldPath.FindChar(...) was
returning '-1', and then we were substracting 1 from that, which made
endSlashPos -2.. when cast to a PRUint32, it became a very large number.
sr=alecf

Comment 30

[Brian Nesse (gone)]

Comment on attachment 81689 [details] [diff] [review]
proposed fix

r=bnesse.

Comment 31

[David :Bienvenu]

I've checked in my patch, which should fix the hang. I think we should
understand the problem better, however.

Comment 32

[David :Bienvenu]

*** Bug 141154 has been marked as a duplicate of this bug. ***

Comment 33

[Tracy Walker [:tracy]]

respins look good. Mail is testable/usable.

linux 2002-04-30-10-trunk
mac os9 2002-04-30-10-trunk

Comment 34

[Patrick]

xp pro, 2002-04-30-10-trunk works as well

Comment 35

[jag (Peter Annema)]

Why did this code work fine for over a year and has it started acting up
yesterday?

Comment 36

[R.K.Aa.]

*** Bug 141165 has been marked as a duplicate of this bug. ***

Comment 37

[David Bradley]

I wondered that myself. I assumed that something else besides "/" was getting
past in before, maybe an empty string instead? I fully expected this to only fix
the symptom and the real question was why "/" was getting passed in.