1580187 - Crash in [@ nsImapService::NewChannel]

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect, critical)

Description

[Wayne Mery (:wsmwk)]

#14 crash for Thunderbird 68.0. Signature does not appear in any prior betas or nightlies. Assuming regression.

This bug is for crash report bp-eeab81a4-093a-4e61-8924-278ee0190910.

Top 10 frames of crashing thread:

0 xul.dll nsImapService::NewChannel comm/mailnews/imap/src/nsImapService.cpp:2549
1 xul.dll mozilla::net::nsIOService::NewChannelFromURIWithProxyFlagsInternal netwerk/base/nsIOService.cpp:959
2 xul.dll mozilla::net::nsIOService::NewChannelFromURIWithProxyFlagsInternal netwerk/base/nsIOService.cpp:931
3 xul.dll mozilla::net::nsIOService::NewChannelFromURIWithClientAndController netwerk/base/nsIOService.cpp:871
4 xul.dll NS_NewChannelInternal netwerk/base/nsNetUtil.cpp:368
5 xul.dll NS_NewChannelWithTriggeringPrincipal netwerk/base/nsNetUtil.cpp:429
6 xul.dll static nsresult NewImageChannel image/imgLoader.cpp:813
7 xul.dll imgLoader::LoadImage image/imgLoader.cpp:2208
8 xul.dll nsContentUtils::LoadImage dom/base/nsContentUtils.cpp:3321
9 xul.dll mozilla::dom::Document::MaybePreLoadImage dom/base/Document.cpp:8680

Comment 1

[Jorg K (GMT+2)]

Attachment: 1580187-dont-crash-NewChannel.patch

Strange, imapRoot is checked above, so why not here? And why didn't it crash before?

Comment 2

[Magnus Melin [:mkmelin]]

Comment on attachment 9091734 [details] [diff] [review]
1580187-dont-crash-NewChannel.patch

Review of attachment 9091734 [details] [diff] [review]:
-----------------------------------------------------------------

::: mailnews/imap/src/nsImapService.cpp
@@ +2550,5 @@
> +        rv = imapRoot->FindOnlineSubFolder(fullFolderName,
> +                                           getter_AddRefs(subFolder));
> +        aFolder = do_QueryInterface(subFolder);
> +        if (aFolder) aFolder->GetParent(getter_AddRefs(parent));
> +      }

Maybe better to add the if (imapRoot) to the outer if clause? Otherwise there is a potential mix of what fullFolderName and parent refer to, I think.

Comment 3

[Jorg K (GMT+2)]

Attachment: 1580187-dont-crash-NewChannel.patch

Yes, good catch, you're right, simpler this way.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/ef6aa355a702
Add null check to avoid crash in nsImapService::NewChannel(). r=mkmelin

Comment 5

[Wayne Mery (:wsmwk)]

quite odd - absolutely no crashes in nightly nor beta prior to 68.0 - https://crash-stats.mozilla.org/signature/?release_channel=%21release&signature=nsImapService%3A%3ANewChannel&date=%3E%3D2019-03-13T08%3A57%3A00.000Z&date=%3C2019-09-13T08%3A57%3A00.000Z

perhaps caused by a recent uplift to 68.0 that also somehow didn't cause problems earlier?

Comment 6

[Jorg K (GMT+2)]

TB 70 beta 2:
https://hg.mozilla.org/releases/comm-beta/rev/3a71c5c5ccc1f7f188d5fe4de94900d516769aaa

Comment 7

[Jorg K (GMT+2)]

TB 68.1.1 ESR:
https://hg.mozilla.org/releases/comm-esr68/rev/a324dcba33be14218d39dea1197ddeed2c3baad5