1581766 - Crash in [@ arena_t::DallocSmall | je_free | nsIMAPGenericParser::AdvanceToNextToken] via nsImapServerResponseParser

Status: RESOLVED WORKSFORME

(MailNews Core :: Networking: IMAP, defect)

Description

[Wayne Mery (:wsmwk)]

Two distinct issues for same signature?

bp-2f89e53e-29f9-4bd7-8471-c2c650190917.

Top 10 frames of crashing thread:

0 mozglue.dll arena_t::DallocSmall memory/build/mozjemalloc.cpp:3260
1 mozglue.dll je_free memory/build/malloc_decls.h:41
2 xul.dll nsIMAPGenericParser::AdvanceToNextToken comm/mailnews/imap/src/nsIMAPGenericParser.cpp:95
3 xul.dll nsImapServerResponseParser::ParseIMAPServerResponse comm/mailnews/imap/src/nsImapServerResponseParser.cpp:194
4 xul.dll nsImapProtocol::FetchMessage comm/mailnews/imap/src/nsImapProtocol.cpp:3583
5 xul.dll nsImapProtocol::FetchTryChunking comm/mailnews/imap/src/nsImapProtocol.cpp:3629
6 xul.dll nsIMAPBodypart::GeneratePart comm/mailnews/imap/src/nsIMAPBodyShell.cpp:413
7 xul.dll nsIMAPBodypartLeaf::Generate comm/mailnews/imap/src/nsIMAPBodyShell.cpp:529
8 xul.dll nsIMAPBodypartMultipart::Generate comm/mailnews/imap/src/nsIMAPBodyShell.cpp:894
9 xul.dll nsIMAPBodypartMultipart::Generate comm/mailnews/imap/src/nsIMAPBodyShell.cpp:894

bp-62dfac52-f6fa-46d5-8419-85bcb0190917

 0 	mozglue.dll	arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*)	memory/build/mozjemalloc.cpp:3257 	context
1 	mozglue.dll	je_free	memory/build/malloc_decls.h:41 	cfi
2 	xul.dll	nsIMAPGenericParser::AdvanceToNextToken()	comm/mailnews/imap/src/nsIMAPGenericParser.cpp:95 	cfi
3 	xul.dll	nsImapServerResponseParser::response_fatal()	comm/mailnews/imap/src/nsImapServerResponseParser.cpp:1836 	cfi
4 	xul.dll	nsImapServerResponseParser::ParseIMAPServerResponse(char const*, bool, char*)	comm/mailnews/imap/src/nsImapServerResponseParser.cpp:259 	cfi
5 	xul.dll	nsImapProtocol::ParseIMAPandCheckForNewMail(char const*, bool)	comm/mailnews/imap/src/nsImapProtocol.cpp:1903 	cfi
6 	xul.dll	nsImapProtocol::FetchMessage(nsTString<char> const&, nsIMAPeFetchFields, char const*, unsigned int, unsigned int, char*)	comm/mailnews/imap/src/nsImapProtocol.cpp:3583 	cfi
7 	xul.dll	nsImapProtocol::FetchTryChunking(nsTString<char> const&, nsIMAPeFetchFields, bool, char*, unsigned int, bool)	comm/mailnews/imap/src/nsImapProtocol.cpp:3629 	cfi
8 	xul.dll	nsIMAPBodypart::GeneratePart(nsIMAPBodyShell*, bool, bool)	comm/mailnews/imap/src/nsIMAPBodyShell.cpp:413 	cfi
9 	xul.dll	nsIMAPBodypartLeaf::Generate(nsIMAPBodyShell*, bool, bool)	comm/mailnews/imap/src/nsIMAPBodyShell.cpp:529 	cfi
10 	xul.dll	nsIMAPBodypartMultipart::Generate(nsIMAPBodyShell*, bool, bool)	comm/mailnews/imap/src/nsIMAPBodyShell.cpp:894 	cfi

And slightly different signature arena_t::DallocSmall | je_free | nsIMAPGenericParser::AdvanceToNextLine
bp-e0b309d1-dbb5-4589-a2b9-1b5c10190917

 0 	mozglue.dll	arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*)	memory/build/mozjemalloc.cpp:3260
1 	mozglue.dll	je_free	memory/build/malloc_decls.h:41
2 	xul.dll	nsIMAPGenericParser::AdvanceToNextLine()	comm/mailnews/imap/src/nsIMAPGenericParser.cpp:116
3 	xul.dll	nsImapServerResponseParser::msg_fetch_literal(bool, int)	comm/mailnews/imap/src/nsImapServerResponseParser.cpp:2693
4 	xul.dll	nsImapServerResponseParser::msg_fetch_content(bool, int, char const*)	comm/mailnews/imap/src/nsImapServerResponseParser.cpp:1876
5 	xul.dll	nsImapServerResponseParser::msg_fetch()	comm/mailnews/imap/src/nsImapServerResponseParser.cpp:0
6 	xul.dll	nsImapServerResponseParser::response_data()	comm/mailnews/imap/src/nsImapServerResponseParser.cpp:653
7 	xul.dll	nsImapServerResponseParser::ParseIMAPServerResponse(char const*, bool, char*)	comm/mailnews/imap/src/nsImapServerResponseParser.cpp:188
8 	xul.dll	nsImapProtocol::FetchMessage(nsTString<char> const&, nsIMAPeFetchFields, char const*, unsigned int, unsigned int, char*)	comm/mailnews/imap/src/nsImapProtocol.cpp:3583
9 	xul.dll	nsImapProtocol::FetchTryChunking(nsTString<char> const&, nsIMAPeFetchFields, bool, char*, unsigned int, bool)	comm/mailnews/imap/src/nsImapProtocol.cpp:3611
10 	xul.dll	nsIMAPBodypart::GeneratePart(nsIMAPBodyShell*, bool, bool)	comm/mailnews/imap/src/nsIMAPBodyShell.cpp:413 

Comment 1

[Wayne Mery (:wsmwk)]

xref Bug 1264302 - Random crash getting new email in nsImapServerResponseParser::msg_fetch_literal. Made worse by, but not caused by, fetch_by_chunks - which was closed fixed two years ago because of Bug 1264302 - Random crash getting new email in nsImapServerResponseParser::msg_fetch_literal. Made worse by, but not caused by, fetch_by_chunks

Comment 2

[Wayne Mery (:wsmwk)]

Magnus, does this make sense to you?
Gene didn't know what to make of this in bug 628646.

On betas we have arena_t::DallocSmall | arena_dalloc | Allocator<T>::free | nsIMAPGenericParser::AdvanceToNextToken
For example bp-bb8d1518-3fc3-4edb-9899-203b40200327
0 mozglue.dll arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*) memory/build/mozjemalloc.cpp:3335
1 mozglue.dll arena_dalloc(void*, unsigned int, arena_t*) memory/build/mozjemalloc.cpp:3374
2 mozglue.dll static Allocator<MozJemallocBase>::free(void*) memory/build/malloc_decls.h:54
3 xul.dll nsIMAPGenericParser::AdvanceToNextToken() comm/mailnews/imap/src/nsIMAPGenericParser.cpp:95
4 xul.dll nsImapServerResponseParser::ParseIMAPServerResponse(char const*, bool, char*) comm/mailnews/imap/src/nsImapServerResponseParser.cpp:194
5 xul.dll nsImapProtocol::ParseIMAPandCheckForNewMail(char const*, bool) comm/mailnews/imap/src/nsImapProtocol.cpp:1932
6 xul.dll nsImapProtocol::FetchMessage(nsTString<char> const&, <unnamed-tag>, char const*, unsigned int, unsigned int, char*) comm/mailnews/imap/src/nsImapProtocol.cpp:3610
7 xul.dll nsImapProtocol::ProcessSelectedStateURL() comm/mailnews/imap/src/nsImapProtocol.cpp:2586
8 xul.dll nsImapProtocol::ProcessCurrentURL() comm/mailnews/imap/src/nsImapProtocol.cpp:1786
9 xul.dll nsImapProtocol::ImapThreadMainLoop() comm/mailnews/imap/src/nsImapProtocol.cpp:1429
10 xul.dll nsImapProtocol::Run() comm/mailnews/imap/src/nsImapProtocol.cpp:1111

Comment 3

[Magnus Melin [:mkmelin]]

https://searchfox.org/comm-central/rev/36361fb3e76ab8f11bc59524f444269ff6ae84d0/mailnews/imap/src/nsIMAPGenericParser.cpp#95
No idea.

Comment 4

[Wayne Mery (:wsmwk)]

Like Bug 1333031 - Crash in nsImapServerResponseParser::msg_fetch - the crash rate here is about half what it was 6 months ago.

Conversely the significant drop in crash rate for the blocking bug 628646 (nsImapServerResponseParser::ProcessOkCommand during chunking) hasn't translated to helping here.

https://crash-stats.mozilla.org/signature/?signature=arena_t%3A%3ADallocSmall%20%7C%20je_free%20%7C%20nsIMAPGenericParser%3A%3AAdvanceToNextToken&date=%3E%3D2020-06-26T18%3A42%3A00.000Z&date=%3C2020-12-26T18%3A42%3A00.000Z&_sort=-date#graphs

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #4)

Like Bug 1333031 - Crash in nsImapServerResponseParser::msg_fetch - the crash rate here is about half what it was 6 months ago.

Ranking approx 50

Comment 6

[Wayne Mery (:wsmwk)]

No longer a crash for current versions - like bug 1581017