Yep, as Emilio says, the code looks very confused as to what it expects to be running on :-(
There is a comment in the imap thread cleanup:
// Release protocol object on the main thread to avoid destruction of 'this'
// on the IMAP thread, which causes grief for weak references.
Maybe a similar motivation for the mockchannel destruction?
The stack frame for the latest crash capture bp-0bd5b09f-3485-4643-a6ef-2f0ac0191010:
nsImapMockChannel::~nsImapMockChannel() comm/mailnews/imap/src/nsImapProtocol.cpp:8467 (ASSERT)
<name omitted> comm/mailnews/imap/src/nsImapProtocol.cpp:8450
It appears to me that the dtor is being called when
RetryUrl() exits, and it's local
saveMockChannel goes out of scope.
(which, indeed, happens in the imap thread, not the main thread).
saveMockChannel release inside
RetryUrl() can be deferred to the main thread, maybe that'd help? But it seems a bit of a nasty band-aid fix without really understanding what's going on...
(Either way, I think the proper approach - for this and other IMAP bugs - is to sit down and pick through, mapping out all the IMAP code and figure out just what's happening (and on which threads), and if it's sane. Which is on my TODO list, but it's not a small job :-(