1609849 - Thunderbird crashes when trying to delete attachments from multiple messages (e.g. FiltaQuilla)

Status: RESOLVED FIXED

(Thunderbird :: General, defect)

Description

[Sean M. Pappalardo]

Attachment: Stack trace showing the crash

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

1. Install FiltaQulla add-on
2. Set up a filter to detach attachments to a file system folder
3. Run this filter on a folder with 2000 or more messages. (I tested with 9995.)
4. Wait for the crash.

Actual results:

Thunderbird crashes at https://hg.mozilla.org/releases/comm-esr68/file/tip/mailnews/base/src/nsMessenger.cpp#l2547

Expected results:

Attachments from all matched messages should have been detached successfully.

Comment 1

[Sean M. Pappalardo]

jcranmer in IRC took a look at the trace and thinks that replacing line 148 of nsMessenger.cpp with:
mozilla::RefPtr<nsMessenger> m_messenger;
...may fix the issue. (I would try but don't have a build env set up yet.)

Comment 2

[Sean M. Pappalardo]

Cross-reference FiltaQuilla bug #1

Comment 3

[Wayne Mery (:wsmwk)]

found on crash-stats:

• bp-35f0b6ac-07fb-45ae-94ea-96a7a0200117 Crash Address 0xe5e5e5e5
  0 xul.dll nsDelAttachListener::StartProcessing(nsMessenger*, nsIMsgWindow*, nsAttachmentState*, bool) comm/mailnews/base/src/nsMessenger.cpp:2547 context
  1 xul.dll nsMessenger::DetachAttachments(unsigned int, char const**, char const**, char const**, char const**, nsTArray<nsTString<char> >, bool) comm/mailnews/base/src/nsMessenger.cpp:2744 cfi
  2 xul.dll nsSaveMsgListener::OnStopRequest(nsIRequest, nsresult) comm/mailnews/base/src/nsMessenger.cpp:1736 cfi
  3 xul.dll nsStreamConverter::OnStopRequest(nsIRequest*, nsresult) comm/mailnews/mime/src/nsStreamConverter.cpp:945 cfi
  4 xul.dll mozilla::net::nsStreamListenerTee::OnStopRequest(nsIRequest*, nsresult) netwerk/base/nsStreamListenerTee.cpp:41 cfi
  5 xul.dll nsresult `anonymous namespace'::SyncRunnable2<nsIImapMailFolderSink, const char*, nsIImapUrl*>::Run() comm/mailnews/imap/src/nsSyncRunnableHelpers.cpp:121 cfi

• bp-922fd4f1-c965-49fa-be7e-44aab0200116 Crash Address 0xffffffffffffffff
  0 xul.dll nsDelAttachListener::StartProcessing(nsMessenger*, nsIMsgWindow*, nsAttachmentState*, bool) comm/mailnews/base/src/nsMessenger.cpp:2547 context
  1 xul.dll nsMessenger::DetachAttachments(unsigned int, char const**, char const**, char const**, char const**, nsTArray<nsTString<char> >, bool) comm/mailnews/base/src/nsMessenger.cpp:2744 cfi
  2 xul.dll nsSaveMsgListener::OnStopRequest(nsIRequest, nsresult) comm/mailnews/base/src/nsMessenger.cpp:1736 cfi
  3 xul.dll nsStreamConverter::OnStopRequest(nsIRequest*, nsresult) comm/mailnews/mime/src/nsStreamConverter.cpp:945 cfi
  4 xul.dll nsImapCacheStreamListener::OnStopRequest(nsIRequest*, nsresult) comm/mailnews/imap/src/nsImapProtocol.cpp:8439 cfi
  5 xul.dll nsInputStreamPump::OnStateStop() netwerk/base/nsInputStreamPump.cpp:655 cfi
  6 xul.dll nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) netwerk/base/nsInputStreamPump.cpp:403 cfi

Also found
nsDelAttachListener::OnStopRequest bp-31f61f45-0ad4-4df1-af3a-648ad0200110
<name omitted> | nsDelAttachListener::StartProcessing bp-f1bb1676-0cba-4575-870d-99f150191220 Mac

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Sean M. Pappalardo from comment #1)

jcranmer in IRC took a look at the trace and thinks that replacing line 148 of nsMessenger.cpp with:
mozilla::RefPtr<nsMessenger> m_messenger;
...may fix the issue. (I would try but don't have a build env set up yet.)

The current line 148 is not ref counted.

Comment 5

[Magnus Melin [:mkmelin]]

Attachment: bug1609849crash@nsDelAttachListener_StartProcessing.patch

I guess the question is why this wasn't used in the first place. But it's an ancient line...

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/e4eb5222e198
fix crash @ nsDelAttachListener::StartProcessing . r=benc