1787650 - Crash in [@ nsImapMailFolder::ExpungeAndCompact::<T>::operator()]

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect, P1)

Description

[Wayne Mery (:wsmwk)]

https://crash-stats.mozilla.org/signature/?product=Thunderbird&signature=nsImapMailFolder%3A%3AExpungeAndCompact%3A%3A%3CT%3E%3A%3Aoperator%28%29&date=%3E%3D2022-05-28T12%3A30%3A00.000Z&date=%3C2022-08-28T12%3A30%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-date&page=1#reports

Topcrash for 105.0a1 and 105.0b1. With crashes starting on 2022-08-05, this is then regression of bug 1782374.

Crash report: https://crash-stats.mozilla.org/report/index/e5b82293-cb28-408b-ac2f-c52010220812

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll nsImapMailFolder::ExpungeAndCompact::<lambda_1>::operator const mailnews/imap/src/nsImapMailFolder.cpp:1281
1 xul.dll UrlListener::OnStopRunningUrl mailnews/base/src/UrlListener.h:77
2 xul.dll nsMsgMailNewsUrl::SetUrlState mailnews/base/src/nsMsgMailNewsUrl.cpp:232
3 xul.dll nsImapMailFolder::SetUrlState mailnews/imap/src/nsImapMailFolder.cpp:6286
4 xul.dll `anonymous namespace'::SyncRunnable5<nsIImapMailFolderSink, nsIImapProtocol*, nsIMsgMailNewsUrl*, bool, bool, nsresult>::Run mailnews/imap/src/nsSyncRunnableHelpers.cpp:221
5 xul.dll mozilla::RunnableTask::Run xpcom/threads/TaskController.cpp:538
6 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:851
7 xul.dll mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:683
8 xul.dll mozilla::TaskController::ProcessPendingMTTask xpcom/threads/TaskController.cpp:461
9 xul.dll mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:187:7'>::Run xpcom/threads/nsThreadUtils.h:531

Comment 1

[Ben Campbell]

Ahh... I think I was so fixated on getting the listener invocation working properly, that I failed to take into account the case where a listener isn't passed in :-)

I think I've got a simple fix.
Try run here:
https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=eccbb8e4470e282802f00119c007bb1855e0d39f

Comment 2

[Ben Campbell]

Attachment: Bug 1787650 - Fix crash on null listener in IMAP compaction/expunge. r=mkmelin

Comment 3

[Wayne Mery (:wsmwk)]

Just to be clear, I don't have a real user reporting this.

Comment 4

[Ben Campbell]

(In reply to Wayne Mery (:wsmwk) from comment #3)

Just to be clear, I don't have a real user reporting this.

yep, and no replication case. So I guess it's a matter of landing the patch and leaving the bug open to see if the crash reports dry up?

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/b92dd8ee2aff
Fix crash on null listener in IMAP compaction/expunge. r=mkmelin

Comment 6

[Magnus Melin [:mkmelin]]

Let's not leave it open. It certainly fixes some cases. If needed, a new bug is easier, also for uplifting purposes.

Comment 7

[Rob Lemley [:rjl]]

Comment on attachment 9291942 [details]
Bug 1787650 - Fix crash on null listener in IMAP compaction/expunge. r=mkmelin

[Triage Comment]
Approved for 105.0b2 (per wsmwk)

Comment 8

[Daniel Darnell [:dandarnell]]

Thunderbird 105.0b2:
https://hg.mozilla.org/releases/comm-beta/rev/86313a666ac3

Comment 9

[Wayne Mery (:wsmwk)]

Thanks.
Doesn't exist in 105.0b2.