Closed Bug 1814452 Opened 1 year ago Closed 1 year ago

Application crashes when marking a message as Spam

Categories

(Thunderbird :: Folder and Message Lists, defect, P1)

Thunderbird 111

Tracking

(thunderbird_esr102 unaffected, thunderbird111 verified)

VERIFIED FIXED
111 Branch
Tracking Status
thunderbird_esr102 --- unaffected
thunderbird111 --- verified

People

(Reporter: aleca, Assigned: mkmelin)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Marking a message as Spam from the message list or the message pane make the application crash.

Keywords: crash
Target Milestone: --- → 111 Branch
Target Milestone: 111 Branch → ---
Version: unspecified → Thunderbird 111

It doesn't trigger the crash reporter for me (nor are there any crash reports listed in the profile). Instead the application exits with code 11 and I get a couple logs of Exiting due to channel error.. Next step is probably to see if there's more usable information in the debug build.

I suspect bp-bb5518cf-6f1f-4941-95a8-ee44b0230201 is an example
0 mozglue.dll mozilla::detail::InvalidArrayIndex_CRASH(unsigned long long, unsigned long long) mfbt/Assertions.cpp:50
1 xul.dll nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::ElementAt(unsigned long long) xpcom/ds/nsTArray.h:1194
1 xul.dll nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::operator[](unsigned long long) xpcom/ds/nsTArray.h:1231
1 xul.dll nsMsgDatabase::SetStringPropertyByHdr(nsIMsgDBHdr*, char const*, char const*) mailnews/db/msgdb/src/nsMsgDatabase.cpp:2183
2 xul.dll nsMsgDatabase::SetStringProperty(unsigned int, char const*, char const*) mailnews/db/msgdb/src/nsMsgDatabase.cpp:2122
3 xul.dll nsMsgDBView::SetMsgHdrJunkStatus(nsIJunkMailPlugin*, nsIMsgDBHdr*, unsigned int) mailnews/base/src/nsMsgDBView.cpp:3340
4 xul.dll nsMsgDBView::ApplyCommandToIndices(int, nsTArray<unsigned int> const&) mailnews/base/src/nsMsgDBView.cpp:2931
5 xul.dll nsMsgDBView::DoCommand(int) mailnews/base/src/nsMsgDBView.cpp:2523

Crash Signature: [@ mozilla::detail::InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | nsTArray_Impl<T>::operator[] | nsMsgDatabase::SetStringPropertyByHdr ]

Yeah that's the one. Not a debug build, but ...

Thread 1 "thunderbird" received signal SIGSEGV, Segmentation fault.
mozilla::detail::InvalidArrayIndex_CRASH (aIndex=aIndex@entry=4, aLength=<optimized out>) at /home/magnus/Code/tb/mozilla/mfbt/Assertions.cpp:50
50	  MOZ_CRASH_UNSAFE_PRINTF("ElementAt(aIndex = %zu, aLength = %zu)", aIndex,
(gdb) bt
#0  mozilla::detail::InvalidArrayIndex_CRASH(unsigned long, unsigned long) (aIndex=aIndex@entry=4, aLength=<optimized out>) at /home/magnus/Code/tb/mozilla/mfbt/Assertions.cpp:50
#1  0x00007ffff2a2edd7 in nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::ElementAt(unsigned long) (this=0x7fffffff6e00, aIndex=4)
    at /home/magnus/Code/tb/mozilla/obj-x86_64-pc-linux-gnu/dist/include/nsTArray.h:1194
#2  nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::operator[](unsigned long) (this=0x7fffffff6e00, aIndex=4)
    at /home/magnus/Code/tb/mozilla/obj-x86_64-pc-linux-gnu/dist/include/nsTArray.h:1231
#3  nsMsgDatabase::SetStringPropertyByHdr(nsIMsgDBHdr*, char const*, char const*) (this=<optimized out>, msgHdr=0x7fffa56772e0, aProperty=0x7fffec21dfb0 "junkscore", aValue=0x7fffffff6f1c "100")
    at /home/magnus/Code/tb/mozilla/comm/mailnews/db/msgdb/src/nsMsgDatabase.cpp:2175
#4  0x00007ffff2a2e9a7 in nsMsgDatabase::SetStringProperty(unsigned int, char const*, char const*)
    (this=0x7fffa4bf8240, aKey=<optimized out>, aProperty=0x7fffec21dfb0 "junkscore", aValue=0x7fffffff6f1c "100") at /home/magnus/Code/tb/mozilla/comm/mailnews/db/msgdb/src/nsMsgDatabase.cpp:2122
#5  0x00007ffff2973906 in nsMsgDBView::SetMsgHdrJunkStatus(nsIJunkMailPlugin*, nsIMsgDBHdr*, unsigned int)
     (this=<optimized out>, aJunkPlugin=0x7fffa5cbe5c0, aMsgHdr=<optimized out>, aNewClassification=2) at /home/magnus/Code/tb/mozilla/comm/mailnews/base/src/nsMsgDBView.cpp:3340
#6  0x00007ffff29730e8 in nsMsgDBView::ApplyCommandToIndices(int, nsTArray<unsigned int> const&) (this=0x7fffa4b48ab0, command=27, selection=<optimized out>)
    at /home/magnus/Code/tb/mozilla/comm/mailnews/base/src/nsMsgDBView.cpp:2931
#7  0x00007ffff2971a72 in nsMsgDBView::DoCommand(int) (this=0x7fffa4b48ab0, command=27) at /home/magnus/Code/tb/mozilla/comm/mailnews/base/src/nsMsgDBView.cpp:2523

Length of the m_ChangeListeners will change during the loop (adding one in my case), which makes accessing statusArray[i] go out of bounds.
I don't know why a listener is added mid-flight.

browser_junkCommands.js should have caught it, but it's currently disabled (by bug 1787094)

Assignee: nobody → mkmelin+mozilla
Status: NEW → ASSIGNED
Target Milestone: --- → 111 Branch

Pushed by mkmelin@iki.fi:
https://hg.mozilla.org/comm-central/rev/0846ad7c99ba
Fix crash when marking a message as Spam. r=freaktechnik

Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: