Application crashes when marking a message as Spam
Categories
(Thunderbird :: Folder and Message Lists, defect, P1)
Tracking
(thunderbird_esr102 unaffected, thunderbird111 verified)
Tracking | Status | |
---|---|---|
thunderbird_esr102 | --- | unaffected |
thunderbird111 | --- | verified |
People
(Reporter: aleca, Assigned: mkmelin)
References
(Regression)
Details
(Keywords: crash, regression)
Crash Data
Attachments
(1 file)
Marking a message as Spam from the message list or the message pane make the application crash.
Comment 1•1 year ago
|
||
Regression range: https://hg.mozilla.org/comm-central/pushloghtml?fromchange=f026f940e730940506abd71e5966034bbc2d43ec&tochange=8fcf5784a4ae6cc0d32fe40ab79459e98f8999b0
Probably from Bug 1812453
Updated•1 year ago
|
Updated•1 year ago
|
Comment 2•1 year ago
|
||
Do we hvae a crash ID?
Comment 3•1 year ago
|
||
It doesn't trigger the crash reporter for me (nor are there any crash reports listed in the profile). Instead the application exits with code 11 and I get a couple logs of Exiting due to channel error.
. Next step is probably to see if there's more usable information in the debug build.
Comment 4•1 year ago
|
||
I suspect bp-bb5518cf-6f1f-4941-95a8-ee44b0230201 is an example
0 mozglue.dll mozilla::detail::InvalidArrayIndex_CRASH(unsigned long long, unsigned long long) mfbt/Assertions.cpp:50
1 xul.dll nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::ElementAt(unsigned long long) xpcom/ds/nsTArray.h:1194
1 xul.dll nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::operator[](unsigned long long) xpcom/ds/nsTArray.h:1231
1 xul.dll nsMsgDatabase::SetStringPropertyByHdr(nsIMsgDBHdr*, char const*, char const*) mailnews/db/msgdb/src/nsMsgDatabase.cpp:2183
2 xul.dll nsMsgDatabase::SetStringProperty(unsigned int, char const*, char const*) mailnews/db/msgdb/src/nsMsgDatabase.cpp:2122
3 xul.dll nsMsgDBView::SetMsgHdrJunkStatus(nsIJunkMailPlugin*, nsIMsgDBHdr*, unsigned int) mailnews/base/src/nsMsgDBView.cpp:3340
4 xul.dll nsMsgDBView::ApplyCommandToIndices(int, nsTArray<unsigned int> const&) mailnews/base/src/nsMsgDBView.cpp:2931
5 xul.dll nsMsgDBView::DoCommand(int) mailnews/base/src/nsMsgDBView.cpp:2523
Updated•1 year ago
|
Assignee | ||
Comment 5•1 year ago
|
||
Yeah that's the one. Not a debug build, but ...
Thread 1 "thunderbird" received signal SIGSEGV, Segmentation fault.
mozilla::detail::InvalidArrayIndex_CRASH (aIndex=aIndex@entry=4, aLength=<optimized out>) at /home/magnus/Code/tb/mozilla/mfbt/Assertions.cpp:50
50 MOZ_CRASH_UNSAFE_PRINTF("ElementAt(aIndex = %zu, aLength = %zu)", aIndex,
(gdb) bt
#0 mozilla::detail::InvalidArrayIndex_CRASH(unsigned long, unsigned long) (aIndex=aIndex@entry=4, aLength=<optimized out>) at /home/magnus/Code/tb/mozilla/mfbt/Assertions.cpp:50
#1 0x00007ffff2a2edd7 in nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::ElementAt(unsigned long) (this=0x7fffffff6e00, aIndex=4)
at /home/magnus/Code/tb/mozilla/obj-x86_64-pc-linux-gnu/dist/include/nsTArray.h:1194
#2 nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::operator[](unsigned long) (this=0x7fffffff6e00, aIndex=4)
at /home/magnus/Code/tb/mozilla/obj-x86_64-pc-linux-gnu/dist/include/nsTArray.h:1231
#3 nsMsgDatabase::SetStringPropertyByHdr(nsIMsgDBHdr*, char const*, char const*) (this=<optimized out>, msgHdr=0x7fffa56772e0, aProperty=0x7fffec21dfb0 "junkscore", aValue=0x7fffffff6f1c "100")
at /home/magnus/Code/tb/mozilla/comm/mailnews/db/msgdb/src/nsMsgDatabase.cpp:2175
#4 0x00007ffff2a2e9a7 in nsMsgDatabase::SetStringProperty(unsigned int, char const*, char const*)
(this=0x7fffa4bf8240, aKey=<optimized out>, aProperty=0x7fffec21dfb0 "junkscore", aValue=0x7fffffff6f1c "100") at /home/magnus/Code/tb/mozilla/comm/mailnews/db/msgdb/src/nsMsgDatabase.cpp:2122
#5 0x00007ffff2973906 in nsMsgDBView::SetMsgHdrJunkStatus(nsIJunkMailPlugin*, nsIMsgDBHdr*, unsigned int)
(this=<optimized out>, aJunkPlugin=0x7fffa5cbe5c0, aMsgHdr=<optimized out>, aNewClassification=2) at /home/magnus/Code/tb/mozilla/comm/mailnews/base/src/nsMsgDBView.cpp:3340
#6 0x00007ffff29730e8 in nsMsgDBView::ApplyCommandToIndices(int, nsTArray<unsigned int> const&) (this=0x7fffa4b48ab0, command=27, selection=<optimized out>)
at /home/magnus/Code/tb/mozilla/comm/mailnews/base/src/nsMsgDBView.cpp:2931
#7 0x00007ffff2971a72 in nsMsgDBView::DoCommand(int) (this=0x7fffa4b48ab0, command=27) at /home/magnus/Code/tb/mozilla/comm/mailnews/base/src/nsMsgDBView.cpp:2523
Assignee | ||
Comment 6•1 year ago
|
||
Length of the m_ChangeListeners will change during the loop (adding one in my case), which makes accessing statusArray[i] go out of bounds.
I don't know why a listener is added mid-flight.
browser_junkCommands.js should have caught it, but it's currently disabled (by bug 1787094)
Updated•1 year ago
|
Assignee | ||
Updated•1 year ago
|
Pushed by mkmelin@iki.fi:
https://hg.mozilla.org/comm-central/rev/0846ad7c99ba
Fix crash when marking a message as Spam. r=freaktechnik
Comment 8•1 year ago
|
||
Thanks for the fix.
No crashes so far with Feb 3 or Feb 4 builds, as judged by looking at "Build id".
https://crash-stats.mozilla.org/signature/?signature=mozilla%3A%3Adetail%3A%3AInvalidArrayIndex_CRASH%20%7C%20nsTArray_Impl%3CT%3E%3A%3AElementAt%20%7C%20nsTArray_Impl%3CT%3E%3A%3Aoperator%5B%5D%20%7C%20nsMsgDatabase%3A%3ASetStringPropertyByHdr&date=%3E%3D2023-01-28T00%3A00%3A00.000Z&date=%3C2023-02-04T23%3A59%3A00.000Z#aggregations
Assignee | ||
Updated•1 year ago
|
Description
•