1851293 - Crash in [@ arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | nsImapProtocol::DeleteSubFolders] emptying Trash folder with mark as deleted

Status: VERIFIED FIXED

(MailNews Core :: Networking: IMAP, defect, P2)

Description

[Wayne Mery (:wsmwk)]

#1 crash for beta

First Crash report 118.0a1 buildid 20230816102333: https://crash-stats.mozilla.org/report/index/dda87b00-0a28-47fa-8b06-1c3af0230902

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(diff == regind * size)

Top 10 frames of crashing thread:

0  mozglue.dll  arena_run_reg_dalloc  memory/build/mozjemalloc.cpp:2570
0  mozglue.dll  arena_t::DallocSmall  memory/build/mozjemalloc.cpp:3713
1  mozglue.dll  arena_dalloc  memory/build/mozjemalloc.cpp:3809
2  xul.dll  nsImapProtocol::DeleteSubFolders  mailnews/imap/src/nsImapProtocol.cpp:6953
3  xul.dll  nsImapProtocol::ProcessSelectedStateURL  mailnews/imap/src/nsImapProtocol.cpp:3077
4  xul.dll  nsImapProtocol::ProcessCurrentURL  mailnews/imap/src/nsImapProtocol.cpp:2004
5  xul.dll  nsImapProtocol::ImapThreadMainLoop  mailnews/imap/src/nsImapProtocol.cpp:1546
6  xul.dll  nsImapProtocol::RunImapThreadMainLoop  mailnews/imap/src/nsImapProtocol.cpp:1150
7  xul.dll  nsImapProtocolMainLoopRunnable::Run  mailnews/imap/src/nsImapProtocol.cpp:467
8  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1193

Comment 1

[gene smith]

Very easy to duplicate: Create an imap folder A with subfolder B, CC and DD. Not sure it matters what they are called. Then delete folder A. Crash.
This may have something to do with bug 1848264 since it touched code in this area. (Lots of allocating and freeing going on here when deleting subfolders.)

Comment 2

[gene smith]

Actually, crash on delete of top level parent folder only occurs if your delete model is "just mark deleted". If using move to trash, you don't see the crash until you empty the deleted folder tree from trash.

Comment 3

[Wayne Mery (:wsmwk)]

(In reply to gene smith from comment #1)

This may have something to do with bug 1848264 since it touched code in this area. (Lots of allocating and freeing going on here when deleting subfolders.)

Indeed It fits the time frame

Comment 4

[Magnus Melin [:mkmelin]]

It's crashing since we're freeing the memory of an nsCString which went away. https://searchfox.org/comm-central/rev/8dd2eb58861612e3afa78e00e8f5b10ab4591e40/mailnews/imap/src/nsImapProtocol.cpp#6940,6943,6953

But, I think thing we need to get rid of a bit more old string handling, which is causing the trouble to begin with.

Comment 5

[Wayne Mery (:wsmwk)]

Another signature, less common - arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | BaseAllocator::free | Allocator<T>::free | nsImapProtocol::DeleteSubFolders bp-a302c400-977e-4def-8276-0228e0230904

Comment 6

[Magnus Melin [:mkmelin]]

Attachment: Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

Minimal fix.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/894d89f64450
Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

Comment 8

[Wayne Mery (:wsmwk)]

So far no crashes for nightly builds Sept 6, 7, 8
https://crash-stats.mozilla.org/signature/?release_channel=nightly&signature=arena_run_reg_dalloc%20%7C%20arena_t%3A%3ADallocSmall%20%7C%20arena_dalloc%20%7C%20nsImapProtocol%3A%3ADeleteSubFolders&date=%3E%3D2023-06-08T00%3A00%3A00.000Z&date=%3C2023-09-08T23%3A59%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-date&page=1#reports

Comment 10

[Wayne Mery (:wsmwk)]

Comment on attachment 9351474 [details]
Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

[Triage Comment]

Comment 11

[Wayne Mery (:wsmwk)]

Comment on attachment 9351474 [details]
Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

[Triage Comment]
Approved for beta

Comment 12

[Daniel Darnell [:dandarnell]]

Thunderbird 118.0b3:
https://hg.mozilla.org/releases/comm-beta/rev/8e6ec8f43b65

Comment 13

[Wayne Mery (:wsmwk)]

Magnus, the crash is gone in 118.0b3. Thanks
https://crash-stats.mozilla.org/signature/?product=Thunderbird&version=118.0b&signature=arena_run_reg_dalloc%20%7C%20arena_t%3A%3ADallocSmall%20%7C%20arena_dalloc%20%7C%20nsImapProtocol%3A%3ADeleteSubFolders&date=%3E%3D2023-09-06T00%3A00%3A00.000Z&date=%3C2023-09-13T23%3A59%3A00.000Z#summary

So we need to take this with bug 1848264 to 115, correct?

Comment 14

[Magnus Melin [:mkmelin]]

Comment on attachment 9351474 [details]
Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

[Approval Request Comment]
Needed for bug 1848264

Comment 15

[Wayne Mery (:wsmwk)]

Comment on attachment 9351474 [details]
Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

[Triage Comment]
Approved for esr115

Comment 16

[Daniel Darnell [:dandarnell]]

Thunderbird 115.2.3:
https://hg.mozilla.org/releases/comm-esr115/rev/7799f88543a0

Comment 17

[Wayne Mery (:wsmwk)]

Fixed missed flag