Closed Bug 1851293 Opened 11 months ago Closed 11 months ago

Crash in [@ arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | nsImapProtocol::DeleteSubFolders] emptying Trash folder with mark as deleted

Categories

(MailNews Core :: Networking: IMAP, defect, P2)

Thunderbird 118
Unspecified
All

Tracking

(thunderbird_esr115 fixed, thunderbird118+ verified, thunderbird119 affected)

VERIFIED FIXED
119 Branch
Tracking Status
thunderbird_esr115 --- fixed
thunderbird118 + verified
thunderbird119 --- affected

People

(Reporter: wsmwk, Assigned: mkmelin)

References

(Regression)

Details

(Keywords: crash, regression, topcrash, Whiteboard: [TM: 115.2.3, blocking bug 1848264])

Crash Data

Attachments

(1 file)

#1 crash for beta

First Crash report 118.0a1 buildid 20230816102333: https://crash-stats.mozilla.org/report/index/dda87b00-0a28-47fa-8b06-1c3af0230902

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(diff == regind * size)

Top 10 frames of crashing thread:

0  mozglue.dll  arena_run_reg_dalloc  memory/build/mozjemalloc.cpp:2570
0  mozglue.dll  arena_t::DallocSmall  memory/build/mozjemalloc.cpp:3713
1  mozglue.dll  arena_dalloc  memory/build/mozjemalloc.cpp:3809
2  xul.dll  nsImapProtocol::DeleteSubFolders  mailnews/imap/src/nsImapProtocol.cpp:6953
3  xul.dll  nsImapProtocol::ProcessSelectedStateURL  mailnews/imap/src/nsImapProtocol.cpp:3077
4  xul.dll  nsImapProtocol::ProcessCurrentURL  mailnews/imap/src/nsImapProtocol.cpp:2004
5  xul.dll  nsImapProtocol::ImapThreadMainLoop  mailnews/imap/src/nsImapProtocol.cpp:1546
6  xul.dll  nsImapProtocol::RunImapThreadMainLoop  mailnews/imap/src/nsImapProtocol.cpp:1150
7  xul.dll  nsImapProtocolMainLoopRunnable::Run  mailnews/imap/src/nsImapProtocol.cpp:467
8  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1193
Flags: needinfo?(mkmelin+mozilla)

Very easy to duplicate: Create an imap folder A with subfolder B, CC and DD. Not sure it matters what they are called. Then delete folder A. Crash.
This may have something to do with bug 1848264 since it touched code in this area. (Lots of allocating and freeing going on here when deleting subfolders.)

Actually, crash on delete of top level parent folder only occurs if your delete model is "just mark deleted". If using move to trash, you don't see the crash until you empty the deleted folder tree from trash.

(In reply to gene smith from comment #1)

This may have something to do with bug 1848264 since it touched code in this area. (Lots of allocating and freeing going on here when deleting subfolders.)

Indeed It fits the time frame

Regressed by: 1848264
Severity: -- → S2
Priority: -- → P2
Summary: Crash in [@ arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | nsImapProtocol::DeleteSubFolders] emptying Trash folder → Crash in [@ arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | nsImapProtocol::DeleteSubFolders] emptying Trash folder with mark as deleted
Assignee: nobody → mkmelin+mozilla
Flags: needinfo?(mkmelin+mozilla)

It's crashing since we're freeing the memory of an nsCString which went away. https://searchfox.org/comm-central/rev/8dd2eb58861612e3afa78e00e8f5b10ab4591e40/mailnews/imap/src/nsImapProtocol.cpp#6940,6943,6953

But, I think thing we need to get rid of a bit more old string handling, which is causing the trouble to begin with.

Status: NEW → ASSIGNED

Another signature, less common - arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | BaseAllocator::free | Allocator<T>::free | nsImapProtocol::DeleteSubFolders bp-a302c400-977e-4def-8276-0228e0230904

Crash Signature: [@ arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | nsImapProtocol::DeleteSubFolders] → [@ arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | nsImapProtocol::DeleteSubFolders] [@ arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | BaseAllocator::free | Allocator<T>::free | nsImapProtocol::DeleteSubFolders]
Target Milestone: --- → 119 Branch

Pushed by benc@thunderbird.net:
https://hg.mozilla.org/comm-central/rev/894d89f64450
Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

Status: ASSIGNED → RESOLVED
Closed: 11 months ago
Resolution: --- → FIXED
Duplicate of this bug: 1851742

Comment on attachment 9351474 [details]
Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

[Triage Comment]

Attachment #9351474 - Flags: approval-comm-beta+

Comment on attachment 9351474 [details]
Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

[Triage Comment]
Approved for beta

Whiteboard: [TM: 115.2.2, blocking bug 1851293]
Flags: needinfo?(mkmelin+mozilla)
Whiteboard: [TM: 115.2.2, blocking bug 1851293] → [TM: 115.2.3, blocking bug 1848264]

Comment on attachment 9351474 [details]
Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

[Approval Request Comment]
Needed for bug 1848264

Attachment #9351474 - Flags: approval-comm-esr115?
Flags: needinfo?(mkmelin+mozilla)
See Also: → 1853365

Comment on attachment 9351474 [details]
Bug 1851293 - Fix crash in nsImapProtocol::DeleteSubFolders. r=gds

[Triage Comment]
Approved for esr115

Attachment #9351474 - Flags: approval-comm-esr115? → approval-comm-esr115+

Fixed missed flag

You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: