1868504 - Compact or Compact Folders has immediate Crash in [@ mozilla::span_details::span_iterator<T>::operator*]

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect, P1)

Description

[Wayne Mery (:wsmwk)]

#1 crash for 122.0a1 starting with 2023-12-05 build.

Compact or Compact Folders has immediate Crash. As far as I can tell, it only happens when one or more folders actually has deleted messages.

Crash report: https://crash-stats.mozilla.org/report/index/ef82c6af-271e-4ca7-b365-b9d560231206

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(idx < storage_.size())

Top 10 frames of crashing thread:

0  XUL  mozilla::Span<char const,  const  mfbt/Span.h:735
0  XUL  mozilla::span_details::span_iterator<mozilla::Span<char const,  const  mfbt/Span.h:144
0  XUL  MboxParser::IsReallyReallyFromLine  mailnews/base/src/MboxMsgInputStream.cpp:587
1  XUL  MboxParser::handle_eExpectBodyLine  mailnews/base/src/MboxMsgInputStream.cpp:355
1  XUL  MboxParser::handle  mailnews/base/src/MboxMsgInputStream.cpp:233
2  XUL  MboxParser::Feed  mailnews/base/src/MboxMsgInputStream.cpp:124
3  XUL  MboxMsgInputStream::PumpData  mailnews/base/src/MboxMsgInputStream.cpp:751
4  XUL  MboxMsgInputStream::Read  mailnews/base/src/MboxMsgInputStream.cpp:684
5  XUL  mozilla::net::nsInputStreamTransport::Read  netwerk/base/nsStreamTransportService.cpp:173
5  XUL  {virtual override thunk}  netwerk/base/nsStreamTransportService.cpp

Others of mine: bp-b827675e-a3c8-4192-a4ed-c39330231206 bp-a47e962c-a41f-414f-a027-1ea880231205 bp-edf2ef26-cafc-4db7-a3f2-7f4d80231205

Comment 1

[Wayne Mery (:wsmwk)]

Two other crash signatures that appear on 2023-12-05, perhaps unrelated:

• ucrtbase.dll | BaseAllocator::calloc | MozJemallocPHC::calloc | _vsscanf_l bp-1defc4e3-b3aa-4a51-be60-1574d0231205
• StoreIndexer::OnStopRequest bp-b183cac9-640c-4d04-9373-f787c0231205

Comment 2

[Ben Campbell]

OK, found the problem.
It happens in some places when scanning messages that have folded (multi-line) headers, if you're unlucky to get the end of the read buffer falling within the leading whitespace of the one of the continued lines...
Not specific to compaction, and I think there would be other ways to trigger it. And it'd be repeatable - if you hit it, you'll keep hitting it.

Stupid little mistake on my part, but easy to fix.

(In reply to Wayne Mery (:wsmwk) from comment #1)

Two other crash signatures that appear on 2023-12-05, perhaps unrelated:

• ucrtbase.dll | BaseAllocator::calloc | MozJemallocPHC::calloc | _vsscanf_l bp-1defc4e3-b3aa-4a51-be60-1574d0231205

I don't think that one is related to the mbox changes.

• StoreIndexer::OnStopRequest bp-b183cac9-640c-4d04-9373-f787c0231205

This one is related to the mbox changes... not to this bug though. Is there another bug for that one?

Comment 3

[Ben Campbell]

Attachment: Bug 1868504 - Fix crash bug in mbox parsing. r=#thunderbird-reviewers

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/8822b10f77e9
Fix crash bug in mbox parsing. r=leftmostcat

Comment 5

[Wayne Mery (:wsmwk)]

• StoreIndexer::OnStopRequest bp-b183cac9-640c-4d04-9373-f787c0231205

This one is related to the mbox changes... not to this bug though. Is there another bug for that one?

bug 1868705

Comment 6

[Wayne Mery (:wsmwk)]

FWIW bp-5844f567-ba9f-4193-8aa7-1229e0231207 was a crash on shutdown (restart) using 2023-12-05 build (updating to 2023-12-06) - compact should not have been involved.

Comment 7

[Wayne Mery (:wsmwk)]

My crash is fixed on nightly. Thanks!