257079 - crash in nsImapMailFolder::UpdateImapMailboxInfo

Status: RESOLVED FIXED

(MailNews Core :: Database, defect)

Description

[Robin Lu]

A customer sent me a core file. The stack shows it crashes in
nsImapMailFolder::UpdateImapMailboxInfo:
core 'core' of 4569:    /usr/sfw/bin/../lib/mozilla/mozilla-bin -UILocale en-US
-contentLocale
-----------------  lwp# 1 / thread# 1  --------------------
 ceb82935 _lwp_kill (1, b) + 15
 ceb2ccff raise    (b) + 1f
 cb9d8ec1 void nsProfileLock::FatalSignalHandler(int) (b, 0, 8046a60) + bd
 ceb8159f __sighndlr (b, 0, 8046a60, cb9d8e04) + f
 ca22cabf unsigned
nsImapMailFolder::UpdateImapMailboxInfo(nsIImapProtocol*,nsIMailboxSpec*)
(8fb98c0, 9796550, b41c680, b3ef870, cd2f5bb8, 8046d5c) + 60d
 cd2c9940 XPTC_InvokeByIndex (8fb9998, 1a, 2, 92f1668) + 38
 cd2b4b5b void*EventHandler(PLEvent*) (b152d68) + 3b
 cd2ac60f PL_HandleEvent (b152d68) + 1f
 cd2ac523 PL_ProcessPendingEvents (80fa790) + 6d
 cd2ae531 unsigned nsEventQueueImpl::ProcessPendingEvents() (812f690, 858f0f8,
ce40f302, 858f0b0, 1, 812f690) + 3c
 cba227b2 int event_processor_callback(_GIOChannel*,GIOCondition,void*)
(858f0b0, 1, 812f690, 0, ce40f2d0) + 12
 ce40f302 g_io_unix_dispatch (ce44f968, 2, 80e2710, 64, 3, 10) + 32
 ce44f4c8 g_source_callback_funcs (812f690, 0, 11, 87255980, 0, 1062bd6)
 cba227a0 int event_processor_callback(_GIOChannel*,GIOCondition,void*) ()
-----------------  lwp# 2 / thread# 2  --------------------
 ceb823c5 __pollsys (cce0fd10, 6, 0, 0) + 15
 ceb29c38 poll     (cce0fd10, 6, ffffffff) + 68
 ce9f048d _pr_poll_with_poll (817d3f4, 6, ffffffff, cce0ff70, ccf356ea, 817d3f4)
+ 2d5
 ce9f0601 PR_Poll  (817d3f4, 6, ffffffff) + 11
 ccf356ea int nsSocketTransportService::Poll() (817d0a0) + 58
 ccf35dbd unsigned nsSocketTransportService::Run() (817d0a0) + 18f
 cd2b0422 void nsThread::Main(void*) (817c588) + 32
 ce9f16a3 _pt_root (817d6a8) + 9e
 ceb81260 _thr_setup (ceab8400) + 50
 ceb81420 _lwp_start (ceab8400, 0, 0, cce0fff8, ceb81420, ceab8400)
-----------------  lwp# 3 / thread# 3  --------------------
 ceb814a9 __lwp_park (8313644, 8308e08, cb5afee8) + 19
 ceb7bcb3 cond_wait_queue (8313644, 8308e08, cb5afee8, 0) + 3b
 ceb7c04f cond_wait_common (8313644, 8308e08, cb5afee8) + 1df
 ceb7c291 _cond_timedwait (8313644, 8308e08, cb5aff48) + 51
 ceb7c2fc cond_timedwait (8313644, 8308e08, cb5aff48) + 24
 ceb7c33e pthread_cond_timedwait (8313644, 8308e08, cb5aff48) + 1e
 ce9ec5a8 pt_TimedWait (8313644, 8308e08, 74694) + b8
 ce9ec777 PR_WaitCondVar (8313640, 74694) + 64
 cd2b333e unsigned TimerThread::Run() (8302838) + 16e
 cd2b0422 void nsThread::Main(void*) (8313660) + 32
 ce9f16a3 _pt_root (8308ec8) + 9e
 ceb81260 _thr_setup (ceab8800) + 50
 ceb81420 _lwp_start (ceab8800, 0, 0, cb5afff8, ceb81420, ceab8800)
-----------------  lwp# 9 / thread# 9  --------------------
 ceb814a9 __lwp_park (9159084, 8e244ec, ca7cfe60) + 19
 ceb7bcb3 cond_wait_queue (9159084, 8e244ec, ca7cfe60, 0) + 3b
 ceb7c04f cond_wait_common (9159084, 8e244ec, ca7cfe60) + 1df
 ceb7c291 _cond_timedwait (9159084, 8e244ec, ca7cfec0) + 51
 ceb7c2fc cond_timedwait (9159084, 8e244ec, ca7cfec0) + 24
 ceb7c33e pthread_cond_timedwait (9159084, 8e244ec, ca7cfec0) + 1e
 ce9ec5a8 pt_TimedWait (9159084, 8e244ec, 186a0) + b8
 ce9ec777 PR_WaitCondVar (9159080, 186a0) + 64
 ce9ecaa5 PR_Wait  (8e244e8, 186a0) + 35
 ca248d56 void nsImapProtocol::ImapThreadMainLoop() (90968f0) + c6
 ca2482a6 unsigned nsImapProtocol::Run() (90968f0) + 56
 cd2b0422 void nsThread::Main(void*) (9159180) + 32
 ce9f16a3 _pt_root (915f840) + 9e
 ceb81260 _thr_setup (ceab9800) + 50
 ceb81420 _lwp_start (ceab9800, 0, 0, ca7cfff8, ceb81420, ceab9800)
-----------------  lwp# 10 / thread# 10  --------------------
 ceb814a9 __lwp_park (82fcc84, 82feb48, ca7afef0) + 19
 ceb7bcb3 cond_wait_queue (82fcc84, 82feb48, ca7afef0, 0) + 3b
 ceb7c04f cond_wait_common (82fcc84, 82feb48, ca7afef0) + 1df
 ceb7c291 _cond_timedwait (82fcc84, 82feb48, ca7aff50) + 51
 ceb7c2fc cond_timedwait (82fcc84, 82feb48, ca7aff50) + 24
 ceb7c33e pthread_cond_timedwait (82fcc84, 82feb48, ca7aff50) + 1e
 ce9ec5a8 pt_TimedWait (82fcc84, 82feb48, 5b8d80) + b8
 ce9ec777 PR_WaitCondVar (82fcc80, 5b8d80) + 64
 ccf12f27 void nsIOThreadPool::ThreadFunc(void*) (82feb10) + 75
 ce9f16a3 _pt_root (9cfa7a0) + 9e
 ceb81260 _thr_setup (ceab9c00) + 50
 ceb81420 _lwp_start (ceab9c00, 0, 0, ca7afff8, ceb81420, ceab9c00)
-----------------  lwp# 12 / thread# 12  --------------------
 ceb814a9 __lwp_park (9d94c8c, 91d46ac, cb4efe60) + 19
 ceb7bcb3 cond_wait_queue (9d94c8c, 91d46ac, cb4efe60, 0) + 3b
 ceb7c04f cond_wait_common (9d94c8c, 91d46ac, cb4efe60) + 1df
 ceb7c291 _cond_timedwait (9d94c8c, 91d46ac, cb4efec0) + 51
 ceb7c2fc cond_timedwait (9d94c8c, 91d46ac, cb4efec0) + 24
 ceb7c33e pthread_cond_timedwait (9d94c8c, 91d46ac, cb4efec0) + 1e
 ce9ec5a8 pt_TimedWait (9d94c8c, 91d46ac, 186a0) + b8
 ce9ec777 PR_WaitCondVar (9d94c88, 186a0) + 64
 ce9ecaa5 PR_Wait  (91d46a8, 186a0) + 35
 ca248d56 void nsImapProtocol::ImapThreadMainLoop() (97ce148) + c6
 ca2482a6 unsigned nsImapProtocol::Run() (97ce148) + 56
 cd2b0422 void nsThread::Main(void*) (9d94e08) + 32
 ce9f16a3 _pt_root (975ed68) + 9e
 ceb81260 _thr_setup (ceab9400) + 50
 ceb81420 _lwp_start (ceab9400, 0, 0, cb4efff8, ceb81420, ceab9400)
-----------------  lwp# 13 / thread# 13  --------------------
 ceb814a9 __lwp_park (917972c, b471d4c, 0) + 19
 ceb7bcb3 cond_wait_queue (917972c, b471d4c, 0, 0) + 3b
 ceb7c1ac _cond_wait (917972c, b471d4c) + 66
 ceb7c1f1 cond_wait (917972c, b471d4c) + 21
 ceb7c22b pthread_cond_wait (917972c, b471d4c) + 1b
 ce9ec78a PR_WaitCondVar (9179728, ffffffff) + 77
 ce9ecaa5 PR_Wait  (b471d48, ffffffff) + 35
 cd2ac748 PL_WaitForEvent (b433b20) + 3f
 cd2ae762 unsigned nsEventQueueImpl::WaitForEvent(PLEvent**) (93d3e80, cb50f838)
+ 32
 cd2b4730 unsigned nsProxyObject::PostAndWait(nsProxyObjectCallInfo*) (93ddbc8,
b3ef870) + f8
 cd2b4a09 unsigned
nsProxyObject::Post(unsigned,nsXPTMethodInfo*,nsXPTCMiniVariant*,nsIInterfaceInfo*)
(93ddbc8, 1a, 9168e68, cb50f8c0, 91437e8) + 139
 cd2b6de2 unsigned nsProxyEventObject::CallMethod(unsigned short,const
nsXPTMethodInfo*,nsXPTCMiniVariant*) (91ab5a8, 1a, 9168e68, cb50f8c0) + 32
 cd2c9a82 unsigned PrepareAndDispatch(nsXPTCStubBase*,unsigned,unsigned*)
(91ab5a8, 1a, cb50f97c) + 132
 cd2c9db2 unsigned nsXPTCStubBase::Stub26() (91ab5a8, 9796550, b41c680,
cb50fa74, ca24f2ab, 9796550) + 12
 ca24f45c void nsImapProtocol::UpdatedMailboxSpec(nsImapMailboxSpec*) (9796550,
b41c680) + 1c
 ca24f2ab void nsImapProtocol::ProcessMailboxUpdate(int) (9796550, 1) + 47a
 ca24c189 void nsImapProtocol::ProcessSelectedStateURL() (9796550) + 1704
 ca24994f int nsImapProtocol::ProcessCurrentURL() (9796550) + 825
 ca248dca void nsImapProtocol::ImapThreadMainLoop() (9796550) + 13a
 ca2482a6 unsigned nsImapProtocol::Run() (9796550) + 56
 cd2b0422 void nsThread::Main(void*) (9d6aa38) + 32
 ce9f16a3 _pt_root (8aea190) + 9e
 ceb81260 _thr_setup (ceab9000) + 50
 ceb81420 _lwp_start (ceab9000, 0, 0, cb50fff8, ceb81420, ceab9000)
-----------------  lwp# 14 / thread# 14  --------------------
 ceb814a9 __lwp_park (8dec13c, 9558d9c, cb52fe60) + 19
 ceb7bcb3 cond_wait_queue (8dec13c, 9558d9c, cb52fe60, 0) + 3b
 ceb7c04f cond_wait_common (8dec13c, 9558d9c, cb52fe60) + 1df
 ceb7c291 _cond_timedwait (8dec13c, 9558d9c, cb52fec0) + 51
 ceb7c2fc cond_timedwait (8dec13c, 9558d9c, cb52fec0) + 24
 ceb7c33e pthread_cond_timedwait (8dec13c, 9558d9c, cb52fec0) + 1e
 ce9ec5a8 pt_TimedWait (8dec13c, 9558d9c, 186a0) + b8
 ce9ec777 PR_WaitCondVar (8dec138, 186a0) + 64
 ce9ecaa5 PR_Wait  (9558d98, 186a0) + 35
 ca248d56 void nsImapProtocol::ImapThreadMainLoop() (9076698) + c6
 ca2482a6 unsigned nsImapProtocol::Run() (9076698) + 56
 cd2b0422 void nsThread::Main(void*) (8dec258) + 32
 ce9f16a3 _pt_root (90bd0f0) + 9e
 ceb81260 _thr_setup (ceab8c00) + 50
 ceb81420 _lwp_start (ceab8c00, 0, 0, cb52fff8, ceb81420, ceab8c00)
-----------------  lwp# 15 / thread# 15  --------------------
 ceb814a9 __lwp_park (91cef5c, 9184544, cb0afe60) + 19
 ceb7bcb3 cond_wait_queue (91cef5c, 9184544, cb0afe60, 0) + 3b
 ceb7c04f cond_wait_common (91cef5c, 9184544, cb0afe60) + 1df
 ceb7c291 _cond_timedwait (91cef5c, 9184544, cb0afec0) + 51
 ceb7c2fc cond_timedwait (91cef5c, 9184544, cb0afec0) + 24
 ceb7c33e pthread_cond_timedwait (91cef5c, 9184544, cb0afec0) + 1e
 ce9ec5a8 pt_TimedWait (91cef5c, 9184544, 186a0) + b8
 ce9ec777 PR_WaitCondVar (91cef58, 186a0) + 64
 ce9ecaa5 PR_Wait  (9184540, 186a0) + 35
 ca248d56 void nsImapProtocol::ImapThreadMainLoop() (92e4e10) + c6
 ca2482a6 unsigned nsImapProtocol::Run() (92e4e10) + 56
 cd2b0422 void nsThread::Main(void*) (93d8c68) + 32
 ce9f16a3 _pt_root (9d82e50) + 9e
 ceb81260 _thr_setup (c9c40000) + 50
 ceb81420 _lwp_start (c9c40000, 0, 0, cb0afff8, ceb81420, c9c40000)
As I checked the core file, the crash is due to mDatabase is 0 when it tried to
call mDatabase->SyncCounts() in following lines:
    if (mNumUnreadMessages + keysToFetch.GetSize() > numUnreadFromServer)
      mDatabase->SyncCounts();
The code of nsImapMailFolder::UpdateImapMailboxInfo shows it does have the
possibility that mDatabase is null here.
I don't have the reproduce step of the crash.

Comment 1

[Robin Lu]

Attachment: patch

Comment 2

[Robin Lu]

checked in.
Thanks for the review!

Comment 3

[David :Bienvenu]

Comment on attachment 157787 [details] [diff] [review]
patch

this needs to be in 1.7 as well, apparently.

Comment 4

[David :Bienvenu]

*** Bug 260509 has been marked as a duplicate of this bug. ***

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 157787 [details] [diff] [review]
patch

a=dveditz for 1.7, please add the fixed1.7.x keyword after checkin