303239 - crash in Thunderbird when trying to delete a post / mail in a rss feed / folder and move this folder to an other folder [@ nsMsgLocalMailFolder::CopyMessages]

Status: VERIFIED FIXED

(Thunderbird :: General, defect)

Description

[Jean-Michel Reghem]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050802 Firefox/1.0+
Build Identifier: Thunderbird alpha 2 nightly builds version 1.0+ (20050726)

crash in News and Blogs when trying to delete a post in a rss feed newly added
in the root folder and move to a subfolder.
It is reproducible (i've got the error 3 times, ...)



Reproducible: Always

Steps to Reproduce:
1. Add a rss feed to the root folder News and Blogs
2. Move the new feed to a subfolder (as blogs, podcast or what you want)
3. open the feed
4. Select a post
5. delete the selected post

Actual Results:  
TB crash without delete the post

Expected Results:  
not crash and delete the post.
After a restard of TB, i'm able to delete the post

3 Talkback generated: 
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB8052889W
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB8046916W
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB7984543M

Comment 1

[Jean-Michel Reghem]

Incident ID: 8052889
Stack Signature	nsMsgLocalMailFolder::CopyMessages 00eba760
Product ID	ThunderbirdTrunk
Build ID	2005072608
Trigger Time	2005-08-03 06:40:42.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	thunderbird.exe + (004e7f6a)
URL visited	some drag and drop in rss feeds
User Comments	reproducible ... Add a new feed in the root folder "Blog and
Newsgroup" Move this feed to a subfolder Open the feed and delete a post --> crash
Since Last Crash	20235 sec
Total Uptime	503385 sec
Trigger Reason	Access violation
Source File, Line No.
e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsLocalMailFolder.cpp,
line 1688
Stack Trace 	
nsMsgLocalMailFolder::CopyMessages 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsLocalMailFolder.cpp,
line 1688]
nsMsgCopyService::DoNextCopy 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/src/nsMsgCopyService.cpp,
line 285]
nsMsgCopyService::DoCopy 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/src/nsMsgCopyService.cpp,
line 234]
nsMsgCopyService::CopyMessages 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/src/nsMsgCopyService.cpp,
line 486]
nsMsgLocalMailFolder::DeleteMessages 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsLocalMailFolder.cpp,
line 1500]
nsMsgDBView::DeleteMessages 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/src/nsMsgDBView.cpp,
line 2575]
nsMsgDBView::ApplyCommandToIndices 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/src/nsMsgDBView.cpp,
line 2342]
nsMsgDBView::DoCommand 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/src/nsMsgDBView.cpp,
line 2092]
XPTC_InvokeByIndex 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2119]
XPC_WN_CallMethod 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1350]
js_Invoke 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 1173]
js_Interpret 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 3464]
js_Invoke 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 1193]
nsXPCWrappedJSClass::CallMethod 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 462]
SharedStub 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
XPTC_InvokeByIndex 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2119]
XPC_WN_CallMethod 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1350]
js_Invoke 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 1173]
js_Interpret 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 3464]
js_Invoke 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 1193]
js_InternalInvoke 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 1270]
JS_CallFunctionValue 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/js/src/jsapi.c,
line 3919]
nsJSContext::CallEventHandler 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1400]
nsJSEventListener::HandleEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsXBLPrototypeHandler::ExecuteHandler 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp,
line 499]
nsXBLWindowHandler::WalkHandlersInternal 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xbl/src/nsXBLWindowHandler.cpp,
line 306]
nsXBLWindowKeyHandler::WalkHandlers 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp,
line 197]
nsXBLWindowKeyHandler::KeyPress 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp,
line 250]
nsEventListenerManager::HandleEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1674]
nsXULDocument::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1242]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2226]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
PresShell::HandleEventInternal 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6382]
PresShell::HandleEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6193]
nsViewManager::HandleEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2504]
nsViewManager::DispatchEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2236]
HandleEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1241]
nsWindow::DispatchKeyEvent 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3432]
nsWindow::OnKeyDown 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3570]
nsWindow::ProcessMessage 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4476]
nsWindow::WindowProc 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1418]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppStartup::Run 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 146]
main 
[e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mail/app/nsMailApp.cpp,
line 62]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Jean-Michel Reghem]

test with the nightly: version 1.0+ (20050808)

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB8248656M

adding http://developer.mozilla.org/devnews/index.php/feed/ via Manage
subscription to the root "news and blogs" directory.
close the dialog
move the feed to the subfolder mozilla
open the feed and delete the last post
crash ...

Comment 3

[Jean-Michel Reghem]

See new Talkback TB8463473H

I was believing that was only with RSS feed ...
It is not the case, so here is a more common way to crash TB

1. Create 3 folders inside an Inbox like this:
     Inbox
       |--> test
       |     |--> test2
       |--> test3
2. Set a filter to force a future test mail to come in the folder test2
3. Send the test mail
4. The test mail come in the folder test2
5. Move the folder test2 inside test3 ... we have thus something like this
     Inbox
       |--> test
       |
       |--> test3
             |--> test2
                    |-->test mail
6. Delete the test mail
7. crash

Comment 4

[David :Bienvenu]

I can reproduce this using those last steps - I'll look into a fix.

Comment 5

[David :Bienvenu]

Attachment: proposed fix

OpenMailDBFromFileSpec creates a db w/o the m_folder member var set (which is
why we were crashing down the road - I can add some hacky bullet-proofing for
that too, but this fixes the underlying cause). The fix is that when we pull
that db out of the cache, when using OpenFolderDB, fix the folder pointer. We
only call OpenMailDBFromFileSpec in a few places, and only use the db
temporarily, but the db ends up in the cache, and can get pulled out by
OpenFolderDB.

Comment 6

[Scott MacGregor]

Comment on attachment 192997 [details] [diff] [review]
proposed fix

i trust the caller of OpenFolderDB doesn't expect _retval to get its ref count
bumped (unrelated to this specific change).

Comment 7

[David :Bienvenu]

the callers *do* expect the ref count of _retval to get bumped, and it *is*
bumped, by FindInCache().

Comment 8

[Jean-Michel Reghem]

yeah, this is working
good jobs guy