336097 - [@ nsMsgSearchOfflineMail::ProcessSearchTerm]

Status: RESOLVED FIXED

(MailNews Core :: Search, defect)

Description

[timeless]

Incident ID: 18015307 
Stack Signature nsMsgSearchOfflineMail::ProcessSearchTerm 2c4e3db7 
Product ID ThunderbirdTrunk 
Build ID 2006042508 
Trigger Time 2006-04-26 18:45:50.0 
Platform Win32 
Operating System Windows NT 5.1 build 2600 
Module thunderbird.exe + (005489a1) 
URL visited  
User Comments I was trying to add a new mail folder - I right clicked on what I wnted for a parent, didn't see a "New", so I clicked "file" menu pad - no file menu dropped down, and tbird locked up. 
Since Last Crash 19444 sec 
Total Uptime 19444 sec 
Trigger Reason Access violation 
Source File, Line No. e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 450 
Stack Trace  

nsMsgSearchOfflineMail::ProcessSearchTerm  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 450]
nsMsgSearchBoolExpression::OfflineEvaluate  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 171]
nsMsgSearchOfflineMail::MatchTerms  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 619]
nsMsgSearchOfflineMail::MatchTermsForFilter  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 349]
nsMsgFilter::MatchHdr  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgFilter.cpp, line 517]
nsMsgFilterList::ApplyFiltersToHdr  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgFilterList.cpp, line 339]
nsParseNewMailState::ApplyFilters  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsParseMailbox.cpp, line 1733]
nsParseNewMailState::PublishMsgHeader  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsParseMailbox.cpp, line 1661]
nsPop3Sink::IncorporateComplete  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Sink.cpp, line 891]
nsPop3Protocol::HandleLine  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3393]
nsPop3Protocol::RetrResponse  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3170]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3798]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 498]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 389]
nsInputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 121]
0x778b0c24
NS_NewXMLStylesheetProcessingInstruction  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xml/content/src/nsXMLStylesheetPI.cpp, line 257]
nsGkAtoms::_false

i think m_term has to be deleted or similarly unhappy for this to happen, not sure. kinda worrisome.

Comment 1

[Adam Guthrie]

I don't see how m_term could be null since we get into an if statement that checks for m_term. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp&rev=1.73&root=/cvsroot&mark=167#147

Bug 324467 looks like a likely regression causer (with its change to nsMsgFilter).

Comment 2

[Asa Dotzler [:asa]]

David and Scott, I've been hit by this twice in one day with trunk builds. Any chance one of you can look into it. 

Comment 3

[David :Bienvenu]

Asa, were you editing filters in the session where this happened?

Comment 4

[David :Bienvenu]

Asa was not editing filters; he may have been editing a view, though not likely.

I saw crashes like this when I edited filters and left the filter editor up while new mail arrived. It looked to me like the term had been deleted out from under us.

Comment 5

[Jean-Michel Reghem]

Got the same crash with the same stack on windows XP SP2 with TB 2.0a1 build 2006061911 ( see TB20075205K ).

Don't remember exactly what i did ... sorry

Comment 6

[Wayne Mery (:wsmwk)]

(In reply to comment #5)
> Got the same crash with the same stack on windows XP SP2 with TB 2.0a1 build
> 2006061911 ( see TB20075205K ).
> 
> Don't remember exactly what i did ... sorry

Jean-Michel, Did you cite the wrong TB id?  I don't see that your stack is the same.  From TB20075205K ...
 nsMenuFrame::BuildAcceleratorText  [mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 1500]
 nsMsgDatabase::ClearHdrCache  [mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 387]
 nsMailDatabase::ForceClosed  [mozilla/mailnews/db/msgdb/src/nsMailDatabase.cpp, line 122] 

Comment 7

[Jean-Michel Reghem]

mhm ... sorry ... it is quite old and i don't remember ... but yes, the TB seems not related to this bug ... sorry, an error

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to comment #4)
> Asa was not editing filters; he may have been editing a view, though not
> likely.
> 
> I saw crashes like this when I edited filters and left the filter editor up
> while new mail arrived. It looked to me like the term had been deleted out from
> under us.

David, I had edited one filter shortly before crash - changed it from 1 term to 3, it was breifly at 4 but I reduced it back to 3 before clicking OK.  Likely I recieved mail in that period, but I couldn't swear to it.

stack is different from asa's


TB23342750

Stack Signature	 nsMsgSearchOfflineMail::ProcessSearchTerm 313d86e0
Product ID	ThunderbirdTrunk
Build ID	2006091107
Trigger Time	2006-09-15 19:05:36.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	thunderbird.exe + (005aaee5)
URL visited	
User Comments	added addres book entry, otherwise idle remoted from ultravnc session s/vseerror
Since Last Crash	117771 sec
Total Uptime	117771 sec
Trigger Reason	Access violation
Source File, Line No.	e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 448
Stack Trace 	
nsMsgSearchOfflineMail::ProcessSearchTerm  [mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 448]
nsMsgSearchBoolExpression::OfflineEvaluate  [mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 171]
nsMsgSearchOfflineMail::MatchTerms  [mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 633]
nsMsgSearchOfflineMail::MatchTermsForFilter  [mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 349]
nsMsgFilter::MatchHdr  [mozilla/mailnews/base/search/src/nsMsgFilter.cpp, line 554]
nsMsgFilterList::ApplyFiltersToHdr  [mozilla/mailnews/base/search/src/nsMsgFilterList.cpp, line 358]
nsImapMailFolder::NormalEndHeaderParseStream  [mozilla/mailnews/imap/src/nsImapMailFolder.cpp, line 3074]
nsImapMailFolder::ParseMsgHdrs  [mozilla/mailnews/imap/src/nsImapMailFolder.cpp, line 2893]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
nsProxyObjectCallInfo::Run  [mozilla/xpcom/proxy/src/nsProxyEvent.cpp, line 181]
NS_ProcessNextEvent_P  [mozilla/xpcom/build/nsThreadUtils.cpp, line 225]
nsBaseAppShell::Run  [mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp, line 153]
main  [mozilla/mail/app/nsMailApp.cpp, line 62]
KERNEL32.dll + 0x289a5 (0x7c5989a5)

Comment 9

[Jean-Michel Reghem]

yop ...
this time, got the same crash, with the good TB: TB23424186X

I just have edit one filter for an account.
This account has +/- 15 filters, and in one filter, i've just add a FROM: field (so this filter has now +/- 8 FROM conditions ...)

5' ago, TB crash, maybe during an automatic POP3 check ...

My configuration TB2.0a1 2006090706, Windows XP SP2

Comment 10

[Scott MacGregor]

I just ran into this on today's 10/12 build. 

I had actually edited a filter, adding a new term about 35-40 minutes before the crash. I wasn't doing anything in my thunderbird window at the time of the crash.

Same stack trace as the one Wayne just posted. TB24478646

I wonder if we are getting passed in a null search term
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp&mark=448&rev=#448

Looks like this crash is on the branch too according to talkback. 

Comment 11

[David :Bienvenu]

I'm pretty sure the search term was deleted.

Did you leave the filter editor ui up, or did you close it?

Comment 12

[Scott MacGregor]

The filter dialog was closed. 

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to comment #11)
> I'm pretty sure the search term was deleted.
> 
> Did you leave the filter editor ui up, or did you close it?

Think I've had it happen both ways.

Comment 14

[Jean-Michel Reghem]

Trunk Only? --> No

As said in my comment https://bugzilla.mozilla.org/show_bug.cgi?id=336097#c9 My configuration was TB2.0a1 2006090706, Windows XP SP2

(In reply to comment #11)
> I'm pretty sure the search term was deleted.
> 
> Did you leave the filter editor ui up, or did you close it?
>
>Think I've had it happen both ways.

--> me too

Comment 15

[David :Bienvenu]

one thing I see is that in nsMsgFilter, we're deleting m_expressionTree w/o nulling out the pointer in a couple places. I thought that was the problem, but I'm not sure yet.

Comment 16

[David :Bienvenu]

Attachment: proposed fix

must clear m_expressionTree when m_termList changes, or could possibly change.

Comment 17

[David :Bienvenu]

fixed on trunk and branch.