336710 - repetitive crash when starting TB with "allow anti-virus clients to quarante individual incoming messages" turned on + nstmp folders [@ morkTable::CutRow]

Status: VERIFIED FIXED

(MailNews Core :: Networking, defect)

Description

[Jean-Michel Reghem]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Build Identifier: Thunderbird2a 2006050104

I was updating from TB 1.5.0.2 to the coming soon TB2a (2006050104: branch 1.8.1).
Install succefull ...
I was using it during 15' without problems.
And then TB was blocked. Not freezed, but blocked on a mail.
I was able to click in an other directory, on an other mail, but the view panel always stay to the mail blocked. And impossible to delete it (i don't remember if it was a junk mail or a rss feed)
--> so, i have deleted the process
--> restart: paf: crash: TB18201670Z

Incident ID: 18201670
Stack Signature	morkTable::CutRow 1581111a
Product ID	Thunderbird2
Build ID	2006050104
Trigger Time	2006-05-02 05:36:38.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	thunderbird.exe + (003855e9)
URL visited	crash at restart after TB was blocked and process deleted
User Comments	
Since Last Crash	10 sec
Total Uptime	33 sec
Trigger Reason	Access violation
Source File, Line No.	e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/db/mork/src/morkTable.cpp, line 698
Stack Trace 	
morkTable::CutRow  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/db/mork/src/morkTable.cpp, line 698]
nsMsgDatabase::RemoveHeaderMdbRow  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 1904]
nsPop3Protocol::HandleLine  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3393]
nsPop3Protocol::RetrResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3170]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3798]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 494]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 398]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 217]
0x778b0c24
nsWindowWatcher::GetJSContextFromWindow  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp, line 2305]
0x24448b08

So i restart TB and it was also blocked on the same mail --> impossible to delete it ...
--> delete process
--> restart
--> crash TB18201661Y   (same stack as above)
--> restart
--> crash TB18201577W

--> so it was impossible to use TB after that, crash was there for each restart.

So I have returned to TB 1.5.0.2 and all was OK
But, i noticed 2 folder nstmp^: one in my default pop account (below inbox) and one other in the RSS feed folder

Reproducible: Always

Comment 1

[Jean-Michel Reghem]

Attachment: nstmp.msf

I don't have anymore the nstmp folder of my pop account, but hopefully, i had deleted the nstmp folder of my News And Blogs folder ... and not empying the trash.
So it is in attachment.

Comment 2

[Scott MacGregor]

confirming. one of our mozillazine testers seems to be hitting this on the trunk as well:  

TB18886459Z

Comment 3

[Scott MacGregor]

This is now the #2 top crasher on the trunk and the 1.8.1 branch. Adding some blocking flags so we don't lose track of it.

Comment 4

[David :Bienvenu]

This stack is missing a call, I believe.

nsPop3Protocol::HandleLine 

calls nsPop3Sink::IncorporateComplete

which has this line:

m_newMailParser->m_mailDB->RemoveHeaderMdbRow(hdr);

Do you have quarantining of incoming messages turned on in tools | options | privacy?

Comment 5

[Jean-Michel Reghem]

(In reply to comment #4)

> Do you have quarantining of incoming messages turned on in tools | options |
> privacy?
> 

yes, it's true ... i've checked this box after upgrading from 1.5.0.2 to 2.0 by reviewing option ... Now i'm returned to 1.5.0.2, but it is still checked as I was using the same profile.

Comment 6

[David :Bienvenu]

The hdr variable has been deleted - it's unclear to me how this can happen, since we're holding a strong ref to it. I believe the message was moved by a filter, and perhaps there's a ref-counting problem in the code that moves messages by a filter in the quaranting case. 

This could be related to the other problem I fixed in this area, where messages were going ino the hdr cache with one key, and having the key changed, or it could be a result of that fix.

Comment 7

[Scott MacGregor]

Got a few more folks moving to 2.0 in the MZ forums today that are seeing this crash now too. 

Comment 8

[Jean-Michel Reghem]

> (In reply to comment #4) 

> Do you have quarantining of incoming messages turned on in tools | options | 
> privacy? 

> I don't know if it can help, but my antivirus is CA eTrust EZ antivirus 7.1 with Real-time and Email check set to ON (www.my-etrust.com)

Comment 9

[Ray Marotta]

This problem happens when upgrading from 1.5.0.4 Mac to 2.0a1 Mac.   As soon as the very first message is downloaded,  tb crashes with talkback.  the only way to stop tb from crashing is to revert back to 1.5.0.4 mac.

Comment 10

[David :Bienvenu]

have you tried turning off TB's message quarantining by going to tools | options | privacy | anti-virus and unchecking the box that says "quarantine incoming messages"?

Comment 11

[Jean-Michel Reghem]

(In reply to comment #10)
> have you tried turning off TB's message quarantining by going to tools |
> options | privacy | anti-virus and unchecking the box that says "quarantine
> incoming messages"?
> 

no ... as my migration from 1.5.0.2 to 2.0 a1 was unsucceful, i had returned to 1.5.0.2 and never try again ...
I will backup my mails and to the test this afternoon and see if i have the same problem

Comment 12

[Jean-Michel Reghem]

Ok ... i've redone the migration this morning with the antivirus option not checked ...
It was working until 15:30 ... so i've checked the option, and at 16:58 it crash (same behaviour: TB become slow, and a new message cannot be displayed: the display screen stay on the same message ... obligation to kill process and at reboot --> crash (see TB19417809G )

So, i will try to restore the option and working with 2.0 with the option not checked to see if it crash also

Comment 13

[Jean-Michel Reghem]

OK "quarantining of incoming messages turned on" is the responsible ...
I've try to open TB and uncheck the option before TB crash at startup. It take me 3 times to be able to do that (TB was crashing before i could press OK).
The 3rd time, i've succeed to press ok and ... TB didn't crash ... now, it is usable ...
(TB of crash at startup: TB19417969K and TB19417991X)

PS: don't find nstmp folder this time ...

Comment 14

[David :Bienvenu]

the other way to avoid this crash is to turn on filter logging - that's why I was never seeing it. Filter logging has a side effect that prevents this crash from happening. Now that I can reproduce this, I should have a fix soon.

Comment 15

[David :Bienvenu]

Attachment: proposed fix

as the comment says, we're already removing this header in nsParseNewMailState::ApplyFilterHit, if the message is moved, so we shouldn't remove it here

Comment 16

[(not reading, please use [e-mail] instead)]

Comment on attachment 224255 [details] [diff] [review]
proposed fix

sr=sspitzer (acting super reviewer why mscott is away)

Comment 17

[Jean-Michel Reghem]

thanks ... seems great David.
I'm now testing version 2006060504 with allowing quaranting checked ...
If it works all the day, i think it will be verified as previous version didn't live without problems less of 2 hours ...

Comment 18

[Marcia Knous [:marcia]]

verified fixed on the 1.8 branch (Win XP) using the Tbird candidate build, version 2.0.0.0 (20070326). No crash with that pref checked. Adding verified keyword.