339518 - Switching IMAP folders while "mark-as-spam" is running causes a crash [@ nsMsgDBView::DeleteMessages]

Status: RESOLVED FIXED

(MailNews Core :: Database, defect)

Description

[Alexey N. Solofnenko]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1a2) Gecko/20060525 BonEcho/2.0a2
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1a3) Gecko/20060528 Thunderbird/2.0a1 ID:2006052804

I thought I already filed this bug, but I cannot find it, so I am filing it "again". This problem has been there for ages. It looks like mark-as-spam starts downloading emails from the current IMAP folder and, if I switch the current folder during this process, Thunderbird crashes. Today Thunderbird was not quick enough to mark just two emails as spam.

Talkback:
TB19216906Y
TB19216875Q

Reproducible: Sometimes

Steps to Reproduce:
1. Make an IMAP folder with few emails (~20, but it depends on a speed of connection).
2. Select all.
3. Mark as spam.
4. Change the current folder. In my case I went to a folder in a different account.

Actual Results:  
crash

Expected Results:  
not crash

Comment 1

[Adam Guthrie]

Unfortunately those talkback IDs don't have symbols with them. Could you please reinstall Thunderbird and try crashing again?

Comment 2

[Alexey N. Solofnenko]

There is no installer for Linux, so I remove thunderbird folder and unzip new build. This is the last crash: TB19400120H in Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1a3) Gecko/20060601 Thunderbird/2.0a1 ID:2006060103.

Comment 3

[Adam Guthrie]

Hmm... still no symbols. I guess the talkback server doesn't like you. :( Maybe try once more to see if it was just a stroke of bad luck?

Comment 4

[Alexey N. Solofnenko]

By the way, the talkback reports are not in crash report: http://talkback-public.mozilla.org/reports/thunderbird/TB2x/index.html . It looks like the build number I have is not recognized and this is the reason for missing symbols in the stack trace.

Comment 5

[Alexey N. Solofnenko]

This one is after reinstallation: TB19400322M . There are still no symbols in the stack trace.

Comment 6

[timeless]

can you try a trunk nightly instead?

Comment 7

[Alexey N. Solofnenko]

While configuring trunk Thunderbird I noticed one more setting that can be important - I configured IMAP accounts to move junk emails into Trash folders (for the same accounts).

Comment 8

[Alexey N. Solofnenko]

The important setting was actually "When I mark messages as junk: delete". No luck  with trunk build - still no symbols: TB19627121X .

Comment 9

[Alexey N. Solofnenko]

Why do not somebody else try to crash Thunderbird. It is easy: TB20093140E .

Comment 10

[Adam Guthrie]

#0  0xb5dc388e in nsMsgDBView::DeleteMessages (this=0x8b458b0, window=0xb768e2b4, indices=0x8b237c0, numIndices=18, deleteStorage=-1217862988) at /moz/trunk/mozilla/mailnews/base/src/nsMsgDBView.cpp:2565
#1  0xb5dc3e3f in nsMsgDBView::ApplyCommandToIndices (this=0x8b458b0, command=7, indices=0x8b237c0, numIndices=18) at /moz/trunk/mozilla/mailnews/base/src/nsMsgDBView.cpp:2346
#2  0xb5dc5f0a in nsMsgDBView::PerformActionsOnJunkMsgs (this=0x8b458b0) at /moz/trunk/mozilla/mailnews/base/src/nsMsgDBView.cpp:2919
#3  0xb5dc600d in nsMsgDBView::OnMessageClassified (this=0x8b458b0, aMsgURI=0x8ccbd00 "imap-message://[e-mail]/INBOX#72", aClassification=2) at /moz/trunk/mozilla/mailnews/base/src/nsMsgDBView.cpp:2844
#4  0xb602fc3e in nsBayesianFilter::observeMessage (this=0x89489b8, tokenizer=@0x0, messageURL=0x8ccbd00 "imap-message://[e-mail]/INBOX#72", oldClassification=0, newClassification=2, listener=0x8b458c0) at /moz/trunk/mozilla/mailnews/extensions/bayesian-spam-filter/src/nsBayesianFilter.cpp:1340
#5  0xb6032840 in MessageObserver::analyzeTokens (this=0x8c198c0, tokenizer=@0x0) at /moz/trunk/mozilla/mailnews/extensions/bayesian-spam-filter/src/nsBayesianFilter.cpp:1252
#6  0xb60309e1 in TokenStreamListener::OnStopRequest (this=0x8cbdbd8, aRequest=0x8b124d8, aContext=0x8b681fc, aStatusCode=0) at /moz/trunk/mozilla/mailnews/extensions/bayesian-spam-filter/src/nsBayesianFilter.cpp:891
#7  0xb601cf66 in nsStreamConverter::OnStopRequest (this=0x8d5e6c0, request=0xb768e2b4, ctxt=0xb768e2b4, status=3077104308) at /moz/trunk/mozilla/mailnews/mime/src/nsStreamConverter.cpp:1048
#8  0xb7148296 in nsStreamListenerTee::OnStopRequest (this=0x8c0ee28, request=0xb768e2b4, context=0xb768e2b4, status=3077104308) at /moz/trunk/mozilla/netwerk/base/src/nsStreamListenerTee.cpp:65
#9  0xb7e8ff59 in XPTC_InvokeByIndex () at xptiprivate.h:123
#10 0xb7e842d1 in nsProxyCallEvent::Invoke (this=0x82f1998) at /moz/trunk/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:180
#11 0xb7e84857 in nsProxyCallEvent::Run (this=0x82f1998) at /moz/trunk/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:159
#12 0xb7e7ab44 in nsThread::ProcessNextEvent (this=0x80828b0, mayWait=1, result=0xb768e2b4) at /moz/trunk/mozilla/xpcom/threads/nsThread.cpp:482
#13 0xb7e14df1 in NS_ProcessNextEvent_P (thread=0x0, mayWait=0) at nsThreadUtils.cpp:225
#14 0xb55a67cb in nsBaseAppShell::Run (this=0x816fce0) at /moz/trunk/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:153
#15 0xb551673d in nsAppStartup::Run (this=0x81e0f40) at /moz/trunk/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:171
#16 0xb7edc21a in XRE_main (argc=3, argv=0xbfefe3c4, aAppData=0x80497a0) at /moz/trunk/mozilla/toolkit/xre/nsAppRunner.cpp:2406
#17 0x08048608 in main (argc=0, argv=0x0) at /moz/trunk/mozilla/mail/app/nsMailApp.cpp:62

Comment 11

[David :Bienvenu]

OK, thanks to Adam's research, he's determined that the view has been closed and the m_keys/m_flags/m_levels arrays have been cleared out. At this point, all we can really do is a range check. Actually, better would be to clear out mJunkIndices and mNumJunkIndices in nsMsgDBView::Close, and verify that that keeps out of trouble. Do you want to close that up and try it, Adam?

Comment 12

[David :Bienvenu]

this will mean that the messages will get marked as junk, but we won't apply the default mark as junk actions - but the user should have waited to select a different folder :-) the alternative is to keep track of message keys instead of view indexes, because keys would still be valid.

Comment 13

[Adam Guthrie]

Attachment: fix

This fixes the crash, but I am now getting an assertion:

###!!! ASSERTION: the classification of a manually-marked junk message has been classified as junk, yet there seem to be no such outstanding messages: '(aClassification == nsIJunkMailPlugin::GOOD) || (mJunkIndices != nsnull)', file /moz/trunk/mozilla/mailnews/base/src/nsMsgDBView.cpp, line 2720

coming from: http://lxr.mozilla.org/seamonkey/source/mailnews/base/src/nsMsgDBView.cpp#2715

Comment 14

[David :Bienvenu]

Comment on attachment 227198 [details] [diff] [review]
fix

that causes a small memory leak - you need to add

nsMemory::Free(mJunkIndices);

before nulling out the mJunkIndices pointer. r/sr=bienvenu with that change.

The assertion is what I'd expect.

Comment 15

[Adam Guthrie]

Attachment: fix v2

Comments addressed. I also changed setting mNumJunkIndices to 0 instead of null (since this seems slightly more clear).

(Also, why do I need to explicitly allocate mJunkIndices here? http://lxr.mozilla.org/seamonkey/source/mailnews/base/src/nsMsgDBView.cpp#2285 I don't really understand that comment.)

Comment 16

[Adam Guthrie]

David, could you check this in for me? Thanks.

Comment 17

[David :Bienvenu]

fixed on trunk and branch, thx, ispiked!

Comment 18

[Adam Guthrie]

Comment on attachment 227283 [details] [diff] [review]
fix v2

David says that he think this will fix bug 313103 (a topcrash in 1.5.0.4) and that we should get this patch in on the 1.8.0 branch.

Comment 19

[Adam Guthrie]

*** Bug 313103 has been marked as a duplicate of this bug. ***

Comment 20

[Daniel Veditz [:dveditz]]

Comment on attachment 227283 [details] [diff] [review]
fix v2

approved for 1.8.0 branch, a=dveditz for drivers

Comment 21

[Michael Wu [:mwu]]

Checking in mailnews/base/src/nsMsgDBView.cpp;
/cvsroot/mozilla/mailnews/base/src/nsMsgDBView.cpp,v  <--  nsMsgDBView.cpp
new revision: 1.222.4.2.2.4; previous revision: 1.222.4.2.2.3
done

Comment 22

[Marcia Knous [:marcia]]

verified on the 1.8.0 branch using version 1.5.0.7 (20060906) (Talkback Build ID=2006090611). I marked 20 messages as spam with my IMAP account and then quickly switched to my POP account and did not experience a crash. Running FC5.

Comment 23

[Marcia Knous [:marcia]]

verified on the 1.8 branch using the Tbird candidate build, version 2.0.0.0 (20070326). Marked 20 messages as spam with IMAP, then switched quickly between accounts. No crash running FC5. Add branch verified keyword.