423259 - Crash [@ nsImapMailFolder::AllocateUidStringFromKeys] on mail startup

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[Robert Kaiser]

Attachment: stacktrace from debug build

On my recent SeaMonkey debug builds (at least from yesterday and today), I'm getting a crash at mail startup, see attached stacktrace.
I have some IMAP addresses that get checked right at mail startup, and the crash is at nsImapMailFolder::AllocateUidStringFromKeys, so that clearly seems related.

Comment 1

[Robert Kaiser]

Just to be clear, this is the UA for where the crash happens:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b5pre) Gecko/2008031612 SeaMonkey/2.0a1pre

On a Gecko/2008030612, I didn't crash. Unfortunately, I didn't run the build I made in the days between those two.

Comment 2

[Robert Kaiser]

The crashing line is http://mxr.mozilla.org/mozilla/source/mailnews/imap/src/nsImapMailFolder.cpp#1948 which is

startSequence = keys[0];

That makes the "keys=0x5a5a5a5a" argument in the last frame look even more suspect than it has been before - note that it's passed up from frames below.

Given this is array stuff and there hasn't been much change to nsImapMailFolder after that patch, Neil's change in http://bonsai.mozilla.org/cvslog.cgi?file=/mozilla/mailnews/imap/src/nsImapMailFolder.cpp&rev=HEAD&mark=1.796 is likely to be the cause, even though I wonder why the build before didn't have the problem, even though it should theoretically have been created shortly after this patch, but maybe I did for some reason not catch it there.

Comment 3

[[e-mail]]

Attachment: Proposed patch

When all of your new messages are junk, we don't create a nonjunk bucket. Then when we come to store all the junk and nonjunk keywords, we discover that we don't have a nonjunk bucket and create one. Unfortunately, nsTArray only grows as necessary, compared to nsVoidArray which always grows at least 8 elements. This means that creating the junk bucket invalidates the memory location of the nonjunk bucket. The easy fix is to concentrate on one bucket at a time.

Comment 4

[[e-mail]]

Comment on attachment 309764 [details] [diff] [review]
Proposed patch

Looking for KaiRo to test this since he can presumably reproduce the crash ;-)

Comment 5

[Robert Kaiser]

Comment on attachment 309764 [details] [diff] [review]
Proposed patch

Looks good. With this patch, I can check IMAP accounts, run junk controls on them, move messages there, and don't crash :)

Comment 6

[[e-mail]]

Fix checked in.

Comment 7

[Wayne Mery (:wsmwk)]

hanging sr?  @  neil: superreview? (dmose)

Comment 8

[[e-mail]]

It was important to fix the crash and I was hoping for post-facto review ;-)

Comment 9

[David :Bienvenu]

Comment on attachment 309764 [details] [diff] [review]
Proposed patch

stealing review request.

Comment 10

[David :Bienvenu]

Comment on attachment 309764 [details] [diff] [review]
Proposed patch

sorry for the delay - a comment would have been helpful since this is a bit of a magic workaround.