433331 - crash clicking on a message or an imap folder [@ nsTArray<unsigned int>::InsertElementsAt<int>(unsigned int, unsigned int, int const&)]

Status: VERIFIED FIXED

(Thunderbird :: Mail Window Front End, defect)

Description

[Wayne Mery (:wsmwk)]

crash clicking on moz-l imap folder.
reproducible: always

builds 2008032302 and 2008051203

first crash is...
bp-27002a51-201f-11dd-a1f7-001321b13766

Signature	nsTArray<unsigned int>::InsertElementsAt<int>(unsigned int, unsigned int, int const&)
UUID	27002a51-201f-11dd-a1f7-001321b13766
Time	2008-05-12 05:29:18-07:00
Uptime	30225
Product	Thunderbird
Version	3.0a1pre
Build ID	2008032302
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0xbda0000
Comments	opening a message after having moved a message (but did not change folders)

0  	thunderbird.exe  	nsTArray<unsigned int>::InsertElementsAt<int>  	 nsTArray.h:709
1 	thunderbird.exe 	nsMsgDBView::ListIdsInThread 	mozilla/mailnews/base/src/nsMsgDBView.cpp:4833
2 	thunderbird.exe 	nsMsgDBView::ExpandByIndex 	mozilla/mailnews/base/src/nsMsgDBView.cpp:4414
3 	thunderbird.exe 	nsMsgThreadedDBView::AddKeys 	mozilla/mailnews/base/src/nsMsgThreadedDBView.cpp:265
4 	thunderbird.exe 	nsMsgThreadedDBView::InitThreadedView 	mozilla/mailnews/base/src/nsMsgThreadedDBView.cpp:156
5 	thunderbird.exe 	nsMsgThreadedDBView::Open 	mozilla/mailnews/base/src/nsMsgThreadedDBView.cpp:94
6 	xpcom_core.dll 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
7 	js3250.dll 	js_GetProperty 	mozilla/js/src/jsobj.c:3702
8 	thunderbird.exe 	XPCCallContext::XPCCallContext 	mozilla/js/src/xpconnect/src/xpccallcontext.cpp:174


now I consistently crash when clicking this folder.
second crash bp-83e7f5ee-2024-11dd-bed8-001a4bd46e84
  "clicked a different folder [moz-l] - nothing else going on."

variation of bug 415601?

I have the .msf file saved.

Comment 1

[Wayne Mery (:wsmwk)]

forgot to mention, target folder of the initial move is not affected by filters.

so, the first time, "opening a message after having moved a message (but did not
change folders)" ... the sequence of events was:
  1. message in folder A (A is target of a filter)
  2. manual move of message to folder B (folder B is not target of any filters)
  3. clicked another message in folder A
 

Comment 2

[David :Bienvenu]

Attachment: proposed fix

I ran with Wayne's .msf file, and ran into a crash because we had a thread hdr with 0 children. This simple patch fixes the crash. Later on, we clean up the thread object/num children, so it's OK to simply avoid crashing here.

Comment 3

[Wayne Mery (:wsmwk)]

Assuming this "fixes" something that shouldn't be happening, will it then be hiding problem(s) that caused the error in the first place?

I'm thinking of move messages bugs and their ilk.

Comment 4

[David :Bienvenu]

My suspicion is that the crash started when things were switched over to nsTArray. This just fixes the crash - it doesn't hide anything, and I put in an assertion to help track this down, if we figure out how to get into this state. 

Comment 5

[Dan Mosedale (:dmosedale, :dmose)]

Comment on attachment 320799 [details] [diff] [review]
proposed fix

r+sr=dmose

Comment 6

[David :Bienvenu]

thx for the quick review, fix checked in. I've spun off a bug for the underlying problem - Bug 433709 

Comment 7

[Wayne Mery (:wsmwk)]

verified - folder no longer crashes. version 3.0a2pre (2008051503)