479927 - crash [@ strlen - nsDependentCString::nsDependentCString]

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ strlen - nsDependentCString::nsDependentCString]
found from crash-stats query

suddenly appears with 2009-02-15 build** - just days before cutting 3.0b2 - and continues on 3.0b3pre 2009-02-22 build***. 95% of all crashes occur on 2009-02-23. So could be a bad crasher if it is not just one person testing, but can't tell without examining all crashes because all times are 00:00 per crash-stats

** http://crash-stats.mozilla.com/report/list?product=Thunderbird&branch=1.9.1&query_search=signature&query_type=contains&query=strlen&date=&range_value=11&range_unit=days&do_query=1&signature=strlen
*** bp-400957a1-627e-471d-abf5-4e0482090223


bp-71d56576-ca00-478b-b95a-8fee02090223
strlen	 strlen.asm:81
nsDependentCString::nsDependentCString	objdir-tb/mozilla/dist/include/string/nsTDependentString.h:90
nsImapProtocol::AlertUserEventFromServer	mailnews/imap/src/nsImapProtocol.cpp:4875
nsImapServerResponseParser::ParseIMAPServerResponse	mailnews/imap/src/nsImapServerResponseParser.cpp:296
nsImapProtocol::ParseIMAPandCheckForNewMail	mailnews/imap/src/nsImapProtocol.cpp:1799
nsImapProtocol::UploadMessageFromFile	mailnews/imap/src/nsImapProtocol.cpp:5691
nsImapProtocol::OnAppendMsgFromFile	mailnews/imap/src/nsImapProtocol.cpp:5570
nsImapProtocol::ProcessAuthenticatedStateURL	mailnews/imap/src/nsImapProtocol.cpp:7489
nsImapProtocol::ProcessCurrentURL	mailnews/imap/src/nsImapProtocol.cpp:1657
nsImapProtocol::ImapThreadMainLoop	mailnews/imap/src/nsImapProtocol.cpp:1327
nsImapProtocol::Run	mailnews/imap/src/nsImapProtocol.cpp:1035
nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:510
NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:227
nsThread::ThreadFunc	xpcom/threads/nsThread.cpp:254
_PR_NativeRunThread	nsprpub/pr/src/threads/combined/pruthr.c:436
pr_root	nsprpub/pr/src/md/windows/w95thred.c:122
_callthreadstartex	objdir-tb/mozilla/memory/jemalloc/src/threadex.c:348
_threadstartex	objdir-tb/mozilla/memory/jemalloc/src/threadex.c:326

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

bienvenu, thoughts? Might it be related to recent IMAP improvements?

Comment 2

[David :Bienvenu]

No, I doubt it's related to the IMAP thread shutdown changes. It looks very much like we're getting an empty alert message from the server. I can look at the code.

Comment 3

[Wayne Mery (:wsmwk)]

And no crashes so far today, compared to 18 crashes on 02-23 on 3.0b2.  All crashes might be from one person testing, because all are "Windows NT 6.0.6001 Service Pack 1". But it's a mystery why a bug hasn't been filed. No bugs found filed in core or elsewhere since 02-14 that might relate to this. 
 
"modules" tab of bp-71d56576-ca00-478b-b95a-8fee02090223 lists:
NSLDAPPR32V60.dll	
smime3.dll	
nss3.dll	
nssutil3.dll	
ssl3.dll	
NSLDAP32V60.dll	
thunderbird.exe	hccutils.dll	
softokn3.dll	
nssdbm3.dll	
freebl3.dll	
nssckbi.dll	
nspr4.dll	
mdnsNSP.dll	
xpcom_core.dll	
sqlite3.dll	
...
msvcr80.dll	
GrooveUtil.DLL

Comment 4

[David :Bienvenu]

We're not null checking the alert text - the conversion in the idl to ACString from string and corresponding use of nsDependentCString caused this crash, along with a server issue (it would be very strange for the server to issue an ALERT with no text). Anyway, the fix is easy.

Comment 5

[David :Bienvenu]

Attachment: proposed fix

simple null check - nsImapIncomingServer::FEAlertFromServer already ignores empty strings, so this just adds a null check in a caller.

Comment 6

[Bryan Clark (DevTools PM) [:clarkbw]]

While this bug was found during the testing of tb3b2 (bug 477222) we're not blocking the release on this bug.  This bug has been around for a while so even though this is a crash and we have a fix already we won't re-spin specifically to get this in.   If we do happen to need a re-spin we should get this in, otherwise say hello to beta3 :)

Comment 7

[Wayne Mery (:wsmwk)]

(In reply to comment #4)
> We're not null checking the alert text - the conversion in the idl to ACString
> from string and corresponding use of nsDependentCString caused this crash,

so regression of bug 379070?

(~15 crashes/day on crash-stats from whomever is still testing 3.0b2, pre-announcement)

Comment 8

[David :Bienvenu]

yes, most likely a regression from that, or some other string bug...