Closed Bug 480870 Opened 11 years ago Closed 11 years ago

Crash on startup with IMAP account containing folders with subfolders but no messages in them [@ nsString::CharAt - nsString::operator]

Categories

(MailNews Core :: Backend, defect, critical)

x86_64
Linux
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED FIXED
Thunderbird 3.0b3

People

(Reporter: bernie, Assigned: Bienvenu)

Details

(Keywords: regression)

Attachments

(2 files, 1 obsolete file)

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009020410 Fedora/3.0.6-1.fc10 Firefox/3.0.6
Build Identifier: 

The following happens when I let TB connect to my IMAP server:

---cut---
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x80004001: file /home/bernie/src/oss/comm-central/mozilla/content/events/src/nsIMEStateManager.cpp, line 551
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
###!!! ASSERTION: index exceeds allowable range: 'i <= mLength', file ../../../mozilla/dist/include/string/nsTString.h, line 129

Program ./thunderbird-bin (pid = 16258) received signal 11.
Stack:
UNKNOWN [/lib64/libpthread.so.0 +0x0000F0F0]
UNKNOWN [./libmsgbaseutil.so +0x00046A25]
UNKNOWN [./libmsgbaseutil.so +0x00046A45]
NS_MsgHashIfNecessary(nsAutoString&)+0x000000B5 [./libmsgbaseutil.so +0x00071057]
nsMsgDBFolder::CreateFileForDB(nsAString_internal const&, nsILocalFile*, nsILocalFile**)+0x0000008C [./libmsgbaseutil.so +0x000428CC]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libmsgimap.so +0x00074C1E]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libmsgimap.so +0x00074A86]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libmsgimap.so +0x0003F8B4]
NS_InvokeByIndex_P+0x000001E0 [./libxpcom_core.so +0x000D3987]
UNKNOWN [./libxpcom_core.so +0x000C2E51]
UNKNOWN [./libxpcom_core.so +0x000B8F58]
NS_ProcessNextEvent_P(nsIThread*, int)+0x00000076 [./libxpcom_core.so +0x0004A006]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libwidget_gtk2.so +0x000664F0]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libtoolkitcomps.so +0x0000B0F4]
XRE_main+0x000027E3 [./libxul.so +0x0002904F]
UNKNOWN [./thunderbird-bin +0x00001A58]
__libc_start_main+0x000000E6 [/lib64/libc.so.6 +0x0001E576]
UNKNOWN [./thunderbird-bin +0x00001799]


Reproducible: Always

Steps to Reproduce:
Perhaps not easy to reproduce, there might be something in my profile that triggers this crash.  I tried removing the ImapMail directory, and a few other files.  Nothing seems to help.

If developers can't reproduce it, I could provide additional information such as my prefs.js on demand.
Backtrace

#0  0x00007ffff1107a25 in nsString::CharAt (this=0x7fffffffbf20, i=4294967295)
    at ../../../mozilla/dist/include/string/nsTString.h:130
#1  0x00007ffff1107a45 in nsString::operator[] (this=0x7fffffffbf20, i=4294967295)
    at ../../../mozilla/dist/include/string/nsTString.h:135
#2  0x00007ffff1132057 in NS_MsgHashIfNecessary (name=@0x7fffffffbf20)
    at /home/bernie/src/oss/comm-central/mailnews/base/util/nsMsgUtils.cpp:456
#3  0x00007ffff11038cc in nsMsgDBFolder::CreateFileForDB (this=0x7fffe3be1c00, userLeafName=@0x7fffffffc120, 
    path=0x7fffd6d60540, dbFile=0x7fffffffc3a0) at /home/bernie/src/oss/comm-central/mailnews/base/util/nsMsgDBFolder.cpp:851
#4  0x00007fffe6d4fc1e in nsImapMailFolder::CreateClientSubfolderInfo (this=0x7fffe3be1c00, folderName=@0x7fffffffc820, 
    hierarchyDelimiter=46, flags=72, suppressNotification=0)
    at /home/bernie/src/oss/comm-central/mailnews/imap/src/nsImapMailFolder.cpp:907
#5  0x00007fffe6d4fa86 in nsImapMailFolder::CreateClientSubfolderInfo (this=0x7fffe7838c00, folderName=@0x7fffffffd010, 
    hierarchyDelimiter=46, flags=72, suppressNotification=0)
    at /home/bernie/src/oss/comm-central/mailnews/imap/src/nsImapMailFolder.cpp:891
#6  0x00007fffe6d1a8b4 in nsImapIncomingServer::PossibleImapMailbox (this=0x7fffe6891990, folderPath=@0x7fffd6dd44d0, 
    hierarchyDelimiter=46, boxFlags=72, aNewFolder=0x7fffd9dfe5e4)
    at /home/bernie/src/oss/comm-central/mailnews/imap/src/nsImapIncomingServer.cpp:1223
#7  0x00007ffff79dc987 in NS_InvokeByIndex_P (that=0x7fffe6891a78, methodIndex=3, paramCount=4, params=0x7fffd6dda0e0)
    at /home/bernie/src/oss/comm-central/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_linux.cpp:208
#8  0x00007ffff79cbe51 in nsProxyObjectCallInfo::Run (this=0x7fffd6d99470)
    at /home/bernie/src/oss/comm-central/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181
#9  0x00007ffff79c1f58 in nsThread::ProcessNextEvent (this=0x7ffff6f27fb0, mayWait=1, result=0x7fffffffd3dc)
    at /home/bernie/src/oss/comm-central/mozilla/xpcom/threads/nsThread.cpp:510
#10 0x00007ffff7953006 in NS_ProcessNextEvent_P (thread=0x7ffff6f27fb0, mayWait=1) at nsThreadUtils.cpp:230
#11 0x00007fffee3e74f0 in nsBaseAppShell::Run (this=0x7ffff6e76dd0)
    at /home/bernie/src/oss/comm-central/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
#12 0x00007fffed5060f4 in nsAppStartup::Run (this=0x7ffff188e8d0)
    at /home/bernie/src/oss/comm-central/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:192
#13 0x0000000000c2604f in XRE_main (argc=1, argv=0x7fffffffdd88, aAppData=0x7ffff6f0a0f0)
    at /home/bernie/src/oss/comm-central/mozilla/toolkit/xre/nsAppRunner.cpp:3220
#14 0x0000000000401a58 in main (argc=1, argv=0x7fffffffdd88) at /home/bernie/src/oss/comm-central/mail/app/nsMailApp.cpp:103
Severity: normal → critical
In the following code, name.Length() is 0, and thus lastIndex is -1.

Eventually dereferencing name[lastIndex] leads to badness.


453	    PRInt32 lastIndex = name.Length() - 1;
454	    if (NS_LITERAL_STRING(ILLEGAL_FOLDER_CHARS_AS_FIRST_LETTER).FindChar(name[0]) != -1)
455	      illegalCharacterIndex = 0;
456	    else if (NS_LITERAL_STRING(ILLEGAL_FOLDER_CHARS_AS_LAST_LETTER).FindChar(name[lastIndex]) != -1)
457	      illegalCharacterIndex = lastIndex;
458	    else
459	      illegalCharacterIndex = -1;
Ok, I have something evil in my IMAP account:

 - a namespace called "arc" within the main namespace

 - an folder inside arc named Inbox with just subfolders in it
   and no messages (the server really doesn't have a corresponding
   folder for it)

 - an empty, inaccessible folder within Inbox that  I don't know
   how to kill
The attached patch fixed this bug for me.

You might find it somewhat crude, but consider it's my first attempt at hacking the mozilla codebase.
Attached patch crude patch (obsolete) — Splinter Review
This fixed the bug for me, but feel free to come up with a cleaner approach that deals with the root of the problem.
Attachment #364830 - Flags: review?
You should not use a wildcard review request
Component: General → Backend
Product: Thunderbird → MailNews Core
QA Contact: general → backend
Attachment #364830 - Flags: review? → review?(bienvenu)
Bernie, thx for looking into this. If you change CreateFileForDB to check for an empty name, do you still need to change the hash functions? If so, what does the stack look like when you hit those functions?

In the original crashing case, in PossibleImapMailbox, what does folderPath look like? And in nsImapMailFolder::CreateClientSubfolderInfo, what does folderName look like? I'm wondering if you have something like "//" in the folder name.
I'm going to confirm based on stack trace.
Status: UNCONFIRMED → NEW
Ever confirmed: true
actually, an imap protocol log of a session where you crash (i.e., w/o your patch) would be very helpful. The last folder we see in the protocol log is probably the problematic one.

https://wiki.mozilla.org/MailNews:Logging
(In reply to comment #7)
> Bernie, thx for looking into this. If you change CreateFileForDB to check for
> an empty name, do you still need to change the hash functions? If so, what does
> the stack look like when you hit those functions?

The patch to CreateFileForDB() alone is sufficient to fix the bug,
gut it might be more prudent to leave at least an assertion in
the hash functions for a non-zero name.
Attachment #364830 - Attachment description: crude patc → crude patch
ok, this server response is causing the problem:

 * LIST (\Noselect \HasChildren) "." "arc.Develer."

I'll try to come up with a fix in CreateClientSubfolderInfo for this. Thx for the log!
Assignee: nobody → bienvenu
Status: NEW → ASSIGNED
Flags: blocking-thunderbird3+
Keywords: regression
Target Milestone: --- → Thunderbird 3.0b3
Attached patch possible fixSplinter Review
Bernie, can you try this patch w/o your patches and see if it fixes the problem? Your server was returning a hierarchy delimiter at the end of the folder path, and the code that was trying to remove it was expecting the actual delimiter (in your case, '.') instead of the canonical delimiter ('/').

I can add more bulletproofing, but I'd like to know if this is sufficient to fix the issue.
(In reply to comment #13)
> Bernie, can you try this patch w/o your patches and see if it fixes the
> problem? Your server was returning a hierarchy delimiter at the end of the
> folder path, and the code that was trying to remove it was expecting the actual
> delimiter (in your case, '.') instead of the canonical delimiter ('/').
> 
> I can add more bulletproofing, but I'd like to know if this is sufficient to
> fix the issue.

Not only your patch alone is sufficient to fix this bug, it also makes those bogus empty folders go away.  Thanks a bunch!
Comment on attachment 365235 [details] [diff] [review]
possible fix

the folderPath is already in canonical format, so we should be checking for '/', not hierarchy delimiter.
Attachment #365235 - Flags: superreview?(bugzilla)
Attachment #365235 - Flags: review?(bugzilla)
Attachment #365086 - Attachment mime type: application/octet-stream → text/plain
Attachment #365235 - Flags: superreview?(bugzilla)
Attachment #365235 - Flags: superreview+
Attachment #365235 - Flags: review?(bugzilla)
Attachment #365235 - Flags: review+
Comment on attachment 364830 [details] [diff] [review]
crude patch

I believe this patch is obsolete now.
Attachment #364830 - Attachment is obsolete: true
Attachment #364830 - Flags: review?(bienvenu)
fixed on trunk. Thx for the help, Bernie!
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Summary: Crash on startup with imap account from old tb2 profile → Crash on startup with IMAP account containing folders with subfolders but no messages in them
bienvenu, is this in fact a regression? (you marked it around comment 13)

Thanks Bernie. adding missing crash keyword, and stack in summary.
Summary: Crash on startup with IMAP account containing folders with subfolders but no messages in them → Crash on startup with IMAP account containing folders with subfolders but no messages in them [@ nsString::CharAt - nsString::operator]
Version: unspecified → Trunk
I think it was a regression, yes, but I'm not positive.
Yes, it was a regression. Thunderbird 2.x worked for me.
You need to log in before you can comment on or make changes to this bug.