480870 - Crash on startup with IMAP account containing folders with subfolders but no messages in them [@ nsString::CharAt - nsString::operator]

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[Bernie Innocenti]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009020410 Fedora/3.0.6-1.fc10 Firefox/3.0.6
Build Identifier: 

The following happens when I let TB connect to my IMAP server:

---cut---
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
WARNING: NS_ENSURE_SUCCESS(rv, 0) failed with result 0x80004001: file /home/bernie/src/oss/comm-central/mozilla/content/events/src/nsIMEStateManager.cpp, line 551
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
###!!! ASSERTION: GetMinimumWidgetSize was ignored: 'rect->width == indicator_size', file /home/bernie/src/oss/comm-central/mozilla/widget/src/gtk2/gtk2drawing.c, line 987
###!!! ASSERTION: index exceeds allowable range: 'i <= mLength', file ../../../mozilla/dist/include/string/nsTString.h, line 129

Program ./thunderbird-bin (pid = 16258) received signal 11.
Stack:
UNKNOWN [/lib64/libpthread.so.0 +0x0000F0F0]
UNKNOWN [./libmsgbaseutil.so +0x00046A25]
UNKNOWN [./libmsgbaseutil.so +0x00046A45]
NS_MsgHashIfNecessary(nsAutoString&)+0x000000B5 [./libmsgbaseutil.so +0x00071057]
nsMsgDBFolder::CreateFileForDB(nsAString_internal const&, nsILocalFile*, nsILocalFile**)+0x0000008C [./libmsgbaseutil.so +0x000428CC]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libmsgimap.so +0x00074C1E]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libmsgimap.so +0x00074A86]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libmsgimap.so +0x0003F8B4]
NS_InvokeByIndex_P+0x000001E0 [./libxpcom_core.so +0x000D3987]
UNKNOWN [./libxpcom_core.so +0x000C2E51]
UNKNOWN [./libxpcom_core.so +0x000B8F58]
NS_ProcessNextEvent_P(nsIThread*, int)+0x00000076 [./libxpcom_core.so +0x0004A006]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libwidget_gtk2.so +0x000664F0]
UNKNOWN [/home/bernie/src/oss/objdir-x86_64-unknown-linux-gnu/mail/mozilla/dist/bin/components/libtoolkitcomps.so +0x0000B0F4]
XRE_main+0x000027E3 [./libxul.so +0x0002904F]
UNKNOWN [./thunderbird-bin +0x00001A58]
__libc_start_main+0x000000E6 [/lib64/libc.so.6 +0x0001E576]
UNKNOWN [./thunderbird-bin +0x00001799]


Reproducible: Always

Steps to Reproduce:
Perhaps not easy to reproduce, there might be something in my profile that triggers this crash.  I tried removing the ImapMail directory, and a few other files.  Nothing seems to help.

If developers can't reproduce it, I could provide additional information such as my prefs.js on demand.

Comment 1

[Bernie Innocenti]

Backtrace

#0  0x00007ffff1107a25 in nsString::CharAt (this=0x7fffffffbf20, i=4294967295)
    at ../../../mozilla/dist/include/string/nsTString.h:130
#1  0x00007ffff1107a45 in nsString::operator[] (this=0x7fffffffbf20, i=4294967295)
    at ../../../mozilla/dist/include/string/nsTString.h:135
#2  0x00007ffff1132057 in NS_MsgHashIfNecessary (name=@0x7fffffffbf20)
    at /home/bernie/src/oss/comm-central/mailnews/base/util/nsMsgUtils.cpp:456
#3  0x00007ffff11038cc in nsMsgDBFolder::CreateFileForDB (this=0x7fffe3be1c00, userLeafName=@0x7fffffffc120, 
    path=0x7fffd6d60540, dbFile=0x7fffffffc3a0) at /home/bernie/src/oss/comm-central/mailnews/base/util/nsMsgDBFolder.cpp:851
#4  0x00007fffe6d4fc1e in nsImapMailFolder::CreateClientSubfolderInfo (this=0x7fffe3be1c00, folderName=@0x7fffffffc820, 
    hierarchyDelimiter=46, flags=72, suppressNotification=0)
    at /home/bernie/src/oss/comm-central/mailnews/imap/src/nsImapMailFolder.cpp:907
#5  0x00007fffe6d4fa86 in nsImapMailFolder::CreateClientSubfolderInfo (this=0x7fffe7838c00, folderName=@0x7fffffffd010, 
    hierarchyDelimiter=46, flags=72, suppressNotification=0)
    at /home/bernie/src/oss/comm-central/mailnews/imap/src/nsImapMailFolder.cpp:891
#6  0x00007fffe6d1a8b4 in nsImapIncomingServer::PossibleImapMailbox (this=0x7fffe6891990, folderPath=@0x7fffd6dd44d0, 
    hierarchyDelimiter=46, boxFlags=72, aNewFolder=0x7fffd9dfe5e4)
    at /home/bernie/src/oss/comm-central/mailnews/imap/src/nsImapIncomingServer.cpp:1223
#7  0x00007ffff79dc987 in NS_InvokeByIndex_P (that=0x7fffe6891a78, methodIndex=3, paramCount=4, params=0x7fffd6dda0e0)
    at /home/bernie/src/oss/comm-central/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_linux.cpp:208
#8  0x00007ffff79cbe51 in nsProxyObjectCallInfo::Run (this=0x7fffd6d99470)
    at /home/bernie/src/oss/comm-central/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181
#9  0x00007ffff79c1f58 in nsThread::ProcessNextEvent (this=0x7ffff6f27fb0, mayWait=1, result=0x7fffffffd3dc)
    at /home/bernie/src/oss/comm-central/mozilla/xpcom/threads/nsThread.cpp:510
#10 0x00007ffff7953006 in NS_ProcessNextEvent_P (thread=0x7ffff6f27fb0, mayWait=1) at nsThreadUtils.cpp:230
#11 0x00007fffee3e74f0 in nsBaseAppShell::Run (this=0x7ffff6e76dd0)
    at /home/bernie/src/oss/comm-central/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
#12 0x00007fffed5060f4 in nsAppStartup::Run (this=0x7ffff188e8d0)
    at /home/bernie/src/oss/comm-central/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:192
#13 0x0000000000c2604f in XRE_main (argc=1, argv=0x7fffffffdd88, aAppData=0x7ffff6f0a0f0)
    at /home/bernie/src/oss/comm-central/mozilla/toolkit/xre/nsAppRunner.cpp:3220
#14 0x0000000000401a58 in main (argc=1, argv=0x7fffffffdd88) at /home/bernie/src/oss/comm-central/mail/app/nsMailApp.cpp:103

Comment 2

[Bernie Innocenti]

In the following code, name.Length() is 0, and thus lastIndex is -1.

Eventually dereferencing name[lastIndex] leads to badness.


453	    PRInt32 lastIndex = name.Length() - 1;
454	    if (NS_LITERAL_STRING(ILLEGAL_FOLDER_CHARS_AS_FIRST_LETTER).FindChar(name[0]) != -1)
455	      illegalCharacterIndex = 0;
456	    else if (NS_LITERAL_STRING(ILLEGAL_FOLDER_CHARS_AS_LAST_LETTER).FindChar(name[lastIndex]) != -1)
457	      illegalCharacterIndex = lastIndex;
458	    else
459	      illegalCharacterIndex = -1;

Comment 3

[Bernie Innocenti]

Ok, I have something evil in my IMAP account:

 - a namespace called "arc" within the main namespace

 - an folder inside arc named Inbox with just subfolders in it
   and no messages (the server really doesn't have a corresponding
   folder for it)

 - an empty, inaccessible folder within Inbox that  I don't know
   how to kill

Comment 4

[Bernie Innocenti]

The attached patch fixed this bug for me.

You might find it somewhat crude, but consider it's my first attempt at hacking the mozilla codebase.

Comment 5

[Bernie Innocenti]

Attachment: crude patch

This fixed the bug for me, but feel free to come up with a cleaner approach that deals with the root of the problem.

Comment 6

[Matthias Versen [:Matti]]

You should not use a wildcard review request

Comment 7

[David :Bienvenu]

Bernie, thx for looking into this. If you change CreateFileForDB to check for an empty name, do you still need to change the hash functions? If so, what does the stack look like when you hit those functions?

In the original crashing case, in PossibleImapMailbox, what does folderPath look like? And in nsImapMailFolder::CreateClientSubfolderInfo, what does folderName look like? I'm wondering if you have something like "//" in the folder name.

Comment 8

[David :Bienvenu]

I'm going to confirm based on stack trace.

Comment 9

[David :Bienvenu]

actually, an imap protocol log of a session where you crash (i.e., w/o your patch) would be very helpful. The last folder we see in the protocol log is probably the problematic one.

https://wiki.mozilla.org/MailNews:Logging

Comment 10

[Bernie Innocenti]

Attachment: dump of the conversation with the imap server before the crash

Comment 11

[Bernie Innocenti]

(In reply to comment #7)
> Bernie, thx for looking into this. If you change CreateFileForDB to check for
> an empty name, do you still need to change the hash functions? If so, what does
> the stack look like when you hit those functions?

The patch to CreateFileForDB() alone is sufficient to fix the bug,
gut it might be more prudent to leave at least an assertion in
the hash functions for a non-zero name.

Comment 12

[David :Bienvenu]

ok, this server response is causing the problem:

 * LIST (\Noselect \HasChildren) "." "arc.Develer."

I'll try to come up with a fix in CreateClientSubfolderInfo for this. Thx for the log!

Comment 13

[David :Bienvenu]

Attachment: possible fix

Bernie, can you try this patch w/o your patches and see if it fixes the problem? Your server was returning a hierarchy delimiter at the end of the folder path, and the code that was trying to remove it was expecting the actual delimiter (in your case, '.') instead of the canonical delimiter ('/').

I can add more bulletproofing, but I'd like to know if this is sufficient to fix the issue.

Comment 14

[Bernie Innocenti]

(In reply to comment #13)
> Bernie, can you try this patch w/o your patches and see if it fixes the
> problem? Your server was returning a hierarchy delimiter at the end of the
> folder path, and the code that was trying to remove it was expecting the actual
> delimiter (in your case, '.') instead of the canonical delimiter ('/').
> 
> I can add more bulletproofing, but I'd like to know if this is sufficient to
> fix the issue.

Not only your patch alone is sufficient to fix this bug, it also makes those bogus empty folders go away.  Thanks a bunch!

Comment 15

[David :Bienvenu]

Comment on attachment 365235 [details] [diff] [review]
possible fix

the folderPath is already in canonical format, so we should be checking for '/', not hierarchy delimiter.

Comment 16

[Mark Banner (:standard8)]

Comment on attachment 364830 [details] [diff] [review]
crude patch

I believe this patch is obsolete now.

Comment 17

[David :Bienvenu]

fixed on trunk. Thx for the help, Bernie!

Comment 18

[Wayne Mery (:wsmwk)]

bienvenu, is this in fact a regression? (you marked it around comment 13)

Thanks Bernie. adding missing crash keyword, and stack in summary.

Comment 19

[David :Bienvenu]

I think it was a regression, yes, but I'm not positive.

Comment 20

[Bernie Innocenti]

Yes, it was a regression. Thunderbird 2.x worked for me.