492475 - crash [@ nsMsgThreadedDBView::MoveThreadAt(unsigned int)]

Status: VERIFIED FIXED

(Thunderbird :: Folder and Message Lists, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsMsgThreadedDBView::MoveThreadAt]

only 7 crashes beginning with 20090509031542 build and not same stack as bug 464802. I have no idea who the other 6 crashes belong to

 my (only) crash bp-604dacde-e12f-4564-af76-239152090511

0	thunderbird.exe	nsMsgThreadedDBView::MoveThreadAt	 mailnews/base/src/nsMsgThreadedDBView.cpp:769
1	thunderbird.exe	nsMsgThreadedDBView::OnNewHeader	mailnews/base/src/nsMsgThreadedDBView.cpp:678
2	thunderbird.exe	nsMsgDBView::OnHdrAdded	mailnews/base/src/nsMsgDBView.cpp:5418
3	thunderbird.exe	nsMsgDatabase::NotifyHdrAddedAll	mailnews/db/msgdb/src/nsMsgDatabase.cpp:688
4	thunderbird.exe	nsMsgDatabase::AddNewHdrToDB	mailnews/db/msgdb/src/nsMsgDatabase.cpp:3020
5	thunderbird.exe	nsImapMailDatabase::AddNewHdrToDB	mailnews/db/msgdb/src/nsImapMailDatabase.cpp:154
6	thunderbird.exe	nsImapMailFolder::NormalEndHeaderParseStream	mailnews/imap/src/nsImapMailFolder.cpp:2949
7	thunderbird.exe	nsImapMailFolder::ParseMsgHdrs	mailnews/imap/src/nsImapMailFolder.cpp:2784
8	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
9	xpcom_core.dll	nsEventQueue::GetEvent	xpcom/threads/nsEventQueue.cpp:100 

regression of bug 466048?

Comment 1

[Peter Weilbacher]

I get the same on Linux amd64. I'm running a self-compiled build [Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b5pre) Gecko/20090511 SeaMonkey/2.0b1pre] compiled with --enable-debugger-info-modules=yes and get this in the gdb:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fa896212750 (LWP 29324)]
_______________________________________________________________________________
Error while running hook_stop:
Value can't be converted to integer.
0x00007fa888523023 in nsMsgThreadedDBView::MoveThreadAt (this=0x7fa86b6e4c00, threadIndex=0x0) at /home/mozilla/comm-central/mailnews/base/src/nsMsgThreadedDBView.cpp:769
769	                         selectionCount > 0);
gdb> bt
#0  0x00007fa888523023 in nsMsgThreadedDBView::MoveThreadAt (this=0x7fa86b6e4c00, threadIndex=0x0) at /home/mozilla/comm-central/mailnews/base/src/nsMsgThreadedDBView.cpp:769
#1  0x00007fa88852357e in nsMsgThreadedDBView::OnNewHeader (this=0x7fa86b6e4c00, newHdr=0x7fa865a90040, aParentKey=0x48c, ensureListed=0x10010) at /home/mozilla/comm-central/mailnews/base/src/nsMsgThreadedDBView.cpp:678
#2  0x00007fa8885e85b0 in nsMsgDatabase::NotifyHdrAddedAll (this=<value optimized out>, aHdrAdded=0x7fa865a90040, aParentKey=0x48c, aFlags=0x10010, aInstigator=0x0) at /home/mozilla/comm-central/mailnews/db/msgdb/src/nsMsgDatabase.cpp:688
#3  0x00007fa8885eb5d7 in nsMsgDatabase::AddNewHdrToDB (this=0x7fa86a76d5f0, newHdr=0x7fa865a90040, notify=0x1) at /home/mozilla/comm-central/mailnews/db/msgdb/src/nsMsgDatabase.cpp:3020
#4  0x00007fa8886b6bac in nsNNTPNewsgroupList::CallFilters (this=0x7fa864bfa3e0) at /home/mozilla/comm-central/mailnews/news/src/nsNNTPNewsgroupList.cpp:1157
#5  0x00007fa8886bc798 in nsNNTPProtocol::ProcessXover (this=0x7fa864ac8000) at /home/mozilla/comm-central/mailnews/news/src/nsNNTPProtocol.cpp:3557
#6  0x00007fa8886c90b5 in nsNNTPProtocol::ProcessProtocolState (this=0x7fa864ac8000, url=0x7fa864ce5368, inputStream=0x7fa865187110, sourceOffset=<value optimized out>, length=0x125) at /home/mozilla/comm-central/mailnews/news/src/nsNNTPProtocol.cpp:5136
#7  0x00007fa8884b985d in nsMsgProtocol::OnDataAvailable (this=0x7fa864ac8018, request=<value optimized out>, ctxt=<value optimized out>, inStr=0x7fa865187110, sourceOffset=0xaff1, count=0x125) at /home/mozilla/comm-central/mailnews/base/util/nsMsgProtocol.cpp:350
#8  0x00007fa887a12c5e in nsInputStreamPump::OnStateTransfer (this=0x7fa864bd7630) at /home/mozilla/comm-central/mozilla/netwerk/base/src/nsInputStreamPump.cpp:508
#9  0x00007fa887a12de8 in nsInputStreamPump::OnInputStreamReady (this=0x7fa864bd7630, stream=<value optimized out>) at /home/mozilla/comm-central/mozilla/netwerk/base/src/nsInputStreamPump.cpp:398
#10 0x00007fa895467837 in nsInputStreamReadyEvent::Run (this=<value optimized out>) at /home/mozilla/comm-central/mozilla/xpcom/io/nsStreamUtils.cpp:111
#11 0x00007fa895482e1b in nsThread::ProcessNextEvent (this=0x7fa88dc2e160, mayWait=0x1, result=0x7fff9e249bbc) at /home/mozilla/comm-central/mozilla/xpcom/threads/nsThread.cpp:510
#12 0x00007fa895440af9 in NS_ProcessNextEvent_P (thread=0x0, mayWait=0x1) at nsThreadUtils.cpp:227
#13 0x00007fa885a19e3d in nsBaseAppShell::Run (this=0x7fa8890909a0) at /home/mozilla/comm-central/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
#14 0x00007fa884e8fa76 in nsAppStartup::Run (this=0x7fa8890a06c0) at /home/mozilla/comm-central/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:193
#15 0x00007fa895914aab in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>) at /home/mozilla/comm-central/mozilla/toolkit/xre/nsAppRunner.cpp:3298
#16 0x0000000000401b19 in main (argc=0x1, argv=0x7fff9e24a388) at /home/mozilla/comm-central/suite/app/nsSuiteApp.cpp:103

I don't see how but it does crash in the hasSelection line added by bug 466048.

Comment 2

[David :Bienvenu]

maybe a null mTree or mTreeSelection...

Comment 3

[David :Bienvenu]

Attachment: fix null check for mTree and mTreeSelection

add braces so mTree and mTreeSelection test is anded with the rest of the clauses.

Comment 4

[Robert Roessler]

Have you looked at Bug 492590 on the SeaMonkey email client?  It includes behavioral descriptions that you might find a) helpful, or b) use to rule out (or confirm) any connection.

Comment 5

[David :Bienvenu]

It's probably a dup - when the fix for this lands, you could recheck that one.

Comment 6

[David :Bienvenu]

fix checked in.

Comment 7

[Robert Roessler]

Thanks, David - as of the SeaMonkey nightly build of 2009/5/14, this does indeed fix my observed SeaMonkey 2 trunk build crash.  I tested both single attachment delete as well as "Delete All" operations, and all functionality is now restored.

Comment 8

[David :Bienvenu]

cool, thx, marking verified, then.