503854 - crash [@ nsMsgDBView::FindHdr(nsIMsgDBHdr*, unsigned int, int)]

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsMsgDBView::FindHdr(nsIMsgDBHdr*, unsigned int, int)]

3.0b3pre topcrash. none for 3.0b2, so regression. the earliest build to crash is 20090630032137 based on a query of 4 weeks.  someone can look at previous month to determine if it starts earlier

bp-66a4fb95-1c20-4813-87a7-073e12090713
Frame	Module	Signature [Expand]	Source
0	thunderbird.exe	nsMsgDBView::FindHdr	mailnews/base/src/nsMsgDBView.cpp:4428
1	thunderbird.exe	nsMsgDBView::GetIndexOfFirstDisplayedKeyInThread	mailnews/base/src/nsMsgDBView.cpp:4288
2	thunderbird.exe	nsMsgGroupView::AddHdrToThread	mailnews/base/src/nsMsgGroupView.cpp:383
3	thunderbird.exe	nsMsgGroupView::OnNewHeader	mailnews/base/src/nsMsgGroupView.cpp:572
4	thunderbird.exe	nsMsgDBView::OnHdrAdded	mailnews/base/src/nsMsgDBView.cpp:5617
5	thunderbird.exe	nsMsgDatabase::NotifyHdrAddedAll	mailnews/db/msgdb/src/nsMsgDatabase.cpp:712
6	thunderbird.exe	nsMsgDatabase::AddNewHdrToDB	mailnews/db/msgdb/src/nsMsgDatabase.cpp:3061
7	thunderbird.exe	nsImapMailDatabase::AddNewHdrToDB	mailnews/db/msgdb/src/nsImapMailDatabase.cpp:154
8	thunderbird.exe	nsImapMailFolder::NormalEndHeaderParseStream	mailnews/imap/src/nsImapMailFolder.cpp:2981
9	thunderbird.exe	nsImapMailFolder::ParseMsgHdrs	mailnews/imap/src/nsImapMailFolder.cpp:2811
10	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101

Comment 1

[Kent James (:rkent)]

A check for null hdr would probably stop the crash here:

4424 nsMsgViewIndex nsMsgDBView::FindHdr(nsIMsgDBHdr *msgHdr, nsMsgViewIndex startIndex,
4425                                     PRBool allowDummy)
4426 {
4427   nsMsgKey msgKey;
4428   msgHdr->GetMessageKey(&msgKey);

Root cause would be more difficult, it is a missing child hdr here in nsMsgDBView::GetIndexOfFirstDisplayedKeyInThread:

4284   while (retIndex == nsMsgViewIndex_None && childIndex < numThreadChildren)
4285   {
4286     nsCOMPtr<nsIMsgDBHdr> childHdr;
4287     threadHdr->GetChildHdrAt(childIndex++, getter_AddRefs(childHdr));
4288     retIndex = FindHdr(childHdr, 0, allowDummy);
4289   }

Comment 2

[Wayne Mery (:wsmwk)]

this has shaken out to be #13 topcrash for 3.0b3.
#5 for 3.0b4pre.
nominating blocking

the earliest crash going back to January is 20090318032831 for bp-bcc26963-c7ed-4451-a0d4-093372090319 Copied Google Sent Mail into Inbox then clicked on Inbox

Comment 3

[David :Bienvenu]

I'll have a look at this.

Comment 4

[David :Bienvenu]

Attachment: fix crash

this should fix the crash, though I've never seen this myself...

Comment 5

[David :Bienvenu]

fix checked in.