529429 - crash [@ morkTable::CutRow(nsIMdbEnv*, nsIMdbRow*)]

Status: RESOLVED FIXED

(MailNews Core :: Database, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ morkTable::CutRow(nsIMdbEnv*, nsIMdbRow*)]

low rank crasher from crash-stats. two typical examples:

3.0 20091112084939 bp-7e45f0f7-ffff-46a7-af32-49dfb2091117
0	thunderbird.exe	morkTable::CutRow	 db/mork/src/morkTable.cpp:698
1	thunderbird.exe	nsMsgDatabase::RemoveHeaderFromDB	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1852
2	thunderbird.exe	nsMsgDatabase::DeleteHeader	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1795
3	thunderbird.exe	nsMsgLocalMailFolder::DeleteMessage	mailnews/local/src/nsLocalMailFolder.cpp:2265
4	thunderbird.exe	nsMsgLocalMailFolder::DeleteMessages	mailnews/local/src/nsLocalMailFolder.cpp:1504
5	thunderbird.exe	nsMsgSendLater::DeleteCurrentMessage	mailnews/compose/src/nsMsgSendLater.cpp:893
6	thunderbird.exe	nsMsgSendLater::OnSendStepFinished	mailnews/compose/src/nsMsgSendLater.cpp:1360
7	thunderbird.exe	SendOperationListener::OnStopSending	mailnews/compose/src/nsMsgSendLater.cpp:470
8	thunderbird.exe	nsMsgComposeAndSend::NotifyListenerOnStopSending	mailnews/compose/src/nsMsgSend.cpp:4066
9	thunderbird.exe	nsMsgComposeAndSend::DoDeliveryExitProcessing	mailnews/compose/src/nsMsgSend.cpp:3915
10	thunderbird.exe	nsMsgComposeAndSend::DeliverAsMailExit	mailnews/compose/src/nsMsgSend.cpp:3948
11	thunderbird.exe	nsMsgComposeAndSend::SendDeliveryCallback	mailnews/compose/src/nsMsgSend.cpp:3502
12	thunderbird.exe	MsgDeliveryListener::OnStopRunningUrl	mailnews/compose/src/nsMsgSend.cpp:276
13	thunderbird.exe	nsMsgMailNewsUrl::SetUrlState	mailnews/base/util/nsMsgMailNewsUrl.cpp:135
14	thunderbird.exe	nsSmtpProtocol::ProcessProtocolState	mailnews/compose/src/nsSmtpProtocol.cpp:1805 


3.0b3 bp-b35b0abd-e242-4fc9-84e1-d2d1a2090908 hit "delete junk mail".. one junk mail was in teh inbox
0	thunderbird.exe	morkTable::CutRow	 db/mork/src/morkTable.cpp:698
1	thunderbird.exe	nsMsgDatabase::RemoveHeaderFromDB	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1841
2	thunderbird.exe	nsMsgDatabase::DeleteHeader	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1784
3	thunderbird.exe	nsMsgLocalMailFolder::DeleteMessage	mailnews/local/src/nsLocalMailFolder.cpp:2217
4	thunderbird.exe	nsMsgLocalMailFolder::DeleteMessages	mailnews/local/src/nsLocalMailFolder.cpp:1500
5	thunderbird.exe	nsMsgLocalMailFolder::EndMove	mailnews/local/src/nsLocalMailFolder.cpp:2786
6	thunderbird.exe	nsCopyMessageStreamListener::EndCopy	mailnews/base/src/nsCopyMessageStreamListener.cpp:179
7	thunderbird.exe	nsCopyMessageStreamListener::OnStopRequest	mailnews/base/src/nsCopyMessageStreamListener.cpp:190
8	thunderbird.exe	nsMsgProtocol::OnStopRequest	mailnews/base/util/nsMsgProtocol.cpp:393
9	thunderbird.exe	nsMailboxProtocol::OnStopRequest	mailnews/local/src/nsMailboxProtocol.cpp:380
10	thunderbird.exe	nsInputStreamPump::OnStateStop	netwerk/base/src/nsInputStreamPump.cpp:576
11	thunderbird.exe	nsInputStreamPump::OnInputStreamReady	netwerk/base/src/nsInputStreamPump.cpp:401
12	xpcom_core.dll	nsInputStreamReadyEvent::Run	xpcom/io/nsStreamUtils.cpp:111
13	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:510 


some eudora, eg bp-4367240c-9707-4d22-9675-865382090722
some SM eg bp-21cb62a6-450c-459c-87d4-ce7382091112

Comment 1

[Wayne Mery (:wsmwk)]

* was veiwing email messages and it just disapeared
* In search filter for rss, select all message and delete permanently (keyboard shift + delete), pop up reports message in use. After clicking OK of the pop up messagebox, thunderbird crash. Can be reproduced but not always.
* This crash happens when I have just sent it a message, it's still in the outbox, and I delete messages in my inbox before the message has completed background sending.
* Compacted local inbox while receiving mail and rules were executing.

Comment 2

[timeless]

careful:
160 NS_IMETHODIMP nsImapMailDatabase::UpdatePendingAttributes(nsIMsgDBHdr* aNewHdr)
193       nsIMdbRow *row = msgHdr->GetMDBRow();
...
202             if (row)
203               row->AddColumn(GetEnv(), cellColumn, &cellYarn);

3427 NS_IMETHODIMP nsMsgDatabase::CopyHdrFromExistingHdr(nsMsgKey key, nsIMsgDBHdr *existingHdr, PRBool addHdrToDB, nsIMsgDBHdr **newHdr)
3439     nsIMdbRow  *sourceRow = sourceMsgHdr->GetMDBRow();
3440     if (!destMsgHdr || !sourceRow)
3441       return NS_MSG_MESSAGE_NOT_FOUND;

1140 nsMsgPropertyEnumerator::nsMsgPropertyEnumerator(nsMsgHdr* aHdr)
1147   if (aHdr &&
1148       (mdbRow = aHdr->GetMDBRow()) &&

callee checks:
330 NS_IMETHODIMP nsMsgHdr::GetNumReferences(PRUint16 *result)
335     if (NS_SUCCEEDED(m_mdb->RowCellColumnToConstCharPtr(GetMDBRow(),

690 NS_IMETHODIMP nsMsgHdr::GetAuthor(char* *resultAuthor)
692   return m_mdb->RowCellColumnToCharPtr(GetMDBRow(), m_mdb->m_senderColumnToken, resultAuthor);

695 NS_IMETHODIMP nsMsgHdr::GetSubject(char* *resultSubject)
697   return m_mdb->RowCellColumnToCharPtr(GetMDBRow(), m_mdb->m_subjectColumnToken, resultSubject);

700 NS_IMETHODIMP nsMsgHdr::GetRecipients(char* *resultRecipients)
702   return m_mdb->RowCellColumnToCharPtr(GetMDBRow(), m_mdb->m_recipientsColumnToken, resultRecipients);

705 NS_IMETHODIMP nsMsgHdr::GetCcList(char * *resultCCList)
707   return m_mdb->RowCellColumnToCharPtr(GetMDBRow(), m_mdb->m_ccListColumnToken, resultCCList);

710 NS_IMETHODIMP nsMsgHdr::GetBccList(char * *resultBCCList)
712   return m_mdb->RowCellColumnToCharPtr(GetMDBRow(), m_mdb->m_bccListColumnToken, resultBCCList);

715 NS_IMETHODIMP nsMsgHdr::GetMessageId(char * *resultMessageId)
717   return m_mdb->RowCellColumnToCharPtr(GetMDBRow(), m_mdb->m_messageIdColumnToken, resultMessageId);

720 NS_IMETHODIMP nsMsgHdr::GetMime2DecodedAuthor(nsAString &resultAuthor)
722   return m_mdb->RowCellColumnToMime2DecodedString(GetMDBRow(), m_mdb->m_senderColumnToken, resultAuthor);

725 NS_IMETHODIMP nsMsgHdr::GetMime2DecodedSubject(nsAString &resultSubject)
727   return m_mdb->RowCellColumnToMime2DecodedString(GetMDBRow(), m_mdb->m_subjectColumnToken, resultSubject);

730 NS_IMETHODIMP nsMsgHdr::GetMime2DecodedRecipients(nsAString &resultRecipients)
732   return m_mdb->RowCellColumnToMime2DecodedString(GetMDBRow(), m_mdb->m_recipientsColumnToken, resultRecipients);

736 NS_IMETHODIMP nsMsgHdr::GetAuthorCollationKey(PRUint8 **resultAuthor, PRUint32 *len)
738   return m_mdb->RowCellColumnToAddressCollationKey(GetMDBRow(), m_mdb->m_senderColumnToken, resultAuthor, len);

741 NS_IMETHODIMP nsMsgHdr::GetSubjectCollationKey(PRUint8 **resultSubject, PRUint32 *len)
743   return m_mdb->RowCellColumnToCollationKey(GetMDBRow(), m_mdb->m_subjectColumnToken, resultSubject, len);

746 NS_IMETHODIMP nsMsgHdr::GetRecipientsCollationKey(PRUint8 **resultRecipients, PRUint32 *len)
748   return m_mdb->RowCellColumnToCollationKey(GetMDBRow(), m_mdb->m_recipientsColumnToken, resultRecipients, len);

751 NS_IMETHODIMP nsMsgHdr::GetCharset(char **aCharset)
753   return m_mdb->RowCellColumnToCharPtr(GetMDBRow(), m_mdb->m_messageCharSetColumnToken, aCharset);

carefree:
516 NS_IMETHODIMP  nsMailDatabase::RemoveOfflineOp(nsIMsgOfflineImapOperation *op)
525   nsIMdbRow* row = offlineOp->GetMDBRow();
526   rv = m_mdbAllOfflineOpsTable->CutRow(GetEnv(), row);
527   row->CutAllColumns(GetEnv());

<you are here>
1996 nsresult nsMsgDatabase::RemoveHeaderFromDB(nsMsgHdr *msgHdr)
2005   nsIMdbRow* row = msgHdr->GetMDBRow();
2006   ret = m_mdbAllMsgHeadersTable->CutRow(GetEnv(), row);

3375 NS_IMETHODIMP nsMsgDatabase::AddNewHdrToDB(nsIMsgDBHdr *newHdr, PRBool notify)
3411     err = m_mdbAllMsgHeadersTable->AddRow(GetEnv(), hdr->GetMDBRow());

3427 NS_IMETHODIMP nsMsgDatabase::CopyHdrFromExistingHdr(nsMsgKey key, nsIMsgDBHdr *existingHdr, PRBool addHdrToDB, nsIMsgDBHdr **newHdr)
3443     nsIMdbRow  *destRow = destMsgHdr->GetMDBRow();
3444     err = destRow->SetRow(GetEnv(), sourceRow);

189 nsresult nsMsgThread::RerootThread(nsIMsgDBHdr *newParentOfOldRoot, nsIMsgDBHdr *oldRoot, nsIDBChangeAnnouncer *announcer)
219     nsIMdbRow *newRootHdrRow = rootMsgHdr->GetMDBRow();
221     m_mdbTable->MoveRow(m_mdbDB->GetEnv(), newRootHdrRow, -1, 0, &outPos);

227 NS_IMETHODIMP nsMsgThread::AddChild(nsIMsgDBHdr *child, nsIMsgDBHdr *inReplyTo, PRBool threadInThread,
237   nsIMdbRow *hdrRow = hdr->GetMDBRow();
267   if (m_mdbTable)
269     m_mdbTable->AddRow(m_mdbDB->GetEnv(), hdrRow);

3375 NS_IMETHODIMP nsMsgDatabase::AddNewHdrToDB(nsIMsgDBHdr *newHdr, PRBool notify)
3411     err = m_mdbAllMsgHeadersTable->AddRow(GetEnv(), hdr->GetMDBRow());

Comment 3

[Wayne Mery (:wsmwk)]

bienvenu, does this make sense?  do you need anything else?

note: most crashes have significant uptime

topcrash in 3.1.6

Comment 4

[Wayne Mery (:wsmwk)]

#46 in v3.1.7

unfortunately almost no comments and no addresses:
bp-dbf319a7-8b12-43b6-b233-4dfa32101225 is shortest uptime
bp-cf30074b-2aa1-41e6-9215-510492101231 (josem) emailed

Comment 5

[Mark Banner (:standard8)]

Not blocking 3.3 on this, especially as it isn't near the top of the crash stats.

Comment 6

[Makoto Kato [:m_kato]]

Attachment: fix

Comment 7

[Makoto Kato [:m_kato]]

about comment #3, we should handle another separated bugs.

Comment 8

[Makoto Kato [:m_kato]]

oops, s/comment #3/comment #2/

Comment 9

[David :Bienvenu]

Comment on attachment 548700 [details] [diff] [review]
fix

thx for working on this.

this:

+  NS_ENSURE_TRUE(row, NS_MSG_MESSAGE_NOT_FOUND);

means we'll skip this:

   msgHdr->m_initedValues = 0; // invalidate cached values.

which I'd rather not do. Can you rework it so we still clear that flag even when we can't find a row?

Comment 10

[Makoto Kato [:m_kato]]

Attachment: fix v2

Comment 11

[David :Bienvenu]

Comment on attachment 549741 [details] [diff] [review]
fix v2

thx for the patch, r=me, but can you fix the braces to match the prevailing style in the file before checkin in? Thx!

Comment 12

[Makoto Kato [:m_kato]]

landed with style changed
http://hg.mozilla.org/comm-central/rev/f80dd2316fcb

Comment 13

[Wayne Mery (:wsmwk)]

At #46 for TB5 this is probably high and simple enough to want for version 7. 
But we are not going to be able to tell from crash-stats whether the patch squashed the crash in v8 or v7 betas/alphas. Only v7 release stats can tell us.

Comment 14

[Mark Banner (:standard8)]

At 150 crashes per week, we're definitely not going to track this. Nominate it for approval-comm-aurora if you want it to get into 7.

Comment 15

[Wayne Mery (:wsmwk)]

Comment on attachment 549741 [details] [diff] [review]
fix v2

sorry, yeah, that was wrong flag

Comment 16

[Mark Banner (:standard8)]

Comment on attachment 549741 [details] [diff] [review]
fix v2

We're comm, not mozilla ;-)

Comment 17

[Mark Banner (:standard8)]

Checked into aurora: http://hg.mozilla.org/releases/comm-aurora/rev/a166416526d2