539784 - crash [@ nsMsgXFViewThread::AddHdr(nsIMsgDBHdr*, int, unsigned int&, nsIMsgDBHdr**)] manipulating messages in virtual folder

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

crash [nsMsgXFViewThread::AddHdr(nsIMsgDBHdr*, int, unsigned int&, nsIMsgDBHdr**)] manipulating messages in virtual folder.
(very unusual) crash-stats reports this for all 3 OS. #74 for 3.0.0

going back to july, I find no crashes prior to build 20091029032301, so probable regression. but not enough trunk crashes to determine regression date [1]

1. virtual folder over several folders, including trash
2. deleted a couple messages in the virtual folder
3. r-click trash and empty
4. the lines in virtual folder for message in trash go blank/don't collapse out
   (not unlike bug 515400 delete message from Search Messages results doesn't update view)
5. do more stuff in virtual folder

crash shortly after

[1] bugs closed fixed in 10 day period up to 2009-10-29
https://bugzilla.mozilla.org/buglist.cgi?bug_severity=blocker;bug_severity=critical;bug_severity=major;bug_severity=normal;resolution=FIXED;chfieldto=2009-10-29;query_format=advanced;chfield=resolution;chfieldfrom=2009-10-19;chfieldvalue=fixed;component=Backend;product=MailNews%20Core;product=Thunderbird;product=Toolkit

Comment 1

[timeless]

Signature	nsMsgXFViewThread::AddHdr(nsIMsgDBHdr*, int, unsigned int&, nsIMsgDBHdr**)
UUID	a030d11c-b116-46be-b5ef-dda292100114
Time 	2010-01-14 13:15:18.966082
Uptime	374
Last Crash	1061424 seconds before submission
Product	Thunderbird
Version	3.0.1pre
Build ID	20100108032539
Branch	1.9.1
OS	Windows NT
OS Version	6.0.6002 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
User Comments	deleting stuff in virtual "bugs" folder
Processor Notes 	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	thunderbird.exe 	nsMsgXFViewThread::AddHdr 	mailnews/base/src/nsMsgXFViewThread.cpp:268
1 	thunderbird.exe 	nsMsgSearchDBView::AddHdrFromFolder 	mailnews/base/src/nsMsgSearchDBView.cpp:478
2 	thunderbird.exe 	nsMsgSearchDBView::InsertHdrFromFolder 	mailnews/base/src/nsMsgSearchDBView.cpp:676
3 	thunderbird.exe 	nsMsgXFVirtualFolderDBView::OnSearchHit 	mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:307
4 	thunderbird.exe 	nsMsgXFVirtualFolderDBView::OnNewHeader 	mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:161
5 	thunderbird.exe 	nsMsgDBView::OnHdrAdded 	mailnews/base/src/nsMsgDBView.cpp:5674
6 	thunderbird.exe 	nsMsgDatabase::NotifyHdrAddedAll 	mailnews/db/msgdb/src/nsMsgDatabase.cpp:730
7 	thunderbird.exe 	nsMsgDatabase::AddNewHdrToDB 	mailnews/db/msgdb/src/nsMsgDatabase.cpp:3263
8 	thunderbird.exe 	nsImapMailDatabase::AddNewHdrToDB 	mailnews/db/msgdb/src/nsImapMailDatabase.cpp:154
9 	thunderbird.exe 	nsImapMailFolder::NormalEndHeaderParseStream 	mailnews/imap/src/nsImapMailFolder.cpp:3148
10 	thunderbird.exe 	nsImapMailFolder::ParseMsgHdrs 	mailnews/imap/src/nsImapMailFolder.cpp:2976
11 	xpcom_core.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
12 	xpcom_core.dll 	nsEventQueue::GetEvent 	xpcom/threads/nsEventQueue.cpp:100

this is from bug 379806

Comment 2

[timeless]

Attachment: spackle

preemptive: i do not intend to write testcases for patches i write to comm-central while i am not actively working on mail.

if someone wants to write a testcase, great. if not, there are 70+ crashes on three platforms with this signature, they're your customers.

Comment 3

[David :Bienvenu]

Comment on attachment 421764 [details] [diff] [review]
spackle

yeah, rootHdr could be null in some strange circumstances.

Comment 4

[David :Bienvenu]

we don't have a test case for this (we can't reproduce it) which makes adding a test for it not worthwhile.

Comment 5

[Mark Banner (:standard8)]

Checked in: http://hg.mozilla.org/comm-central/rev/6c17f7e5f259

Comment 6

[Mark Banner (:standard8)]

Checked in: http://hg.mozilla.org/releases/comm-1.9.1/rev/8cb3c3b7dcc6