543838 - crash [@ nsImapMailFolder::SetUrlState(nsIImapProtocol*, nsIMsgMailNewsUrl*, int, unsigned int)]

Status: RESOLVED WORKSFORME

(MailNews Core :: Networking: IMAP, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsImapMailFolder::SetUrlState(nsIImapProtocol*, nsIMsgMailNewsUrl*, int, unsigned int)]

#155 crash for v3.0.1

bp-0a752b3b-049e-4fa8-b6cc-a533f2100128
just running a rule on a folder. at the time of the crash selecting the destination folder (destination for the e-mail that the rule was moving) for viewing.
0		@0x74c085ff	
1	thunderbird.exe	nsImapMailFolder::SetUrlState	mailnews/imap/src/nsImapMailFolder.cpp:6603
2	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101

Comment 1

[Ludovic Hirlimann [:Usul]]

Frames on 3.1b1pre look like :
0  	 	@0xe8ffffff  	
1 	thunderbird.exe 	nsImapMailFolder::SetUrlState 	mailnews/imap/src/nsImapMailFolder.cpp:6579
2 	xpcom_core.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
3 	xpcom_core.dll 	nsProxyObjectCallInfo::Run 	xpcom/proxy/src/nsProxyEvent.cpp:181
4 	xpcom_core.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
5 	xpcom_core.dll 	NS_ProcessNextEvent_P 	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:250
6 	thunderbird.exe 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
7 	thunderbird.exe 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:182
8 	thunderbird.exe 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3506
9 	thunderbird.exe 	NS_internal_main 	mail/app/nsMailApp.cpp:103
10 	thunderbird.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
11 	thunderbird.exe 	__tmainCRTStartup 	objdir-tb/mozilla/memory/jemalloc/crtsrc/crtexe.c:591
12 	kernel32.dll 	BaseProcessStart

Comment 2

[Ludovic Hirlimann [:Usul]]

This is not security sensitive but turning it it into to one for mozillamessaging's firedrill test exercise - sorry for the spam.

Comment 3

[David :Bienvenu]

My first thought is that aUrl has been deleted during the call to this function. It doesn't hold a reference to aUrl, but from what I can tell, all the callers hold a comptr to the url object for the lifetime of this call (though it is cross-thread, for fun, but a synchronous xp idl call)

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to comment #3)
> My first thought is that aUrl has been deleted during the call to this
> function. It doesn't hold a reference to aUrl, but from what I can tell, all
> the callers hold a comptr to the url object for the lifetime of this call
> (though it is cross-thread, for fun, but a synchronous xp idl call)

#135 for v3.1.6, not in top 300 for v3.1.4. but not sure that's a big change

Comment 5

[Wayne Mery (:wsmwk)]

filters is mentioned in almost all the crash comments


nsImapMailFolder::SetUrlState(nsIImapProtocol*, nsIMsgMailNewsUrl*, int, unsigned int)  signature ends after version 5

starting in version 6 we have
 nsImapMailFolder::SetUrlState(nsIImapProtocol*, nsIMsgMailNewsUrl*, int, int, unsigned int) and and
 @0x0 | nsImapMailFolder::SetUrlState(nsIImapProtocol*, nsIMsgMailNewsUrl*, int, int, unsigned int)


@0x0 | nsI ...
bp-4a76dadc-c593-47f6-80e6-9c27e2111011
EXCEPTION_ACCESS_VIOLATION_EXEC
0x0
0		@0x0	
1	xul.dll	nsImapMailFolder::SetUrlState	mailnews/imap/src/nsImapMailFolder.cpp:6820
2	xul.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
3	xul.dll	nsProxyObjectCallInfo::Run	xpcom/proxy/src/nsProxyEvent.cpp:182



nsImapMailFolder::SetUr ...
bp-0417fbe3-1afd-4a26-868f-b964d2111012

Comment 6

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #5)
> filters is mentioned in almost all the crash comments
> 
> 
> nsImapMailFolder::SetUrlState(nsIImapProtocol*, nsIMsgMailNewsUrl*, int,
> unsigned int)  signature ends after version 5
> 
> starting in version 6 we have
>  nsImapMailFolder::SetUrlState(nsIImapProtocol*, nsIMsgMailNewsUrl*, int,
> int, unsigned int) and 
but mostly one after v7. a rare v9 crash bp-ea090568-0ed3-468e-a54c-f85062121213

declaring this WFM.

Note bug 723888 of similar signature is fixed in TB17