554605 - crash [@ morkRow::AcquireRowObject(morkEnv*, morkStore*)]

Status: RESOLVED FIXED

(MailNews Core :: Database, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ morkRow::AcquireRowObject(morkEnv*, morkStore*)]
low rate crash.

but, crash is interesting because it's on all branches, and all OS.

bp-9f186786-8c82-4eeb-879d-4a1562100225 3.2a1pre Mac (larry)
0	thunderbird-bin	morkRow::AcquireRowObject	 db/mork/src/morkRow.cpp:276
1	thunderbird-bin	morkRow::AcquireRowHandle	db/mork/src/morkRow.cpp:284
2	thunderbird-bin	morkStore::GetRow	db/mork/src/morkStore.cpp:1762
3	thunderbird-bin	nsMsgDatabase::GetMsgHdrForKey	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1690
4	thunderbird-bin	nsImapMailFolder::SyncFlags	mailnews/imap/src/nsImapMailFolder.cpp:4679
5	thunderbird-bin	nsImapMailFolder::UpdateImapMailboxInfo	mailnews/imap/src/nsImapMailFolder.cpp:2833
6	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
7	libxpcom_core.dylib	nsProxyObjectCallInfo::Run	xpcom/proxy/src/nsProxyEvent.cpp:181 

bp-46ca1955-3c6d-4361-80d4-e53e72100302 3.0.2 windows no extensions
bp-3f7910b5-5878-43d7-aa35-ec1202100321 3.0.3 Mac (kali)
0	thunderbird-bin	morkRow::AcquireRowObject	 db/mork/src/morkRow.cpp:276
1	thunderbird-bin	morkRow::AcquireRowHandle	db/mork/src/morkRow.cpp:284
2	thunderbird-bin	morkStore::GetRow	db/mork/src/morkStore.cpp:1762
3	thunderbird-bin	nsMsgDatabase::GetMsgHdrForKey	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1690
4	thunderbird-bin	nsMsgDBFolder::GetMessageHeader	mailnews/base/util/nsMsgDBFolder.cpp:5020
5	thunderbird-bin	nsImapMailFolder::ParseAdoptedMsgLine	mailnews/imap/src/nsImapMailFolder.cpp:4451
6	libxpcom_core.so	NS_GetXPTCallStub_P	
7	libxpcom_core.so	nsProxyObjectCallInfo::Run	xpcom/proxy/src/nsProxyEvent.cpp:181

Comment 1

[timeless]

boy, this took more chasing than necessary. sorry, yes, i believe it's an OOM.

Crash Address	0x20

264 morkRow::AcquireRowObject(morkEnv* ev, morkStore* ioStore)
266   morkRowObject* ro = mRow_Object;
http://mxr.mozilla.org/comm-central/ident?i=morkRowObject
    * line 54, inheriting
          o class morkObject,
    -- class morkObject  : public morkBead, public nsIMdbObject  {  
    -- class morkBead  : public morkNode  {  
http://mxr.mozilla.org/comm-central/ident?i=morkNode::CPP_THROW_NEW

271     nsIMdbHeap* heap = ioStore->mPort_Heap;
272     ro = new(*heap, ev)
So, this gives us a null pointer

275     morkRowObject::SlotWeakRowObject(ro, ev, &mRow_Object);

alias me = ro:
  221   static void SlotWeakRowObject(morkRowObject* me,
  222     morkEnv* ev, morkRowObject** ioSlot)
  223   { morkNode::SlotWeakNode((morkNode*) me, ev, (morkNode**) ioSlot); }

pass me = me:
  489 morkNode::SlotWeakNode(morkNode* me, morkEnv* ev, morkNode** ioSlot)
  496   morkNode* node = *ioSlot;
  497   if ( me != node )

Since me is false, this is the only interesting block, and it does nothing:
  504     if ( me && me->AddWeakRef(ev) )
  505       *ioSlot = me;

and we crash here:
276     ro->AddRef();

I'm having a bit of trouble w/ 0x20 instead of some slightly smaller number, but that might have something to do with the vtable structure. and i'm not going to fret about it.

Comment 2

[timeless]

Attachment: patch

Comment 3

[David :Bienvenu]

Comment on attachment 434532 [details] [diff] [review]
patch

r/sr=me - the spaces around !ro unfortunately seems to be the prevailing style. Thx for digging into this.

Comment 4

[Marco Bonardo [:mak]]

http://hg.mozilla.org/mozilla-central/rev/23adff59407e

Comment 5

[Larry Ploetz]

So, it looks like this has been fixed. I don't think I can recreate the conditions to test the fix, especially if it was really out of memory. If there's anything I can do, let me know. Thanks.

- Larry