612859 - crash [@ ldap_abandon_ext]

Status: RESOLVED WORKSFORME

(Directory :: LDAP C SDK, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ ldap_abandon_ext]
~#220 crash

Todd is going to try to get an ldap log

bp-9e40f408-f64a-4af4-b1f1-7f7832101027 (Todd)
EXCEPTION_ACCESS_VIOLATION_READ
0xc1
0	NSLDAP32V60.dll	ldap_abandon_ext	abandon.c:5.4:103
1	thunderbird.exe	nsLDAPOperation::SimpleBind	directory/xpcom/base/src/nsLDAPOperation.cpp:353
2	thunderbird.exe	nsAbLDAPListenerBase::OnLDAPInit	mailnews/addrbook/src/nsAbLDAPListenerBase.cpp:323
3	thunderbird.exe	nsLDAPAutoCompleteSession::OnLDAPInit	mailnews/addrbook/src/nsLDAPAutoCompleteSession.cpp:444
4	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102

Comment 1

[timeless]

99         if ( !NSLDAPI_VALID_LDAP_POINTER( ld )) {
100                 return( LDAP_PARAM_ERROR );
101         }
102 
103         LDAP_MUTEX_LOCK( ld, LDAP_CONN_LOCK );

I haven't done the math, line 99 seems to handle the ld==0 case.

451 #define LDAP_MUTEX_LOCK(ld, lock) \
452     if ((ld)->ld_mutex_lock_fn != NULL && ld->ld_mutex != NULL) { \
453         if ((ld)->ld_threadid_fn != NULL) { \
454             if ((ld)->ld_mutex_threadid[lock] == (ld)->ld_threadid_fn()) { \
455                 (ld)->ld_mutex_refcnt[lock]++; \
456             } else { \
457                 (ld)->ld_mutex_lock_fn(ld->ld_mutex[lock]); \
458                 (ld)->ld_mutex_threadid[lock] = ld->ld_threadid_fn(); \
459                 (ld)->ld_mutex_refcnt[lock] = 1; \
460             } \
461         } else { \
462             (ld)->ld_mutex_lock_fn(ld->ld_mutex[lock]); \
463         } \
464     } 

669 void
670 nsldapi_mutex_alloc_all( LDAP *ld )
671 {
672         int     i;
673 
674         if ( ld != &nsldapi_ld_defaults && ld->ld_mutex != NULL ) {
675                 for ( i = 0; i<LDAP_MAX_LOCK; i++ ) {
676                         ld->ld_mutex[i] = LDAP_MUTEX_ALLOC( ld );

this doesn't handle failure

633             ((ld->ld_mutex = (void **) NSLDAPI_CALLOC( LDAP_MAX_LOCK, sizeof(void *))) == NULL )) {

is where ld_mutex is allocated and it looks like it does the right thing tm.

Comment 2

[Wayne Mery (:wsmwk)]

like Bug 557932, 80-90% of crashes cite calendar or have the addon installed

Comment 3

[Todd Farmer]

Now able to reproduce with apparent regularity.  The issue seems triggered by entering the first three characters of an email address, which is stored in my local address book.  The auto-complete suggests that email address, and within a second, crashes.  The ldap.log file contains the following:


8076[3fff9c0]: nsLDAPConnection::Run() entered
0[182f140]: nsLDAPOperation::SimpleBind(): called; bindName = '';

Comment 4

[Wayne Mery (:wsmwk)]

Todd, do you still crash?

All crashes are version 3.1.x,  no crashes starting in version 5.
So this signature is gone, but perhaps the signature has morphed.
If indeed fixed in v5, perhaps the fix happened in one of these:
https://bugzilla.mozilla.org/buglist.cgi?type1-0-0=substring;order=Last%20Changed;list_id=2792978;field0-0-0=short_desc;type0-0-1=substring;field0-0-1=component;type1-0-1=allwordssubstr;resolution=FIXED;classification=Client%20Software;classification=Components;chfieldto=2011-06-01;query_format=advanced;chfield=resolution;chfieldfrom=2010-11-01;chfieldvalue=fixed;value0-0-1=ldap;type0-0-0=anywordssubstr;value0-0-0=ldap;field1-0-0=short_desc;product=Directory;product=MailNews%20Core;product=Thunderbird;field1-0-1=short_desc

Comment 5

[Todd Farmer]

I no longer observe crashes (currently using 7.0.1, and also completely reinstalled on OS refresh).  Thanks!

Comment 6

[Wayne Mery (:wsmwk)]

All of this signature are still 3.0x
So let's assume this is gone