625506 - crash [@ nsImapCacheStreamListener::OnStartRequest] (Mac&linux), [@ nsImapCacheStreamListener::OnStartRequest(nsIRequest*, nsISupports*)] (windows)

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[Wayne Mery (:wsmwk)]

~#10 crash in 3.3a2pre
trunk regression 

crash [@ nsImapCacheStreamListener::OnStartRequest] (Mac&linux), [@ nsImapCacheStreamListener::OnStartRequest(nsIRequest*, nsISupports*)] (windows)

first appearance 
20101229 nsImapCacheStreamListener::OnStartRequest(nsIRequest*, nsISupports*) [1]
20101220 nsImapCacheStreamListener::OnStartRequest  [2]

[1] bp-b29d375f-011b-4c6f-8998-5a8592101230
EXCEPTION_ACCESS_VIOLATION_READ
0x0
0	xul.dll	nsImapCacheStreamListener::OnStartRequest	mailnews/imap/src/nsImapProtocol.cpp:8633
1	xul.dll	nsInputStreamPump::OnStateStart	netwerk/base/src/nsInputStreamPump.cpp:441
2	xul.dll	nsInputStreamPump::OnInputStreamReady	netwerk/base/src/nsInputStreamPump.cpp:397
3	xul.dll	nsOutputStreamReadyEvent::Run	xpcom/io/nsStreamUtils.cpp:112
4	xul.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:626
5	xul.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:250
6	xul.dll	nsBaseAppShell::Run	widget/src/xpwidgets/nsBaseAppShell.cpp:195 


[2] bp-b4418365-8187-4aed-9c1e-255762101220
SIGSEGV
0x0
0	libxul.so	nsImapCacheStreamListener::OnStartRequest	mailnews/imap/src/nsImapProtocol.cpp:8633
1	libxul.so	nsInputStreamPump::OnStateStart	netwerk/base/src/nsInputStreamPump.cpp:441
2	libxul.so	nsInputStreamPump::OnInputStreamReady	netwerk/base/src/nsInputStreamPump.cpp:397
3		@0x0	
4	libxul.so	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:626
5	libxul.so	NS_ProcessNextEvent_P	nsThreadUtils.cpp:250
6	libxul.so	nsBaseAppShell::Run	widget/src/xpwidgets/nsBaseAppShell.cpp:195

Comment 1

[Wayne Mery (:wsmwk)]

correction

first appearance looks to be 20101215 nsImapCacheStreamListener::OnStartRequest(nsIRequest*, nsISupports*)
[1] bp-7ed85689-4e38-4683-987c-a2e2a2101214 12-14-2010

which puts it closer to the likes of bug 609683

http://hg.mozilla.org/comm-central/pushloghtml?startdate=2010-12-08&enddate=2010-12-14+03%3A00%3A00

Comment 2

[IU]

Attachment: Stack trace: crash on toggle IMAP mail read/unread status

A difficult to reproduce crash, but generally happens if Shredder has been running for a while, I then get a new message and click on the read column dot to toggle the message to read.

The crash for the attached stack trace happened on toggling a message from read to unread; however, this was after many failed attempts to get a crash.

My crash from a previous day: http://crash-stats.mozilla.com/report/index/bp-c1d6d07a-c257-442e-8099-7a6952110112

Comment 3

[David :Bienvenu]

the cache listener is always initialized with "this" as the m_channelToUse, e.g.,

    nsImapCacheStreamListener * cacheListener = new nsImapCacheStreamListener();
    NS_ADDREF(cacheListener);
    cacheListener->Init(m_channelListener, this);

which means we must be getting an OnStartRequest after an OnStopRequest, so conceivably, a null check for mChannelToUse in OnStartRequest might be sufficient.

Comment 4

[David :Bienvenu]

Attachment: don't crash, assert

Comment 5

[David :Bienvenu]

probably want this for 3.3a2, if possible.

Comment 6

[David :Bienvenu]

fixed on trunk - http://hg.mozilla.org/comm-central/rev/c903a7fb5e32