628647 - crash [@ nsImapMailFolder::AddMoveResultPseudoKey(unsigned int)], [@ nsImapMailFolder::AddMoveResultPseudoKey] (Mac)

Status: VERIFIED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsImapMailFolder::AddMoveResultPseudoKey(unsigned int)], [@ nsImapMailFolder::AddMoveResultPseudoKey] (Mac)

trunk regression. and currently the #1 crash for trunk, but doesn't look like an epidemic.

first crash 20110120 bp-f6878ebe-20de-48f4-bc3b-dfc3c2110121 (ilatypov)
more recent 20110124 bp-68e8bf47-b514-4f82-be3e-a91542110124 (nickp)
EXCEPTION_ACCESS_VIOLATION_READ
0x0
0	xul.dll	nsImapMailFolder::AddMoveResultPseudoKey	mailnews/imap/src/nsImapMailFolder.cpp:3916
1	xul.dll	nsImapOfflineSync::ProcessNextOperation	mailnews/imap/src/nsImapOfflineSync.cpp:848
2	xul.dll	nsImapMailFolder::UpdateFolderWithListener	mailnews/imap/src/nsImapMailFolder.cpp:853
3	xul.dll	nsAutoSyncState::OnStopRunningUrl	mailnews/imap/src/nsAutoSyncState.cpp:489
4	xul.dll	nsMsgMailNewsUrl::SetUrlState	mailnews/base/util/nsMsgMailNewsUrl.cpp:136
5	xul.dll	nsImapMailFolder::SetUrlState	mailnews/imap/src/nsImapMailFolder.cpp:6782 

bp-6b51ce0d-de8d-4811-96d6-ed2fe2110124 Mac (burleigh)

Comment 1

[timeless]

3911 NS_IMETHODIMP nsImapMailFolder::AddMoveResultPseudoKey(nsMsgKey aMsgKey)
3914 mDatabase->GetMsgHdrForKey(aMsgKey, getter_AddRefs(pseudoHdr));

no check for failure/null of pseudoHdr

crash:
3916 pseudoHdr->GetMessageId(getter_Copies(messageId));

Comment 2

[Bob Clary [:bc] (inactive)]

bp-7073fdb6-a930-4ec8-a843-ceaf92110126
bp-531658d6-5d26-48bb-bb79-c5ba82110126

steps to reproduce:

1. go offline
2. click offline icon in left of status bar.
3. crash.

Comment 3

[David :Bienvenu]

Attachment: check for error getting msg hdr

Comment 4

[[e-mail]]

Comment on attachment 507511 [details] [diff] [review]
check for error getting msg hdr

Sadly the other call sites aren't consistent as to what to check.

Comment 5

[David :Bienvenu]

fixed on trunk.

Comment 6

[Bob Clary [:bc] (inactive)]

verified. thanks.

Comment 7

[David :Bienvenu]

I actually just pushed the fix right now - previous push failed and I didn't notice until a few minutes later. Which just means this bug isn't trivial to reproduce and we'll need to watch trunk crash-status.

http://hg.mozilla.org/comm-central/rev/be2443b832b0

Comment 8

[Bob Clary [:bc] (inactive)]

hmm. I was able to easily reproduce twice in a row the first day. I just tried several times and was not able to reproduce with today's build either.

Comment 9

[David :Bienvenu]

I was not able to reproduce it with your steps; I believe you'd have to have offline operations for messages that were deleted somehow.