629649 - Crash [@ nsSpamSettings::Initialize(nsIMsgIncomingServer*) ] shortly after start of MailNews. startup

Status: RESOLVED WORKSFORME

(MailNews Core :: Filters, defect)

Description

[Wayne Mery (:wsmwk)]

+++ This bug was initially created as a clone of Bug #515159 +++
there's still a signature that continues to a small degree

bp-2ae7f90e-536a-4ec1-84a5-a70ff2110112 line #453
EXCEPTION_ACCESS_VIOLATION_EXEC
0x2b5ce37
0		@0x2b5ce37	
1	thunderbird.exe	nsSpamSettings::Initialize	mailnews/base/src/nsSpamSettings.cpp:453
2	thunderbird.exe	nsMsgIncomingServer::GetSpamSettings	mailnews/base/util/nsMsgIncomingServer.cpp:2072
3	thunderbird.exe	nsMsgIncomingServer::ConfigureTemporaryServerSpamFilters	mailnews/base/util/nsMsgIncomingServer.cpp:1810
4	thunderbird.exe	nsMsgIncomingServer::ConfigureTemporaryFilters	mailnews/base/util/nsMsgIncomingServer.cpp:1767
5	thunderbird.exe	nsImapMailFolder::UpdateFolderWithListener	mailnews/imap/src/nsImapMailFolder.cpp:722
6	thunderbird.exe	nsImapMailFolder::UpdateFolder	mailnews/imap/src/nsImapMailFolder.cpp:683 

bp-3a9ab3a7-caa6-4751-a4d7-2a08d2110118 line #340
bp-cf84a65c-626d-4eb8-b071-afa462101224 line #441

bp-8f7a498e-a8c6-4fe5-b332-f84c32101123 (inahofm)

Comment 1

[Wayne Mery (:wsmwk)]

~1 crash/month for release 5+6+7
v6 bp-4755600d-227b-4969-b13e-5267b2110919

Comment 2

[Wayne Mery (:wsmwk)]

bp-bd03fb7f-4e7b-478c-a9a4-334f12130611
0	xul.dll	nsSpamSettings::Initialize	mailnews/base/src/nsSpamSettings.cpp:400
1	xul.dll	nsMsgIncomingServer::GetSpamSettings	mailnews/base/util/nsMsgIncomingServer.cpp:2095
2	xul.dll	nsMsgIncomingServer::ConfigureTemporaryServerSpamFilters	mailnews/base/util/nsMsgIncomingServer.cpp:1935
3	xul.dll	nsMsgIncomingServer::ConfigureTemporaryFilters	mailnews/base/util/nsMsgIncomingServer.cpp:1783
4	xul.dll	nsImapMailFolder::UpdateFolderWithListener	mailnews/imap/src/nsImapMailFolder.cpp:661 

kent@3509 392 if (accountKey.Equals(deferredToAccountKey) || accountKey.Equals(loopAccountKey))
kent@3509 393 {
kent@3509 394 nsCOMPtr<nsISupportsArray> identities;
kent@3509 395 loopAccount->GetIdentities(getter_AddRefs(identities));
kent@3509 396 if (!identities)
kent@3509 397 continue;
ehsan@13324 398 uint32_t identityCount = 0;
kent@3509 399 identities->Count(&identityCount);
ehsan@13324 400 for (uint32_t j = 0; j < identityCount; ++j)

Comment 3

[:aceman]

That is a strange line to crash.
I think the identity list was reworked away from nsISupportsArray. Is there a crash for this from newer version than TB17?

Comment 4

[Kent James (:rkent)]

Here's one possible crash theory: identityCount is -1 so that j < identityCount (with all being uint32_t) goes through a 2^32 loops.

One easy suggestion would be to change the types to int32_t and see if that helps.

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to :aceman from comment #3)
> Is there a crash for this from newer version than TB17?

None in the past 9 months. but because of the low crash rate (less than 1 crash per version per month) impossible to say whether problem is gone until a month or two after version 24 releases.

Comment 6

[Ludovic Hirlimann [:Usul]]

Removing myslef on all the bugs I'm cced on. Please NI me if you need something on MailNews Core bugs from me.

Comment 7

[Wayne Mery (:wsmwk)]

(In reply to Kent James (:rkent) from comment #4)
> Here's one possible crash theory: identityCount is -1 so that j <
> identityCount (with all being uint32_t) goes through a 2^32 loops.
> 
> One easy suggestion would be to change the types to int32_t and see if that
> helps.

(In reply to :aceman from comment #3)
> That is a strange line to crash.
> I think the identity list was reworked away from nsISupportsArray. Is there
> a crash for this from newer version than TB17?

Yes. It seems to be more common for version 38 than version 45.
Two 45 examples:
bp-20b23088-fb9f-445c-a0b0-1fff92170207
bp-e47b22da-0073-4b58-b31f-a91052170112 (wanadoo.fr user with many crashes)

https://hg.mozilla.org/releases/comm-esr45/file/tip/mailnews/base/src/nsSpamSettings.cpp#l379 is still uint32_t
    for (uint32_t i = 0; i < accountCount; i++)

Comment 8

[:aceman]

I see nothing obvious here. The line you pasted iterates over accounts now, not identities.
Also, the 2 crash logs crash at quite different lines and have a different stack.

Comment 9

[Wayne Mery (:wsmwk)]

Two flavors, both 52.6.0

bp-984457e8-9965-481a-861e-a30550180222 Crash Address	0xfffffffffffe8c85
bp-03ea407c-8e00-4532-925e-380c40180215 Crash Address   0x0

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 11

[Wayne Mery (:wsmwk)]

No crashes in Thunderbird 60, so we can declare this WFM