641137 - crash [@ @ nsMsgDBView::GetInsertIndexHelper(nsIMsgDBHdr*, nsTArray<unsigned int, nsTArrayDefaultAllocator>&, nsCOMArray<nsIMsgFolder>*, int, int)] | nsMsgQuickSearchDBView::SortThreads (trunk sig)

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsMsgDBView::GetInsertIndexHelper(nsIMsgDBHdr*, nsTArray<unsigned int, nsTArrayDefaultAllocator>&, nsCOMArray<nsIMsgFolder>*, int, int)]

I crashed after clicking on a message. nothing unusual.
bp-a5553b7d-47e5-42ff-874e-5dd3e2110311
EXCEPTION_ACCESS_VIOLATION_READ
0x0
0	xul.dll	nsMsgDBView::GetInsertIndexHelper	mailnews/base/src/nsMsgDBView.cpp:5171
1	xul.dll	nsMsgQuickSearchDBView::SortThreads	mailnews/base/src/nsMsgQuickSearchDBView.cpp:547
2	xul.dll	nsMsgThreadedDBView::Sort	mailnews/base/src/nsMsgThreadedDBView.cpp:361
3	xul.dll	nsMsgQuickSearchDBView::OnSearchDone	mailnews/base/src/nsMsgQuickSearchDBView.cpp:392
4	xul.dll	nsMsgSearchSession::NotifyListenersDone	mailnews/base/search/src/nsMsgSearchSession.cpp:620
5	xul.dll	nsMsgSearchSession::TimerCallback	mailnews/base/search/src/nsMsgSearchSession.cpp:556 


everything on crash-stats with this signature are trunk crashes. the first crash (going back 5 months) is buildid 20110114140250 bp-6daf9d82-ca54-4b6e-afb5-cd1af2110302 (user=vpavlushkov).  However, there is a branch windows+mac crash nsMsgDBView::GetInsertIndexHelper(nsIMsgDBHdr*, nsTArray<unsigned int>&, nsCOMArray<nsIMsgFolder>*, int, int) as in bp-3ecf2d8d-3800-419c-8423-8da372110311. linux version of the crash is nsMsgDBView::GetInsertIndexHelper as in bp-133849b3-b314-422d-92ab-792e82110222


pitpaw also crashes frequently:
bp-af469207-a601-49b6-afaf-faab92110126 enabled threaded view on a virtual folder
bp-5e947b96-40f4-493e-b97d-58e5e2110126 doing a search in the quick-search box on the inbox


xref Bug 478822 - crash quicksearch subject in threaded view (single folder) [@ nsMsgDBView::GetInsertIndexHelper]

Comment 1

[timeless]

nsMsgQuickSearchDBView::SortThreads   

543 // it would be nice if GetInsertIndexHelper always found the hdr, but it doesn't.
544 threadHdr->GetChildHdrAt(0, getter_AddRefs(rootHdr));
545 threadRootIndex = GetInsertIndexHelper(rootHdr, threadRootIds, nsnull, 

rootHdr is null

Comment 2

[timeless]

Attachment: patch

Comment 3

[Wayne Mery (:wsmwk)]

crashed again. bp-794a7299-981d-4162-8384-250cb2110313

I had a filter in the display for "bug". I then  unselected some criteria (sender and recipient). crash

Comment 4

[David :Bienvenu]

Comment on attachment 518971 [details] [diff] [review]
patch

thx for the patch.

Comment 5

[Mark Banner (:standard8)]

Checked in: http://hg.mozilla.org/comm-central/rev/1643c35cb4de

Comment 6

[Wayne Mery (:wsmwk)]

v.fixed.  I reliably crashed by entering  [@  to filter my inbox. no crash with Mozilla/5.0 (Windows NT 6.0; rv:2.0b13pre) Gecko/20110321 Thunderbird/3.3a4pre


linux crash sig nsMsgDBView::GetInsertIndexHelper per bp-133849b3-b314-422d-92ab-792e82110222 but I'm unsure it's the same crash

Comment 7

[Wayne Mery (:wsmwk)]

Comment on attachment 518971 [details] [diff] [review]
patch

~#120 crash and patch is simple, so would be nice to have on branch if bienvenu agrees.

Comment 8

[Mark Banner (:standard8)]

Checked in for 3.1.10: http://hg.mozilla.org/releases/comm-1.9.2/rev/8833297ec58d