664790 - crash [@ nsImapFlagAndUidState::ExpungeByIndex ]

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsImapFlagAndUidState::ExpungeByIndex ]

all versions, including 5.0b1
bp-b9a5703a-0f88-44cf-8b09-9e6b22110612
EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
0x1e124f2
0	XUL	nsImapFlagAndUidState::ExpungeByIndex	mailnews/imap/src/nsImapFlagAndUidState.cpp:182
1	XUL	nsImapServerResponseParser::numeric_mailbox_data	mailnews/imap/src/nsImapServerResponseParser.cpp:1044
2	XUL	nsImapServerResponseParser::response_data	mailnews/imap/src/nsImapServerResponseParser.cpp:761
3	XUL	nsImapServerResponseParser::ParseIMAPServerResponse	mailnews/imap/src/nsImapServerResponseParser.cpp:247
4	XUL	nsImapProtocol::Expunge	mailnews/imap/src/nsImapProtocol.cpp:5333
5	XUL	nsImapProtocol::ProcessSelectedStateURL	mailnews/imap/src/nsImapProtocol.cpp:2689
6	XUL	nsImapProtocol::ProcessCurrentURL	mailnews/imap/src/nsImapProtocol.cpp:1749
7	XUL	nsImapProtocol::ImapThreadMainLoop	mailnews/imap/src/nsImapProtocol.cpp:1388 

last patch in this area done by bienvenu in Bug 537551 - "ASSERTION: invalid array index" triggered by nsImapFlagAndUidState::GetMessageFlagsFromUID

Comment 1

[Wayne Mery (:wsmwk)]

bienvenu, version 5 crash rate is much higher. Might this crash also be associated with compact?  bp-b9a5703a-0f88-44cf-8b09-9e6b22110612 comment "Despite the update to version 5, Thunderbird continues to crash whenever I try to compact all of my IMAP mailboxes at once. Can't this be fixed?"


windows signature - memmove | nsTArray_base<nsTArrayDefaultAllocator>::ShiftData(unsigned int, unsigned int, unsigned int, unsigned int) | nsImapFlagAndUidState::ExpungeByIndex(unsigned int)
example: bp-df4b20b2-66bb-4de3-a764-2c6322110807

Comment 2

[David :Bienvenu]

This is an online compact, a compact of the imap mailbox on the server, not a compact of the offline store, so it's not related to the other compact issues. But it looks like the server is giving us an invalid expunge index, so a bullet-proofing fix should be easy. I'll code one up and try to generate a try server build.

Comment 3

[Wayne Mery (:wsmwk)]

(In reply to David :Bienvenu from comment #2)
> This is an online compact, a compact of the imap mailbox on the server, not
> a compact of the offline store, so it's not related to the other compact
> issues. 

indeed. But I asked the question, because the crash rate seems to have increased with version 5, *and* it is also happening in version 6 - eg bp-7ef1914d-9b93-480d-80cf-22ead2110807

still impossible say how many users / hard to say how many crashes per user - https://crash-stats.mozilla.com/report/list?product=Thunderbird&query_search=signature&query_type=exact&query=nsImapFlagAndUidState%3A%3AExpungeByIndex&reason_type=contains&date=08%2F08%2F2011%2009%3A54%3A36&range_value=16&range_unit=weeks&hang_type=any&process_type=any&do_query=1&admin=1&signature=nsImapFlagAndUidState%3A%3AExpungeByIndex

Comment 4

[David :Bienvenu]

Attachment: proposed fix

expunge indexes are 1 relative, so we need to check for a 0 index.

Comment 5

[David :Bienvenu]

fixed on trunk

Comment 6

[David :Bienvenu]

Comment on attachment 551490 [details] [diff] [review]
proposed fix

simple bulletproofing check - don't know if this is what's actually happening, but we should protect ourselves from a server doing this.

Comment 7

[David :Bienvenu]

laned on aurora - http://hg.mozilla.org/releases/comm-aurora/rev/52f5f813485a