857170 - crash in net_pop3_write_mapper

Status: RESOLVED INCOMPLETE

(MailNews Core :: Networking: POP, defect)

Description

[Wayne Mery (:wsmwk)]

This bug was filed from the Socorro interface and is 
report bp-6491d5a1-a1c1-4188-8c99-060582130331 .
============================================================= 
0	xul.dll	net_pop3_write_mapper	mailnews/local/src/nsPop3Protocol.cpp:298
1	plds4.dll	PL_HashTableEnumerateEntries	nsprpub/lib/ds/plhash.c:374
2	xul.dll	net_pop3_write_state	mailnews/local/src/nsPop3Protocol.cpp:355
3	xul.dll	nsPop3Protocol::CommitState	mailnews/local/src/nsPop3Protocol.cpp:3706
4	xul.dll	nsPop3Protocol::ProcessProtocolState	mailnews/local/src/nsPop3Protocol.cpp:4044
5	xul.dll	nsMsgProtocol::OnDataAvailable	mailnews/base/util/nsMsgProtocol.cpp:357
6	xul.dll	nsInputStreamPump::OnStateTransfer	netwerk/base/src/nsInputStreamPump.cpp:490
7	xul.dll	nsInputStreamPump::OnInputStreamReady	netwerk/base/src/nsInputStreamPump.cpp:371 

ehsan@13324 343 uint32_t numBytesWritten;
hg@0 344 fileOutputStream->Write(tmpBuffer, strlen(tmpBuffer), &numBytesWritten);
hg@0 345
hg@0 346 for (; host && (len >= 0); host = host->next)
hg@0 347 {
hg@0 348 if (!hash_empty(host->hash))
hg@0 349 {
hg@0 350 fileOutputStream->Write("*", 1, &numBytesWritten);
hg@0 351 fileOutputStream->Write(host->host, strlen(host->host), &numBytesWritten);
hg@0 352 fileOutputStream->Write(" ", 1, &numBytesWritten);
hg@0 353 fileOutputStream->Write(host->user, strlen(host->user), &numBytesWritten);
hg@0 354 fileOutputStream->Write(MSG_LINEBREAK, MSG_LINEBREAK_LEN, &numBytesWritten);
hg@0 355 PL_HashTableEnumerateEntries(host->hash, net_pop3_write_mapper, (void *)fileOutputStream); 

Is cause related to net_pop3_write_state bp-62dc3dec-aba5-4f65-a244-3cc942130313 ?


Perhaps this is related to bug 536802?

Comment 1

[Wayne Mery (:wsmwk)]

Interesting, that current crashes are not startup.
for example bp-9bfa2256-292b-41b1-ac65-58a442160102 38.5.0
 0 	xul.dll	net_pop3_write_mapper	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/local/src/nsPop3Protocol.cpp:292
1 	nss3.dll	PL_HashTableEnumerateEntries	nsprpub/lib/ds/plhash.c
2 	xul.dll	net_pop3_write_state	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/local/src/nsPop3Protocol.cpp:349
3 	xul.dll	nsPop3Protocol::CommitState(bool)	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/local/src/nsPop3Protocol.cpp:3647
4 	xul.dll	nsPop3Protocol::ProcessProtocolState(nsIURI*, nsIInputStream*, unsigned __int64, unsigned int)	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/local/src/nsPop3Protocol.cpp:3985
5 	xul.dll	nsMsgProtocol::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned __int64, unsigned int)	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/base/util/nsMsgProtocol.cpp:291
6 	xul.dll	nsInputStreamPump::OnStateTransfer()	netwerk/base/nsInputStreamPump.cpp

Comment 2

[Wayne Mery (:wsmwk)]

Anything obvious in these 60.x crashes?
bp-803a0894-0a12-4b9f-be63-a8df60190917
bp-16a3813c-d729-4f97-8734-6cd440190912
bp-4df1ce2b-b30a-4d37-853b-954110190831

Comment 3

[Jorg K (CEST = GMT+2)]

c-esr60 code:

static int
net_pop3_write_mapper(PLHashEntry* he, int msgindex, void* arg)
{
  nsIOutputStream* file = (nsIOutputStream*) arg;
  Pop3UidlEntry *uidlEntry = (Pop3UidlEntry *) he->value;  <== 301
  NS_ASSERTION((uidlEntry->status == KEEP) ||
    (uidlEntry->status == DELETE_CHAR) ||
    (uidlEntry->status == FETCH_BODY) ||
    (uidlEntry->status == TOO_BIG), "invalid status");

So something has gone wrong with the hash table entry. Memory corruption, access after free, anything :-( - Nothing obvious, but thanks for asking, a few crashes are easy to analyse, most are not.

Comment 4

[Wayne Mery (:wsmwk)]

Same low crash rate.
Let's say it's not actionable