Wayne Mery (:wsmwk) Reporter
	Description • 14 years ago

crash [@ strlen | nsACString_internal::Assign(char const*, unsigned int)] - [@ nsImapProtocol::CreatePossibleTrashName]

est. top 200 crash

bp-734591d9-13b0-4814-a4de-e99bf2100318
I was attempting to download Ad-Aware from their web site, but before this could be completed I received the error message, "connection error - check your settings." this has now happened at least 3 times with this particular program

0	mozcrt19.dll	strlen	 strlen.asm:81
1	xpcom_core.dll	nsACString_internal::Assign	xpcom/string/src/nsTSubstring.cpp:351
2	thunderbird.exe	nsCString::nsCString	objdir-tb/mozilla/dist/include/string/nsTString.h:80
3	thunderbird.exe	nsImapProtocol::CreatePossibleTrashName	mailnews/imap/src/nsImapProtocol.cpp:7341
4	thunderbird.exe	nsImapProtocol::MailboxDiscoveryFinished	mailnews/imap/src/nsImapProtocol.cpp:7198
5	thunderbird.exe	nsImapProtocol::DiscoverMailboxList	mailnews/imap/src/nsImapProtocol.cpp:7120
6	thunderbird.exe	nsImapProtocol::FindMailboxesIfNecessary	mailnews/imap/src/nsImapProtocol.cpp:6865

	Wayne Mery (:wsmwk) Reporter
	Comment 1 • 14 years ago

bienvenu, does this need a protocol log?

	timeless
	Comment 2 • 14 years ago

working backwards.

341 nsTSubstring_CharT::Assign( const char_type* data, size_type length )
342 {
343 // unfortunately, some callers pass null :-(
344 if (!data)
..
347 return;

ok, data is not 0x0

350 if (length == size_type(-1))
351 length = char_traits::length(data); 

this is probably just an alias to strlen. And we're passing it something very much like 0x10 (which means we have something very much like 0x10...).

77       nsTString_CharT( const char_type* data, size_type length = size_type(-1) )
78         : substring_type()
79         {
80           Assign(data, length);

data is probably 0x10, length is size_type(-1)

7339 char * nsImapProtocol::CreatePossibleTrashName(const char *prefix)
7340 {
7341 nsCString returnTrash(prefix); 

data came from prefix.

7194 // There is no Trash folder (either LIST'd or LSUB'd), and we're using the
7195 // Delete-is-move-to-Trash model, and there is a personal namespace
7196 if (!trashFolderExists && GetDeleteIsMoveToTrash() && ns)

ns is not null

7197 {
7198 char *trashName = CreatePossibleTrashName(ns->GetPrefix()); 

I believe that ns->GetPrefix() is 0x10

I can't quite figure out how to end up w/ 0x10 as a pointer, i will note that most of the m_prefix handling checks both m_prefix and *m_prefix against 0, effectively this code does not.

It's possible that a .dmp will tell us what we need to know (the incident you found doesn't have one).

	David :Bienvenu
	Comment 3 • 14 years ago

yes, an IMAP protocol log would be helpful - https://wiki.mozilla.org/MailNews:Logging

	Wayne Mery (:wsmwk) Reporter
	Comment 4 • 14 years ago

bienvenu, I don't have an imap log yet. not many people reporting crashes with email addresses. however, maybe this one will come through
bp-3d9e88dd-ae4e-400a-be49-95fdc2100905 (janet)
bp-6bd86845-fbac-4f96-ad12-8129d2100824   ""

#78 crash for v3.1.2.  so anticipate this will be in top 60 for v3.1.3 when html5 and some other crashes  are gone.  (in a sampling of 4 days, 100% of strlen | nsACString_internal::Assign(char const*, unsigned int) crashes contain nsImapProtocol::CreatePossibleTrashName )

Most of the crashes I've looked at are not new installs. (is that odd?)

other reporters:
bp-def1ce74-a43f-4ba3-99d4-fead82100830 (fabian)
bp-ef5efe69-c1fa-41cf-bdcd-9aba42100906 (sprague)
bp-cdeb046b-1a0d-4514-a97c-0336c2100904 (u.a.)
bp-9ec90afd-d602-4b5f-8a28-c1d652100903 (icare)

	Wayne Mery (:wsmwk) Reporter
	Comment 5 • 13 years ago

#88 crash for v6 but I didn't check enough to determine if there are v6 crashes with TrashName in the stack (2 of 3 were v5), so topcrash-

bp-c6cff66d-4373-4df2-9f70-c704b2110810 v5
bp-82c14109-6bd7-4a79-bd06-0a6bc2110823 v5

	Wayne Mery (:wsmwk) Reporter
	Comment 6 • 13 years ago

(In reply to Wayne Mery (:wsmwk) from comment #5)
> I didn't check ... to determine if there are v6 crashes with TrashName in the stack 

the answer is yes. and the crash continues in version 8

not mentioned earlier, this bug is a continuation of bug 548474 RESOLVED WORKSFORME crash [@ strlen | nsImapProtocol::CreatePossibleTrashName(char const*) ]

	Wayne Mery (:wsmwk) Reporter
	Comment 7 • 12 years ago

bp-2142e7a3-c2cc-4411-a869-c7d232120331 version 10

	Scoobidiver (away)
	Comment 8 • 11 years ago

The topcrash- keyword is not actively maintained and pollutes queries with topcrash.

	Wayne Mery (:wsmwk) Reporter
	Comment 9 • 10 years ago

current signature is perhaps 
- windows zzz_AsmCodeRange_Begin | nsACString_internal::Assign(char const*, unsigned int, mozilla::fallible_t const&) | nsACString_internal::Assign(char const*, unsigned int) | nsImapProtocol::CreatePossibleTrashName(char const*) 
bp-06734c54-f436-4dd0-8e77-6c6df2140704
- linux  nsACString_internal::Assign | nsACString_internal::Assign | nsImapProtocol::CreatePossibleTrashName 
bp-2e39fa94-a62a-49f3-ad55-1360e2140725

	Liu Xing
	Comment 10 • 10 years ago

https://crash-stats.mozilla.com/report/index/4fbcae57-bef3-4db0-9046-91fc92140903

	Ludovic Hirlimann [:Usul]
	Comment 11 • 9 years ago

Removing myslef on all the bugs I'm cced on. Please NI me if you need something on MailNews Core bugs from me.

	Liu Xing
	Comment 12 • 8 years ago

https://crash-stats.mozilla.com/report/index/5d660f85-40dd-46fc-aacd-4589e2160124

	Liu Xing
	Comment 13 • 8 years ago

https://crash-stats.mozilla.com/report/index/d028f74a-070e-4083-9aff-9cc872161026