472019 - crash [@ nsMsgDBFolder::CallFilterPlugins(nsIMsgWindow*, int*)]

Status: RESOLVED FIXED

(MailNews Core :: Filters, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsMsgDBFolder::CallFilterPlugins] both TB2 and trunk - not a topcrash.


bp-fd566e5d-e637-42c0-abd3-a07c92090102
Mac - Pressed "dismiss all" on Lightening (16 events to dismiss, using caldev server)
nsMsgDBFolder::CallFilterPlugins	nsMsgDBFolder.cpp:2033
nsImapMailFolder::HeaderFetchCompleted	nsImapMailFolder.cpp:5154
NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
nsProxyObjectCallInfo::Run	xpcom/proxy/src/nsProxyEvent.cpp:181
nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:510
NS_ProcessNextEvent_P	nsThreadUtils.cpp:227
nsXULWindow::ShowModal	xpfe/appshell/src/nsXULWindow.cpp:397
nsWindowWatcher::OpenWindowJSInternal	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:959
nsWindowWatcher::OpenWindow	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:419
nsPromptService::DoDialog	embedding/components/windowwatcher/src/nsPromptService.cpp:786
nsPromptService::ConfirmEx	embedding/components/windowwatcher/src/nsPromptService.cpp:397
NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2424
XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1477 


TB51089710
W32 - 	reception de mail
nsMsgDBFolder::CallFilterPlugins  [mozilla/mailnews/base/util/nsMsgDBFolder.cpp, line 2038]
nsMsgLocalMailFolder::UpdateFolder  [mozilla/mailnews/local/src/nsLocalMailFolder.cpp, line 684]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1387]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3966]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1406]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1481]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4367]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1500]
nsJSEventListener::HandleEvent  [mozilla/dom/src/events/nsJSEventListener.cpp, line 195]

Comment 1

[Wayne Mery (:wsmwk)]

calendar issue??

still quite rare. eg.
bp-b4664cd4-2e36-442e-bd23-95eee2090305  Syncing via CalDav with Google with LOTS of changes. I imported a US Holidays ICS calendar via the mozilla site and it set a 10 minute reminder on ALL the events it imported. I was going through them to remove the reminders.
bp-058a311f-e576-4349-81db-2eac52090519  lightning: "dismiss all" on 106 reminders for a caldav calendar

talkback is down, so didn't get to recheck TB2 stats

Comment 2

[Wayne Mery (:wsmwk)]

not in Thunderbird 2.0.0.22's top 10 crashes

Comment 3

[Wayne Mery (:wsmwk)]

#37 crasher and rising for Thunderbird v3.0.0.

80% of crashes with comments mention lightning/calendar.
however, not all crashes have calendar extension, eg
 bp-01f82ca2-c7f2-4763-a3e7-cf9312091225
 bp-a365eb43-afda-41a7-aa2d-425732091228

bp-a365eb43-afda-41a7-aa2d-425732091228 is called from pop
0	thunderbird.exe	nsMsgDBFolder::CallFilterPlugins	 mailnews/base/util/nsMsgDBFolder.cpp:2450
1	thunderbird.exe	nsPop3Sink::EndMailDelivery	mailnews/local/src/nsPop3Sink.cpp:425
2	thunderbird.exe	nsPop3Protocol::GetMsg	mailnews/local/src/nsPop3Protocol.cpp:2543
3	thunderbird.exe	nsPop3Protocol::ProcessProtocolState	mailnews/local/src/nsPop3Protocol.cpp:3633
4	thunderbird.exe	nsMsgProtocol::OnDataAvailable	mailnews/base/util/nsMsgProtocol.cpp:359
5	thunderbird.exe	nsInputStreamPump::OnStateTransfer	netwerk/base/src/nsInputStreamPump.cpp:508
6	thunderbird.exe	nsInputStreamPump::OnInputStreamReady	netwerk/base/src/nsInputStreamPump.cpp:398
7	xpcom_core.dll	nsOutputStreamReadyEvent::Run	xpcom/io/nsStreamUtils.cpp:111
8	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:521
9	xpcom_core.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:236 


but some are long loopers
bp-16cc832d-9c35-4c73-bf35-0bc3d2091218 (shutdown hang?)

Comment 4

[Kent James (:rkent)]

This crash is on the last line of the following code:

2436 PRUint32 count, *proIndices, *antiIndices;
2437 rv = traitService->GetEnabledIndices(&count, &proIndices, &antiIndices);
2438 PRBool filterForOther = PR_FALSE;
2439 for (PRUint32 i = 0; i < count; ++i)
2440 {
2441 // The trait service determines which traits are globally enabled or
2442 // disabled. If a trait is enabled, it can still be made inactive
2443 // on a particular folder using an inherited property. To do that,
2444 // set "dobayes." + trait proID as an inherited folder property with
2445 // the string value "false"
2446 //
2447 // If any non-junk traits are active on the folder, then the bayes
2448 // processing will calculate probabilities for all enabled traits.
2449
2450 if (proIndices[i] != nsIJunkMailPlugin::JUNK_TRAIT)

I am guessing that the traitService is failing, and leaving count as a random value, which then crashes the array. So the suggested fix would be to both check for errors, and initialize count to zero.

Comment 5

[Kent James (:rkent)]

Attachment: assume that traitService is failing

Comment 6

[David :Bienvenu]

Comment on attachment 419358 [details] [diff] [review]
assume that traitService is failing

It's unclear to me how the trait service could be failing but the rest of your analysis makes sense.

Comment 7

[Kent James (:rkent)]

Comment on attachment 419358 [details] [diff] [review]
assume that traitService is failing

checked in http://hg.mozilla.org/comm-central/rev/5c49bdbb4922

Comment 8

[Mark Banner (:standard8)]

Not blocking as this isn't in our significant top crasher range. Wanted thought. Will consider approval request later.

Comment 9

[Kent James (:rkent)]

Comment on attachment 419358 [details] [diff] [review]
assume that traitService is failing

Checked in for TB 3.0 as http://hg.mozilla.org/releases/comm-1.9.1/rev/8d91eedf259f

Comment 10

[Wayne Mery (:wsmwk)]

Thanks Kent.

can't verify this is gone - we have no testcase, patch only just landed, and crash frequency is insufficient to say it's gone from trunk or 3.0.1pre (crash rate there is not even 1/month).  So verification can't happen until several days after 3.0.1 ships.

removed [needs 3.0 approval]

Comment 11

[Wayne Mery (:wsmwk)]

calendar tie in to traitService? 
can anyone from calendar offer insight?

Bug 541879 filed for crashes that remain in 3.0.1. calendar related crashes with this sig seem to be gone in 3.0.1 - no comments mention calendar and none that I checked list the extension.  however, I can't explain why the crash rate for this sig is not significantly reduced, given that 80% of 3.0.0 crashes with comments cite calendar activity happening at the time of crash. And of crashes without comments, a high % have lightning installed (per spot check). 3.0.0 examples:
bp-546d2657-71c5-4cb9-9078-5bb212091130
bp-206b1217-a3b2-4026-b170-05d812091212
bp-2a6901b3-4340-455a-9a2a-9ec522091218