1175190 - Thunderbird 38 crashes in mozilla::mailnews::EncodedHeader [msvcr120.dll | nsCOMArray_base::Adopt | mozilla::mailnews::EncodedHeader]

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

most, but not all, crashes are startup. Because they are startup crashes, many crashes are labeled DUP. Perhaps as high as 75%

no stacks sampled match stacks for Fireefox msvcr120 bug reports http://mzl.la/1MIwjdm
A high percentage have Calendar installed - but I'm not saying calendar is involved.


#6 crash msvcr120.dll@0xf608 | nsTArray_Impl<T>::AppendElements<T>(mozilla::net::PNeckoChild* const*, unsigned int)
1/4 of sample has calendar installed.
bp-849664bd-5f48-4f7e-9513-b48e72150613
 0 	msvcr120.dll	msvcr120.dll@0xf608
1 	xul.dll	nsTArray_Impl<mozilla::net::PNeckoChild*, nsTArrayInfallibleAllocator>::AppendElements<mozilla::net::PNeckoChild*>(mozilla::net::PNeckoChild* const*, unsigned int)
2 	xul.dll	nsCOMArray_base::Adopt(nsISupports**, unsigned int)
3 	xul.dll	mozilla::mailnews::EncodedHeader(nsACString_internal const&, char const*)
4 	xul.dll	nsMsgDBView::FetchAuthor(nsIMsgDBHdr*, nsAString_internal&)
5 	xul.dll	nsMsgDBView::CellTextForColumn(int, wchar_t const*, nsAString_internal&)
6 	xul.dll	nsMsgGroupView::CellTextForColumn(int, wchar_t const*, nsAString_internal&)
7 	xul.dll	nsMsgDBView::GetCellText(int, nsITreeColumn*, nsAString_internal&)
8 	xul.dll	nsCSSRendering::PaintBorderWithStyleBorder(nsPresContext*, nsRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, nsStyleContext*, mozilla::Sides)
9 	xul.dll	nsCSSRendering::PaintOutline(nsPresContext*, nsRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleContext*)
10 	xul.dll	nsTreeBodyFrame::PaintCell(int, nsTreeColumn*, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&, int&, nsPoint)
11 		@0xebe0ff

no addons bp-0638d29d-bb05-4241-8a93-0fa7f2150614
 0 	msvcr120.dll	msvcr120.dll@0xf608
1 	xul.dll	nsTArray_Impl<mozilla::net::PNeckoChild*, nsTArrayInfallibleAllocator>::AppendElements<mozilla::net::PNeckoChild*>(mozilla::net::PNeckoChild* const*, unsigned int)
2 	xul.dll	nsCOMArray_base::Adopt(nsISupports**, unsigned int)
3 	xul.dll	mozilla::mailnews::EncodedHeader(nsACString_internal const&, char const*)
4 	xul.dll	nsMsgDBView::FetchAuthor(nsIMsgDBHdr*, nsAString_internal&)
5 	xul.dll	nsMsgDBView::CellTextForColumn(int, wchar_t const*, nsAString_internal&)
6 	xul.dll	nsMsgGroupView::CellTextForColumn(int, wchar_t const*, nsAString_internal&)
7 	xul.dll	nsMsgDBView::GetCellText(int, nsITreeColumn*, nsAString_internal&)

#10 crash [@ msvcr120.dll@0xf20c | nsCOMArray_base::Adopt(nsISupports**, unsigned int) ]
bp-84abba11-29bf-4024-9322-8947c2150615
 0 	msvcr120.dll	msvcr120.dll@0xf20c
1 	xul.dll	nsCOMArray_base::Adopt(nsISupports**, unsigned int)
2 	xul.dll	mozilla::mailnews::EncodedHeader(nsACString_internal const&, char const*)
3 	xul.dll	nsMsgDBView::FetchAuthor(nsIMsgDBHdr*, nsAString_internal&)
4 	xul.dll	nsMsgDBView::CellTextForColumn(int, wchar_t const*, nsAString_internal&)
5 	xul.dll	nsMsgGroupView::CellTextForColumn(int, wchar_t const*, nsAString_internal&)
6 	xul.dll	nsMsgDBView::GetCellText(int, nsITreeColumn*, nsAString_internal&)

#46 crash [@ msvcr120.dll@0xf20c | IPC::ParamTraitsMozilla<T>::Write(IPC::Message*, nsresult const&) ]
just one user bp-5ecd6a44-d476-4fe5-8faf-e176a2150614

Comment 1

[Wayne Mery (:wsmwk)]

Is EncodedHeader source of the crash? 

" I was trying to sort my trash emails by sender. "
bp-1aa18ea5-1a11-4648-803e-a2c8f2150616  msvcr120.dll@0xf20c | nsCOMArray_base::Adopt(nsISupports**, unsigned int)
 0 	msvcr120.dll	msvcr120.dll@0xf20c
1 	xul.dll	nsCOMArray_base::Adopt(nsISupports**, unsigned int)
2 	xul.dll	mozilla::mailnews::EncodedHeader(nsACString_internal const&, char const*)
3 	xul.dll	nsMsgDBView::FetchAuthor(nsIMsgDBHdr*, nsAString_internal&)
4 	xul.dll	nsMsgDBView::GetCollationKey(nsIMsgDBHdr*, int, unsigned char**, unsigned int*, nsIMsgCustomColumnHandler*)
5 	xul.dll	nsMsgDBView::Sort(int, int)
6 	xul.dll	nsMsgThreadedDBView::Sort(int, int) 


Reevaluated startupcrash - by eliminating crashes marked DUP I estimate <10% of crashes are startup.
But it's still a top 10 crash after eliminating DUPs

Comment 2

[Makoto Kato [:m_kato]]

It seems that addresses is null.  It mean nsIMsgHeaderParser::ParseEncodeHeader sets null.  I think we should check length == 0, then don't call adopt it if 0.

Comment 3

[Wayne Mery (:wsmwk)]

related to bug 1123379 and bug 1023285?

Comment 4

[Makoto Kato [:m_kato]]

(In reply to Wayne Mery (:wsmwk, use Needinfo for questions) from comment #3)
> related to bug 1123379 and bug 1023285?

Bug 1123379 is same bug.  We should dup of bug 1123379.

This is a regression by replacing with JSMIME.

Comment 5

[Wayne Mery (:wsmwk)]

similar to comment 1, the reporter of https://support.mozilla.org/questions/1067789 has crashes prior to bp-5e44a8b8-ae56-4388-a25f-6f90d2150620 about which he writes 
today I tried accessing the same folder and it worked.. o.O... and then I did another repair and it worked also.. but then I tried to reorder the folder according to the date and it crashed

Comment 6

[Magnus Melin [:mkmelin]]

Attachment: bug1175190_EncodedHeader_crash.patch

I'd suspect it's likely the case we get an empty string in...

Comment 7

[Kent James (:rkent)]

Comment on attachment 8625173 [details] [diff] [review]
bug1175190_EncodedHeader_crash.patch

I'm going to steal this review, since I want this for TB 39b1

LGTM.

Comment 8

[Magnus Melin [:mkmelin]]

https://hg.mozilla.org/comm-central/rev/f91e51cf26b7 -> FIXED

Comment 9

[Kent James (:rkent)]

Comment on attachment 8625173 [details] [diff] [review]
bug1175190_EncodedHeader_crash.patch

https://hg.mozilla.org/releases/comm-aurora/rev/84bf7d2167f5
https://hg.mozilla.org/releases/comm-beta/rev/b80e51a7c88a

Comment 10

[Wayne Mery (:wsmwk)]

Do we need confirmation to take this on esr38?

I do not have confirm this is gone in nightly or auorora, as the crash rates are too low. (crashes in aurora for the past month look like ~3 users)
I am trying to contact one of them, and the users in https://support.mozilla.org/en-US/questions/1068405 https://support.mozilla.org/en-US/questions/1067789

Comment 11

[Kent James (:rkent)]

Comment on attachment 8625173 [details] [diff] [review]
bug1175190_EncodedHeader_crash.patch

http://hg.mozilla.org/releases/comm-esr38/rev/e7bcc03ba8b1

Comment 12

[Wayne Mery (:wsmwk)]

I have positive feedback in https://support.mozilla.org/en-US/questions/1067789 that 42.0a1, which has the patch, does not crash

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk, use Needinfo for questions) from comment #12)
> I have positive feedback in
> https://support.mozilla.org/en-US/questions/1067789 that 42.0a1, which has
> the patch, does not crash

similar positive results in https://support.mozilla.org/questions/1068405

It's a little early perhaps, but so far no crashes seen for 38.1.0

Comment 14

[Philip Chee]

http://hg.mozilla.org/releases/comm-release/rev/7171d7f121da SEAMONKEY_2_35_RELEASE_BRANCH

Comment 15

[Wayne Mery (:wsmwk)]

In THunderbird 38.1.0, this also killed signature OOM | large | mozalloc_abort(char const* const) | mozalloc_handle_oom(unsigned int) | moz_xmalloc | nsTArray_base<T>::EnsureCapacity(unsigned int, unsigned int) | nsTArray_Impl<T>::AppendElements<T>(mozilla::net::PNeckoChild* const*, unsigned int) 

https://crash-stats.mozilla.com/report/index/bde3b545-be0a-4b1a-a2ce-15db62150728
 0 	mozalloc.dll	mozalloc_abort(char const* const)	memory/mozalloc/mozalloc_abort.cpp
1 	mozalloc.dll	mozalloc_handle_oom(unsigned int)	memory/mozalloc/mozalloc_oom.cpp
2 	mozalloc.dll	moz_xmalloc	memory/mozalloc/mozalloc.cpp
3 	xul.dll	nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity(unsigned int, unsigned int)	xpcom/glue/nsTArray-inl.h
4 	xul.dll	nsTArray_Impl<mozilla::net::PNeckoChild*, nsTArrayInfallibleAllocator>::AppendElements<mozilla::net::PNeckoChild*>(mozilla::net::PNeckoChild* const*, unsigned int)	xpcom/glue/nsTArray.h
5 	xul.dll	mozilla::mailnews::EncodedHeader(nsACString_internal const&, char const*)	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/mime/src/MimeHeaderParser.cpp:95
6 	xul.dll	nsMsgDBView::FetchAuthor(nsIMsgDBHdr*, nsAString_internal&)	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/base/src/nsMsgDBView.cpp:406
7 	xul.dll	nsMsgDBView::CellTextForColumn(int, wchar_t const*, nsAString_internal&)	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/base/src/nsMsgDBView.cpp:1948
8 	xul.dll	nsMsgGroupView::CellTextForColumn(int, wchar_t const*, nsAString_internal&)	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/base/src/nsMsgGroupView.cpp:882
9 	xul.dll	nsMsgDBView::GetCellText(int, nsITreeColumn*, nsAString_internal&)	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mailnews/base/src/nsMsgDBView.cpp:1924