436366 - "ASSERTION: tried to add duplicate listener: 'index == -1'" when replying to a message

Status: REOPENED

(Thunderbird :: Mail Window Front End, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: both normal and full backtraces

###!!! ASSERTION: tried to add duplicate listener: 'index == -1', file /Users/skywalker/Desktop/Mozilla/cvs/mozilla/mailnews/base/src/nsMsgMailSession.cpp, line 96

Reply to a message and this assertion triggers. Debug trunk build 3.0a2 from yesterday's checkout.

Comment 1

[Mark Banner (:standard8)]

(In reply to comment #0)
> ###!!! ASSERTION: tried to add duplicate listener: 'index == -1', file
> /Users/skywalker/Desktop/Mozilla/cvs/mozilla/mailnews/base/src/nsMsgMailSession.cpp,
> line 96
> 
> Reply to a message and this assertion triggers. Debug trunk build 3.0a2 from
> yesterday's checkout.
> 

Interesting, so we do try to add duplicate listeners within mailnews code. Though maybe the problem is here that we're not checking the notify flags are the same as well...

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/base/src/nsMessenger.cpp&rev=1.388&mark=342#328

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/base/src/nsMsgMailSession.cpp&rev=1.92&mark=90,95-97#89

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/base/src/nsMsgMailSession.h&rev=1.30&mark=89-91#79

Comment 2

[Andrew Sutherland [:asuth] (he/him)]

So, the delete logic doesn't actually care about the notify flags either, which is why I had the assertion ignore them.

Based on a quick perusal of nsMessenger, it appears it is adding the same listener every time and never removing them.

Comment 3

[Martin Mokrejs]

Doing a "Reply" with current TRUNK build yeilds me with:

###!!! ASSERTION: tried to add duplicate listener: 'index == -1', file nsMsgMailSession.cpp, line 96
###!!! ASSERTION: Illegal value (length > position): 'aLen > aPos', file nsJISx4501LineBreaker.cpp, line 775
This is a recycled compose window!
###!!! ASSERTION: reflow state computed incorrect width: 'reflowState.ComputedWidth() == size.width - reflowState.mComputedBorderPadding.LeftRight()', file nsPresShell.cpp, line 6276
###!!! ASSERTION: reflow roots must not have visible overflow: 'desiredSize.mOverflowArea == nsRect(nsPoint(0, 0), nsSize(desiredSize.width, desiredSize.height))', file nsPresShell.cpp, line 6294
###!!! ASSERTION: URI is empty: '!aURI.IsEmpty()', file nsRDFService.cpp, line 940

Comment 4

[Mark Banner (:standard8)]

This sort of thing makes me nervous we're going to be doing the wrong thing - especially as we appear to have at least one step to reproduce.

Andrew, can you take a look at this sometime please?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

No longer seems to occur on latest debug Mac TB build. WFM.

Comment 6

[Martin Mokrejs]

With current debug build I still get after hitting a Reply button:

###!!! ASSERTION: tried to add duplicate listener: 'index == -1', file /home/mmokrejs/proj/comm-central/src/mailnews/base/src/nsMsgMailSession.cpp, line 100
[cut]
###!!! ASSERTION: Illegal value (length > position): 'aLen > aPos', file /home/mmokrejs/proj/comm-central/src/mozilla/intl/lwbrk/src/nsJISx4501LineBreaker.cpp, line 789
[cut]
UNKNOWN [./seamonkey-bin +0x000016B2]
###!!! ASSERTION: URI is empty: '!aURI.IsEmpty()', file /home/mmokrejs/proj/comm-central/src/mozilla/rdf/base/src/nsRDFService.cpp, line 940
[cut]
###!!! ASSERTION: cannot call GetUsedBorder on a dirty frame not currently being reflowed: 'nsLayoutUtils::sDisableGetUsedXAssertions || !NS_SUBTREE_DIRTY(this) || (GetStateBits() & NS_FRAME_IN_REFLOW)', file /home/mmokrejs/proj/comm-central/src/mozilla/layout/generic/nsFrame.cpp, line 608
[cut]


Please re-open.

Build identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.3pre) Gecko/20090801 SeaMonkey/2.0b2pre

Comment 7

[Mark Banner (:standard8)]

Martin, can you confirm this is without extensions installed?

Comment 8

[Martin Mokrejs]

Mark, I started seamoneky off the build directory. On a daily baissi I use the seamonkey-1.1.17. If you talk about plugins etc, I would hope that I do not have any installed in this temporary, testing build but about:plugins displays some (libnpsoplugin.so, libnptest.so, libnullplugin.so, libunixprintplugin.so, opensc-signer.so).

My session started with:

$ rm -rf ~/.mozilla/seamonkey/
$ pwd
/home/mmokrejs/proj/comm-central/seamonkey-compiled/mozilla/dist/bin
$ MOZILLA_FIVE_HOME=`pwd` XPCOM_DEBUG_BREAK=stack ./seamonkey
[cut]
-> Import Wizard
[cut]
The following folders are currently being imported
[Importing...]
[Import complete]
-> Finish
[and then I went to test for existence of my old bugs, and suddenly hit this issue meanwhile]

Does that answer your question?



Source

Built from http://hg.mozilla.org/releases/mozilla-1.9.1/rev/0274a35f0e16

Configure arguments
--disable-optimize --enable-debug=-ggdb --enable-debug-modules=all --enable-debugger-info-modules --enable-detect-webshell-leaks --enable-svg --enable-svg-renderer-libart --enable-image-decoders=all --with-qtdir=/usr/qt/3 --enable-application=suite --disable-freetype2 --enable-jprof --enable-default-toolkit=cairo-gtk2 --enable-xft --disable-gssapi --disable-optimize --enable-debug=-ggdb --enable-debug-modules=all --enable-debugger-info-modules --enable-detect-webshell-leaks --enable-svg --enable-svg-renderer-libart --enable-image-decoders=all --with-qtdir=/usr/qt/3 --enable-application=suite --disable-freetype2 --enable-jprof --enable-default-toolkit=cairo-gtk2 --enable-xft --disable-gssapi --enable-application=../suite --disable-official-branding --with-branding=../suite/branding/nightly --cache-file=.././config.cache --srcdir=/home/mmokrejs/proj/comm-central/src/mozilla

Comment 9

[David :Bienvenu]

I can confirm - I see this occasionally.

Comment 10

[Hiroyuki Ikezoe (:hiro)]

I've seen this issue while running test_imapFlagChange.js with some modifications on try server.

https://tbpl.mozilla.org/?tree=Thunderbird-Try&rev=943fe0d4c221

From the try server log:

TEST-INFO | (xpcshell/head.js) | exiting test

TEST-PASS | (xpcshell/head.js) | 19 (+ 0) check(s) passed

TEST-INFO | (xpcshell/head.js) | 0 check(s) todo
WARNING: nsExceptionService ignoring thread destruction after shutdown: file ../../../../mozilla/xpcom/base/nsExceptionService.cpp, line 166
WARNING: NS_ENSURE_TRUE(folder) failed: file ../../../../mailnews/imap/src/nsImapProtocol.cpp, line 2018
###!!! ASSERTION: tried to add duplicate listener: 'index == -1', file ../../../../mailnews/base/src/nsMsgMailSession.cpp, line 72
nsStopwatch::Stop()+0x00033120 [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x01C03BF0]
nsStopwatch::Stop()+0x00029B39 [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x01BFA609]
nsMsgMailNewsUrl::GetServer(nsIMsgIncomingServer**)+0x000003BB [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x01BC296B]
nsStopwatch::Stop()+0x0036DE24 [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x01F3E8F4]
nsStopwatch::Stop()+0x00384CF0 [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x01F557C0]
nsStopwatch::Stop()+0x002F7E3C [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x01EC890C]
nsStopwatch::Stop()+0x003E983D [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x01FBA30D]
XRE_AddManifestLocation+0x00006C28 [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x02471F08]
mac_plugin_interposing_child_OnSetThemeCursor+0x001D88AE [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x023F6C8E]
NS_InitXPCOM+0x000002ED [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/XUL +0x024013BD]
main+0x00001B2A [/Users/cltbld/talos-slave/test/build/DailyDebug.app/Contents/MacOS/xpcshell +0x0000555A]
###!!! ASSERTION: tried to add duplicate listener: 'index == -1', file ../../../../mailnews/base/src/nsMsgMailSession.cpp, line 72
<<<<<<<
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/thunderbird/try-builds/[e-mail]-943fe0d4c221/try-comm-central-macosx64-debug/thunderbird-16.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | /Users/cltbld/talos-slave/test/build/xpcshell/tests/mailnews/imap/test/unit/test_imapFlagChange.js | application crashed (minidump found)
Crash dump filename: /Users/cltbld/talos-slave/test/build/xpcshell/tests/mailnews/imap/test/unit/5DDD9E76-D748-405C-9260-EE2E196FAC36.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  libmozalloc.dylib!mozalloc_abort [mozalloc_abort.cpp : 23 + 0x0]
    rbx = 0x706c72f8   r12 = 0x706c72f8   r13 = 0x5fbfd710   r14 = 0x02ff8658
    r15 = 0x02ff8649   rip = 0x0001f9e5   rsp = 0x5fbfd6c0   rbp = 0x5fbfd6d0
    Found by: given as instruction pointer in context
 1  XUL!NS_DebugBreak_P [nsDebugImpl.cpp : 382 + 0x7]
    rbx = 0x00000001   r12 = 0x706c72f8   r13 = 0x5fbfd710   r14 = 0x02ff8658
    r15 = 0x02ff8649   rip = 0x024a5870   rsp = 0x5fbfd6e0   rbp = 0x5fbfdb40
    Found by: call frame info
 2  XUL!nsMsgMailSession::AddFolderListener [nsMsgMailSession.cpp : 72 + 0x3b]
    rbx = 0x04847d68   r12 = 0x04848ef0   r13 = 0x0000000b   r14 = 0x00000000
    r15 = 0x04847d40   rip = 0x01c13b4b   rsp = 0x5fbfdb50   rbp = 0x5fbfdbb0
    Found by: call frame info
 3  XUL!nsMsgAccountManager::LoadAccounts [nsMsgAccountManager.cpp : 1192 + 0x15]
    rbx = 0x00000000   r12 = 0x048ad320   r13 = 0x5fbfdeac   r14 = 0x00000000
    r15 = 0x04847d40   rip = 0x01c25bf0   rsp = 0x5fbfdbc0   rbp = 0x5fbfdf50
    Found by: call frame info
 4  XUL!nsMsgAccountManager::FindServerByURI [nsMsgAccountManager.cpp : 1776 + 0x8]
    rbx = 0x00000000   r12 = 0x048ad320   r13 = 0x5fbfe260   r14 = 0x5fbfe228
    r15 = 0x04847d40   rip = 0x01c1c609   rsp = 0x5fbfdf60   rbp = 0x5fbfe1d0
    Found by: call frame info
 5  XUL!nsMsgMailNewsUrl::GetServer [nsMsgMailNewsUrl.cpp : 165 + 0x14]
    rbx = 0x00000000   r12 = 0x0489a238   r13 = 0x5fbfe260   r14 = 0x5fbfe228
    r15 = 0x5fbfe650   rip = 0x01be496b   rsp = 0x5fbfe1e0   rbp = 0x5fbfe360
    Found by: call frame info
 6  XUL!nsImapProtocol::SetupWithUrl [nsImapProtocol.cpp : 638 + 0xc]
    rbx = 0x0489a238   r12 = 0x01be45b0   r13 = 0x00000000   r14 = 0x05825800
    r15 = 0x00000000   rip = 0x01f608f4   rsp = 0x5fbfe370   rbp = 0x5fbfe6b0
    Found by: call frame info
 7  XUL!nsImapProtocol::LoadImapUrl [nsImapProtocol.cpp : 2084 + 0xd]
    rbx = 0x0489a238   r12 = 0x05825800   r13 = 0x00000000   r14 = 0x00000000
    r15 = 0x5fbfe780   rip = 0x01f777c0   rsp = 0x5fbfe6c0   rbp = 0x5fbfe720
    Found by: call frame info
 8  XUL!nsImapIncomingServer::RetryUrl [nsImapIncomingServer.cpp : 489 + 0xb]
    rbx = 0x00000000   r12 = 0x0489a230   r13 = 0x5fbfe748   r14 = 0x04849f70
    r15 = 0x5fbfe780   rip = 0x01eea90c   rsp = 0x5fbfe730   rbp = 0x5fbfe7c0
    Found by: call frame info
 9  XUL!SyncRunnable2<nsIImapServerSink,nsIImapUrl*,nsIImapMockChannel*>::Run [nsSyncRunnableHelpers.cpp : 146 + 0x32]
    rbx = 0x00000000   r12 = 0x049e22b0   r13 = 0x0481a110   r14 = 0x0481a0d0
    r15 = 0x00000000   rip = 0x01fdc30d   rsp = 0x5fbfe7d0   rbp = 0x5fbfe7e0
    Found by: call frame info
10  XUL!nsThread::ProcessNextEvent [nsThread.cpp : 624 + 0x5]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x0481a110   r14 = 0x0481a0d0
    r15 = 0x00000000   rip = 0x02493f08   rsp = 0x5fbfe7f0   rbp = 0x5fbfe8c0
    Found by: call frame info
11  XUL!NS_ProcessPendingEvents_P [nsThreadUtils.cpp : 166 + 0xd]
    rbx = 0x0481a0d0   r12 = 0x00000000   r13 = 0xe5b4e8a1   r14 = 0xffffffff
    r15 = 0x5fbfe8df   rip = 0x02418c8e   rsp = 0x5fbfe8d0   rbp = 0x5fbfe910
    Found by: call frame info
12  XUL!mozilla::ShutdownXPCOM [nsXPComInit.cpp : 586 + 0x9]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x5fbfe970
    r15 = 0x5fbfe980   rip = 0x024233bd   rsp = 0x5fbfe920   rbp = 0x5fbfe9e0
    Found by: call frame info
13  xpcshell!main [xpcshell.cpp : 1970 + 0x6]
    rbx = 0x00000000   r12 = 0x0493fad0   r13 = 0x00000000   r14 = 0x5fbfeb48
    r15 = 0x00000014   rip = 0x0000555a   rsp = 0x5fbfe9f0   rbp = 0x5fbfec50
    Found by: call frame info
14  xpcshell + 0xd73
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x00000000   r14 = 0x00000000
    r15 = 0x00000000   rip = 0x00000d74   rsp = 0x5fbfec60   rbp = 0x5fbfec68
    Found by: call frame info

Comment 11

[Hiroyuki Ikezoe (:hiro)]

Unfortunately I can not reproduce the crash on my local macOSX machine, but it happens repeatedly on try server.

Comment 12

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Back to the pool, asuth is unlikely to be working on TB much these days.

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to Hiroyuki Ikezoe (:hiro) from comment #11)
> Unfortunately I can not reproduce the crash on my local macOSX machine, but
> it happens repeatedly on try server.

Have either of you come across this?

Comment 14

[ISHIKAWA, Chiaki]

No, I don't think so.

Comment 15

[Jorg K (CEST = GMT+2)]

I've never seen it. Remember, I'm new here, I only started in 2015. ;-)