526047 - startup crash getting mail @ nsAddrDatabase::GetRowForCharColumn - nsSpamSettings::CheckWhiteList [@ nsAddrDatabase::GetRowForCharColumn(unsigned short const*, unsigned int, int, int, nsIMdbRow**, int*)]

Status: RESOLVED FIXED

(MailNews Core :: Address Book, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsAddrDatabase::GetRowForCharColumn(unsigned short const*, unsigned int, int, int, nsIMdbRow**)]

fairly common for 3.0x. #31 for 3.0b4. still in current nightly bp-2809f3f5-510b-4d5e-b122-3b5782091020
based on uptime, 1/3 are during startup

bp-1ffd2c8e-ddc5-4953-8072-5e2dc2090529
0	thunderbird.exe	nsAddrDatabase::GetRowForCharColumn	 nsAddrDatabase.cpp:3235
1	thunderbird.exe	nsAddrDatabase::GetRowFromAttribute	nsAddrDatabase.cpp:3044
2	thunderbird.exe	nsAddrDatabase::GetCardFromAttribute	nsAddrDatabase.cpp:3058
3	thunderbird.exe	nsAbMDBDirectory::CardForEmailAddress	nsAbMDBDirectory.cpp:1056
4	thunderbird.exe	nsMsgDBFolder::CallFilterPlugins	nsMsgDBFolder.cpp:2169
5	thunderbird.exe	nsImapMailFolder::HeaderFetchCompleted	nsImapMailFolder.cpp:5199
6	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
7	xpcom_core.dll	nsProxyObjectCallInfo::Run	xpcom/proxy/src/nsProxyEvent.cpp:181 


TB56591181 v2 Creating a new list in my address book
nsAddrDatabase::GetRowForCharColumn  [mozilla/mailnews/addrbook/src/nsAddrDatabase.cpp, line 3889]
nsAddrDatabase::FindMailListbyUnicodeName  [mozilla/mailnews/addrbook/src/nsAddrDatabase.cpp, line 3782]
nsAddressBook::MailListNameExists  [mozilla/mailnews/addrbook/src/nsAddressBook.cpp, line 378]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1387]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3966]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1406]

Comment 1

[Wayne Mery (:wsmwk)]

This stack sig is gone as of v3.0.0 (last is 3.0b4) ... I am unsure if this is gone or has morphed to where nsSpamSettings::CheckWhiteList is in the stack, and top of stack is nsAddrDatabase::GetRowForCharColumn(unsigned short const*, unsigned int, int, int, nsIMdbRow**, int*) 

some, but not all, of these crashes have lookout extension installed

bp-90c41d1a-d6aa-4f99-99a9-bced12091226
0	thunderbird-bin	nsAddrDatabase::GetRowForCharColumn	 mailnews/addrbook/src/nsAddrDatabase.cpp:3254
1	thunderbird-bin	nsAddrDatabase::GetRowFromAttribute	mailnews/addrbook/src/nsAddrDatabase.cpp:3024
2	thunderbird-bin	nsAddrDatabase::GetCardFromAttribute	mailnews/addrbook/src/nsAddrDatabase.cpp:3037
3	thunderbird-bin	nsAbMDBDirectory::CardForEmailAddress	mailnews/addrbook/src/nsAbMDBDirectory.cpp:1090
4	thunderbird-bin	nsSpamSettings::CheckWhiteList	mailnews/base/src/nsSpamSettings.cpp:907
5	thunderbird-bin	nsMsgDBFolder::CallFilterPlugins	mailnews/base/util/nsMsgDBFolder.cpp:2543
6	thunderbird-bin	nsImapMailFolder::HeaderFetchCompleted	mailnews/imap/src/nsImapMailFolder.cpp:5665

Comment 2

[Wayne Mery (:wsmwk)]

bp-4d3141b2-338e-4b18-8681-c8e3d2100104 has no extension

Comment 3

[Wayne Mery (:wsmwk)]

also, bp-4d3141b2-338e-4b18-8681-c8e3d2100104 stack is slightly different. It doesn't include nsSpamSettings::CheckWhiteList

updated summary to cover nsAddrDatabase::GetRowForCharColumn(unsigned short const*, unsigned int, int, int, nsIMdbRow**, int*) for which I filed a duplicate bug :)

Comment 5

[Wayne Mery (:wsmwk)]

#26 crash for 3.1.3 and #13 for 3.0.7 -> topcrash
about 2/3 are startup crashes

https://crash-stats.mozilla.com/report/index/bp-1b89fbd4-eded-4b57-8448-d50fa2100917 is from http://gsfn.us/t/pk8a

Comment 6

[Wayne Mery (:wsmwk)]

ideas on cause?

blocking? to get on 3.1 QA radar

Comment 7

[Wayne Mery (:wsmwk)]

> https://crash-stats.mozilla.com/report/index/bp-1b89fbd4-eded-4b57-8448-d50fa2100917
> is from http://gsfn.us/t/pk8a

specifically http://getsatisfaction.com/mozilla_messaging/topics/3_01_update_crashes#reply_3492520

Comment 8

[Makoto Kato [:m_kato]]

It cannot open database well, so m_mdbPabTable seems to be null.  I don't know why m_mdbPabTable is null.

Comment 9

[Makoto Kato [:m_kato]]

- morkStore::GetTable can return success even if m_mdbPabTable isn't set.
- morkStore::NewTableWithOid can return success even if m_mdbPabTable isn't set.
- nsAddrDatabase::InitExistingDB can return success even if  m_mdbPabTable is null.

I think that table for addressbook is broken if this crash occurs.

Comment 10

[Wayne Mery (:wsmwk)]

another example http://getsatisfaction.com/mozilla_messaging/topics/error_when_reading_new_mail

Comment 11

[Sandro Della Giustina]

An user, jackfi,  in the italian forum have reported that when he fetch mail TB crashes, their crash reports link to this bug:
http://crash-stats.mozilla.com/report/index/bp-be8224e0-b235-4f98-83fb-898982110221
	http://crash-stats.mozilla.com/report/index/bp-a79318d6-c70d-44a1-b442-822662110218
	
The problem is that the TB address book is corrupted:
http://forum.mozillaitalia.org/index.php?topic=48886.msg316869#msg316869
	
editing the mab file with Notepad++ user have seen that there are strange strings like this:
"joilet data added by roxyo cd creator"
maybe, he have opened mab file from Explorer and it is opened by default by Roxio that corrupt the file. Removing the strings the problem disappear.
I hope this could help.

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to comment #9)
> - morkStore::GetTable can return success even if m_mdbPabTable isn't set.
> - morkStore::NewTableWithOid can return success even if m_mdbPabTable isn't
> set.
> - nsAddrDatabase::InitExistingDB can return success even if  m_mdbPabTable
> is null.
> 
> I think that table for addressbook is broken if this crash occurs.

Is there a reasonable solution?

Comment 14

[Wayne Mery (:wsmwk)]

Mark, Joshua, (or anyone) do we need a testcase to help develop a patch?

Comment 15

[Wayne Mery (:wsmwk)]

still a topcrash.

however, prior signatures are gone as of version 7. version 7 signature is @ nsAddrDatabase::GetRowForCharColumn(wchar_t const*, unsigned int, int, int, nsIMdbRow**, int*) 

version 7 crashes:
bp-1b1790df-2692-4441-af54-6a5742111011 
bp-4185d1e1-6391-4999-a981-ebf0a2111012

Mac and linux signature = @ nsAddrDatabase::GetRowForCharColumn

Comment 16

[Wayne Mery (:wsmwk)]

reporter of bp-4185d1e1-6391-4999-a981-ebf0a2111012 writes 
"I can download e-mail to [Thunderbird on my PC] Mozilla from the Imapserver after I first load them to my Mac and mark them as "read".

Comment 17

[Makoto Kato [:m_kato]]

(In reply to Wayne Mery (:wsmwk) from comment #13)

> > I think that table for addressbook is broken if this crash occurs.
> 
> Is there a reasonable solution?

I don't know.  At least, this crash occurs when database file isn't generated by any error.

Comment 18

[Scoobidiver (away)]

It's only #55 top crasher in Thunderbird 8. I don't think the topcrash keyword is required.

Comment 19

[Wayne Mery (:wsmwk)]

I don't know where you see #55.  The 7 day range gives #48 and 14 day = #45 [1]. 

when you consider that approx 80% of thunderbird crashes are OOM, core issues, or non-mozilla causes, most of which thunderbird developers/coders will have marginal capability to effect repair, surely a top 50 ranking (or perhaps even higher) for designating topcrash isn't unreasonable 

[1] https://crash-stats.mozilla.com/topcrasher/byversion/Thunderbird/8.0/14/browser

Comment 20

[Scoobidiver (away)]

(In reply to Wayne Mery (:wsmwk) from comment #19)
> I don't know where you see #55.  The 7 day range gives #48 and 14 day = #45
> [1]. 
This morning, it was #55 in https://crash-stats.mozilla.com/topcrasher/byversion/Thunderbird/8.0/7/all

Comment 21

[Makoto Kato [:m_kato]]

m_mdbPabTable is null

- GetRowForCharColumn doesn't check whether m_mdbPabTable is null
- m_mdbPabTable is set in InitPabTable only
- If InitPabTable returns error, OpenMDB will return success.

Comment 22

[Wayne Mery (:wsmwk)]

Given the tendency to be a startup crash, this might be driving some users away.

although art, the reporter of bp-4b9cc715-c94f-445f-910e-649ef2120410 is tenacious.

Comment 23

[Wayne Mery (:wsmwk)]

Makoto Kato, could you float a patch?

Comment 24

[Wayne Mery (:wsmwk)]

https://getsatisfaction.com/mozilla_messaging/topics/thunderbird_crashes-43hca

Comment 25

[Makoto Kato [:m_kato]]

Attachment: quick fix

Comment 26

[David :Bienvenu]

Comment on attachment 638987 [details] [diff] [review]
quick fix

looks reasonable, thx. But instead of initializing ret as NS_ERROR_FAILURE, I think I'd prefer an early return in the case of not being able to get a factory, i.e.,

NS_ENSURE_TRUE(m_mdbFactory, NS_ERROR_FAILURE);

and then remove the if (m_mdbFactory), which will make the rest of the code look cleaner, thx!

Comment 27

[:aceman]

Makoto?

Comment 29

[rhills]

Since my bug 727662 duplicates this one, I'll comment here.
After reading through the comments above, I opened up my .mab files using a text editor (gedit in Ubuntu).  One of these files ("abook-2.mab") caused gedit to throw an error about non-text characters.  I moved this file out of my thunderbird/<user name> filder and now Thunderbird doesn't crash any more.

So, this seems like a way to work around this problem while we wait for the bug fix to make its way through to stable package repositories

Comment 30

[Makoto Kato [:m_kato]]

https://hg.mozilla.org/comm-central/rev/402d16973109

Comment 31

[Wayne Mery (:wsmwk)]

Comment on attachment 638987 [details] [diff] [review]
quick fix

Thanks all!

I think we should take this on ESR.
It has been in the wild for several months with no reported problems. 
And is a topcrash, often startup, with no obvious workaround to the user.

[Approval Request Comment]
Regression caused by (bug #): -
User impact if declined: startup crashes
Testing completed (on c-c, etc.): TB18beta and TB19 beta
Risk to taking this patch (and alternatives if risky): ?

Comment 32

[Wayne Mery (:wsmwk)]

p.s. 75% of crashes are windows 7

Comment 33

[Mark Banner (:standard8)]

https://hg.mozilla.org/releases/comm-esr17/rev/0bf1c27bcdb0