Closed Bug 1220667 Opened 4 years ago Closed 4 years ago

crash in NS_CycleCollectorSuspect3 coming from gloda

Categories

(Thunderbird :: Search, defect, critical)

Unspecified
All
defect
Not set
critical

Tracking

(thunderbird43 unaffected, thunderbird44+ fixed, thunderbird45+ fixed)

VERIFIED FIXED
Thunderbird 45.0
Tracking Status
thunderbird43 --- unaffected
thunderbird44 + fixed
thunderbird45 + fixed

People

(Reporter: Pike, Assigned: mkmelin)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [regression:TB44])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-713eeeec-8f8f-42c4-9dee-813692151102.
=============================================================

Crashed twice in a row with this on Daily from yesterday. Per bug 1151643:

Crashes with this signature indicate that a cycle collected object is either being used after the cycle collector is shut down, or on a thread that does not have a cycle collector.

PS: Yes, Wayne, I'm on Daily now, not long enough for a verdict, though
This is a regression from bug 931283, which landed in Fx44. That patch made it so that any nsIVariant created by the component manager are mainthread-only, and this is being called on some database thread.

I worked around similar issues in Firefox code in bug 1210517, by directly calling |new nsVariant()| rather than using the component manager. The fix here is to do the same thing in nsGlodaRankerFunction::OnFunctionCall().

That is the only direct use of the variant contract id in C++ in Thunderbird:
http://mxr.mozilla.org/comm-central/search?string=%40mozilla.org/variant%3B1

There are also a few places that use NS_VARIANT_CONTRACTID (which is just a macro for the same contract id) from C++, that somebody should audit and decide if they are used off the main thread. If so, they will need to be converted similarly. Even if they aren't, they could be changed to |new nsVariantCC()|, which would be a little cleaner, but not really necessary.
http://mxr.mozilla.org/comm-central/ident?i=NS_VARIANT_CONTRACTID
Blocks: 931283
Sorry, I should have checked comm-central for this variant pattern and filed a bug about it! Somehow it slipped my mind.
Thanks for the hings.
And this is a topcrash for 44.0a2 and 45.0a1
I have had daily crash 3 times in a row with this : exactly the same pattern of behaviour : attempted to do a search over all folders.

I noticed LavasoftLSP was mentioned in the crash dump : I will try the following

 - switch to safe mode
 - delete global-messages-db.sqlite
 - switch off email protection in ad-aware

I will report back with my results!
(In reply to helkav from comment #4)
> I have had daily crash 3 times in a row with this : exactly the same pattern
> of behaviour : attempted to do a search over all folders.
> 
> I noticed LavasoftLSP was mentioned in the crash dump : I will try the
> following
> 
>  - switch to safe mode
>  - delete global-messages-db.sqlite
>  - switch off email protection in ad-aware
> 
> I will report back with my results!

none of these had any effect : I am going to earlybird to see how that does ...
regression checking:

43.0a2 : not affected 
44.0a1 : affected
44.0a2 : affected

so the issue has arisen between 43.0a2 and 44.0a1 , unless there's a build inbetween , but I couldn't find any
45.0a1 : affected

this is the current version for daily ...
We need to fix this in aurora ASAP based on stats of https://crash-stats.mozilla.com/topcrasher/products/Thunderbird/versions/44.0a2 - within the next week would be ideal


(In reply to Wayne Mery (:wsmwk, use Needinfo for questions) from comment #3)
> Thanks for the hings.
c/Thanks for the hings./Thanks for the hints./
Keywords: dogfood
Assignee: nobody → mkmelin+mozilla
Status: NEW → ASSIGNED
Attachment #8685593 - Flags: review?(mconley)
Attachment #8685593 - Flags: feedback?(continuation)
Comment on attachment 8685593 [details] [diff] [review]
bug1220667_crash_in_gloda_NS_CycleCollectorSuspect3.patch

Review of attachment 8685593 [details] [diff] [review]:
-----------------------------------------------------------------

This looks to me like it will fix the issue. Thanks!
Attachment #8685593 - Flags: feedback?(continuation) → feedback+
Comment on attachment 8685593 [details] [diff] [review]
bug1220667_crash_in_gloda_NS_CycleCollectorSuspect3.patch

Review of attachment 8685593 [details] [diff] [review]:
-----------------------------------------------------------------

Willing to sign off on this.
Attachment #8685593 - Flags: review?(mconley) → review+
https://hg.mozilla.org/comm-central/rev/acb8e32e8c55 -> FIXED
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → Thunderbird 45.0
did an update of daily today and this is now fixed

noticed the version number is still 45.0a1 in the about dialog and troubleshooting page

I don't normally check the build number (currently 20151112030427) but is there a reason the version number has not been updated?
What version number did you expect? I think it's expected for nightlies to be at 45.0a1 atm.
ok I just didn't know if the nightlys were updating the version number nightly...I'm guessing not by your reply - so I should also check the build date. should have been obvious I suppose...
Crash with similar signature is reported during comm-aurora xpcshell tests:

> TEST-UNEXPECTED-FAIL | mailnews/db/gloda/test/unit/test_fts3_tokenizer.js | xpcshell return code: -11
> PROCESS-CRASH | mailnews/db/gloda/test/unit/test_fts3_tokenizer.js | application crashed [@ NS_CycleCollectorSuspect3] 

> TEST-UNEXPECTED-FAIL | mailnews/db/gloda/test/unit/test_msg_search.js | xpcshell return code: -11
> PROCESS-CRASH | mailnews/db/gloda/test/unit/test_msg_search.js | application crashed [@ NS_CycleCollectorSuspect3] 

Will this be ported back to comm-aurora for Thunderbird 44?
Flags: needinfo?(mkmelin+mozilla)
Comment on attachment 8685593 [details] [diff] [review]
bug1220667_crash_in_gloda_NS_CycleCollectorSuspect3.patch

Review of attachment 8685593 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah this should land on 44 too.
Attachment #8685593 - Flags: approval-comm-aurora+
Flags: needinfo?(mkmelin+mozilla)
Whiteboard: [regression:TB44]
Looking great from crash-stats POV.
no crashes for 45.0a1 builds newer than 11-11
no crashes for 44.0a2 builds newer than 12-05
v.fixed
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.