1255903 - crash in ReleaseObjects moving or deleting thousands of emails. Outbox related?

Status: RESOLVED DUPLICATE of bug 583365

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

This is #6 crash for 38.6.0

About 20% of crashes sampled (which have email addresses) cite or have installed the sendlater addon.  Although the same user crashed several times in the sample, so a closer examination might reveal a much smaller % of users having the addon.

What is causing the other 3/4 of crashes I do not know. But I'll list a few

*SENDLATER* examples 
bp-707d04b2-aea1-4dec-b359-78c2f2160218 (jscm)
0 	xul.dll	ReleaseObjects	xpcom/glue/nsCOMArray.cpp
1 	xul.dll	nsCOMArray_base::Clear()	xpcom/glue/nsCOMArray.cpp
2 	xul.dll	nsArrayBase::Clear()	xpcom/ds/nsArray.cpp
3 	xul.dll	nsArrayBase::~nsArrayBase()	xpcom/ds/nsArray.cpp
4 	xul.dll	nsArrayCC::`scalar deleting destructor'(unsigned int)	
5 	xul.dll	nsArrayCC::DeleteCycleCollectable()	xpcom/ds/nsArray.cpp
6 	xul.dll	nsArrayCC::cycleCollection::DeleteCycleCollectable(void*)	xpcom/ds/nsArray.h
7 	xul.dll	SnowWhiteKiller::~SnowWhiteKiller()	xpcom/base/nsCycleCollector.cpp
8 	xul.dll	nsCycleCollector::FreeSnowWhite(bool)	xpcom/base/nsCycleCollector.cpp
9 	xul.dll	AsyncFreeSnowWhite::Run()	js/xpconnect/src/XPCJSRuntime.cpp
10 	kernelbase.dll	InitOnceExecuteOnce	
11 	xul.dll	mozilla::HangMonitor::NotifyActivity(mozilla::HangMonitor::ActivityType)	xpcom/threads/HangMonitor.cpp
12 	mozglue.dll	arena_malloc_small	memory/mozjemalloc/jemalloc.c
13 	mozglue.dll	arena_malloc	memory/mozjemalloc/jemalloc.c
14 	xul.dll	js::HashMap<JSAddonId*, nsCOMPtr<nsIAddonInterposition>, js::PointerHasher<JSAddonId*, 3>, js::SystemAllocPolicy>::add<JSAddonId*&, nsIAddonInterposition*&>(js::detail::HashTable<js::HashMapEntry<JSAddonId*, nsCOMPtr<nsIAddonInterposition> >, js::HashMap<JSAddonId*, nsCOMPtr<nsIAddonInterposition>, js::PointerHasher<JSAddonId*, 3>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::AddPtr&, JSAddonId*&, nsIAddonInterposition*&)	js/public/HashTable.h
15 	xul.dll	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)	ipc/glue/MessagePump.cpp
16 	xul.dll	nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity(unsigned int, unsigned int)	xpcom/glue/nsTArray-inl.h
17 	xul.dll	MessageLoop::Run()	ipc/chromium/src/base/message_loop.cc 

bp-ee3afeec-4b4d-4358-b6a9-8ee812160218 (jscm) bp-c8009e0f-0e5a-4c7a-91c5-ee02c2160219 is another
bp-b419b9c7-01af-4be7-aec2-8cadb2160213 (andi)

other addons, or no addons
bp-9b12b7a3-95bb-46e3-abb6-50f2d2160225 mailmerge addon, which uses Outbox
bp-30714db0-7391-4164-950d-25de12160217 only calendar addon

Comment 1

[Wayne Mery (:wsmwk)]

Another mailmerge user bp-0a6cde01-cc38-4173-896d-181b22160310, and Thunderbird asked him if he wanted to send remaining messages from the Outbox.

no mailmerge or sendlater addon - bp-f19930d5-e8f7-4176-a3cf-5aa972160311

Comment 2

[Wayne Mery (:wsmwk)]

I attempted to find earliest crashes. There's plenty of 38.2.0 crashes. https://crash-stats.mozilla.com/search/?signature=~ReleaseObjects&product=Thunderbird&date=%3C2015-09-10&date=%3E2015-09-01&version=!38.2.0&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports  suggests *perhaps* an equally high rate for version 31.*

However, it's inclear how many are Outbox related. There's not an obvious correlation standout in https://crash-analysis.mozilla.com/crash_analysis/20150616/20150616_Thunderbird_38.0.1-interesting-modules.txt (including the sendlater addon) The top items are
    71% (10/14) vs.  29% (1010/3432) ksuser.dll
     71% (10/14) vs.  30% (1017/3432) avrt.dll
     57% (8/14) vs.  16% (532/3432) thumbcache.dll
     57% (8/14) vs.  19% (649/3432) igd10iumd32.dll
     57% (8/14) vs.  19% (650/3432) igdusc32.dll

Most crashes contain SnowWhiteKiller.  But most, like bp-4a2f5fac-f554-4098-a8ae-e19862160308, don't have a clean stack
 0 	xul.dll	ReleaseObjects	xpcom/glue/nsCOMArray.cpp
1 	xul.dll	nsCOMArray_base::Clear()	xpcom/glue/nsCOMArray.cpp
2 	xul.dll	nsArrayBase::Clear()	xpcom/ds/nsArray.cpp
3 	xul.dll	nsArrayBase::~nsArrayBase()	xpcom/ds/nsArray.cpp
4 	xul.dll	nsArrayCC::`scalar deleting destructor'(unsigned int)	
5 	xul.dll	nsArrayCC::DeleteCycleCollectable()	xpcom/ds/nsArray.cpp
6 	xul.dll	nsArrayCC::cycleCollection::DeleteCycleCollectable(void*)	xpcom/ds/nsArray.h
7 	xul.dll	SnowWhiteKiller::~SnowWhiteKiller()	xpcom/base/nsCycleCollector.cpp
8 	xul.dll	nsCycleCollector::FreeSnowWhite(bool)	xpcom/base/nsCycleCollector.cpp
9 	xul.dll	AsyncFreeSnowWhite::Run()	js/xpconnect/src/XPCJSRuntime.cpp
10 	user32.dll	GetInputBits	
11 	xul.dll	mozilla::HangMonitor::NotifyActivity(mozilla::HangMonitor::ActivityType)	xpcom/threads/HangMonitor.cpp
12 	xul.dll	xul.dll@0x1c6b700	

but bp-fd16d955-ba61-4fe7-bd6e-da1762150907 from version 31.7.0 with crash address 0x5a5a5a62 does
 0 	xul.dll	ReleaseObjects	xpcom/glue/nsCOMArray.cpp
1 	xul.dll	nsCOMArray_base::Clear()	xpcom/glue/nsCOMArray.cpp
2 	xul.dll	nsArray::Clear()	xpcom/ds/nsArray.cpp
3 	xul.dll	nsArray::~nsArray()	xpcom/ds/nsArray.cpp
4 	xul.dll	nsArray::`scalar deleting destructor'(unsigned int)	
5 	xul.dll	mozilla::dom::TableRowsCollection::DeleteCycleCollectable()	parser/htmlparser/src/nsExpatDriver.cpp
6 	xul.dll	mozilla::dom::HTMLOptionsCollection::cycleCollection::DeleteCycleCollectable(void*)	content/html/content/src/nsDOMStringMap.h
7 	xul.dll	SnowWhiteKiller::~SnowWhiteKiller()	xpcom/base/nsCycleCollector.cpp
8 	xul.dll	nsCycleCollector::FreeSnowWhite(bool)	xpcom/base/nsCycleCollector.cpp
9 	xul.dll	nsCycleCollector_doDeferredDeletion()	xpcom/base/nsCycleCollector.cpp
10 	xul.dll	AsyncFreeSnowWhite::Run()	js/xpconnect/src/XPCJSRuntime.cpp
11 	xul.dll	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp 



Jonathan, the author of the sendlater addon, kindly writes "you're going to see Send Later installed in some of the profiles where the bug manifests. Send Later's use of the Outbox is entirely through supported Thunderbird APIs, so whatever the problem is, it's not Send Later's fault, it's just that Send Later is triggering a bug in Thunderbird core."

perhaps a coincidence, but I've encountered at least two people who also crash with  nsMsgDBFolder::NotifyItemAdded bug 873426, like bp-83ea0fb5-cd89-465c-88f7-95d0c2151024

Comment 3

[Wayne Mery (:wsmwk)]

Attachment: crash report comments

Attached are 94 crash comments
7 mention compact
7 mention send and in some cases NOT being able to send
12 mention deleting mail
16 mention archiving

didn't attempt to categorize the other 50

Comment 4

[Wayne Mery (:wsmwk)]

#5 crash for version 45.1.0

perhaps this is related to bug 1133892.  but I wonder if this is related to filters.

Comment 5

[Wayne Mery (:wsmwk)]

bp-4596423c-f265-4ebb-b67d-617b12160517  "running filters on Inbox"
bp-8479a7b9-2848-4fdb-ba9e-7e4b12160521  "Was doing message filters on a large folder."
bp-7d77845d-3d8f-449a-b6be-d00cc2160518  "trying to delete messages"

Comment 6

[Wayne Mery (:wsmwk)]

jscm who uses sendlater and reported bp-c8009e0f-0e5a-4c7a-91c5-ee02c2160219, says the crash went away after changing "the ACCOUNT drafts folder from Local Folders (which was not the default) back to the drafts folder in the account". In other words, it was crashing when Drafts was pointing to Local Folders

Comment 7

[Wayne Mery (:wsmwk)]

Attachment: TB ReleaseObjects graph.png

ReleaseObjects signature is gone in 55.0b2.  Perhaps this morphed into a different signature, like bug 1368786.  Will need to evaluate 56 beta.  It did (and still does) exist in signaficant numbers in 54.0b3.

Comment 8

[Wayne Mery (:wsmwk)]

bug 1454170 may be the Mac version of this crash, which is also Mac topcrash at #12 for 60.6.0

Comment 9

[Wayne Mery (:wsmwk)]

This signature is long gone - needs a new signature.