Closed Bug 1255903 Opened 8 years ago Closed 2 years ago

crash in ReleaseObjects moving or deleting thousands of emails. Outbox related?

Categories

(MailNews Core :: Backend, defect)

x86
Windows NT
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED DUPLICATE of bug 583365

People

(Reporter: wsmwk, Unassigned)

References

Details

(Keywords: crash, regression, regressionwindow-wanted, Whiteboard: [bulkoperations])

Crash Data

Attachments

(2 files)

This is #6 crash for 38.6.0

About 20% of crashes sampled (which have email addresses) cite or have installed the sendlater addon.  Although the same user crashed several times in the sample, so a closer examination might reveal a much smaller % of users having the addon.

What is causing the other 3/4 of crashes I do not know. But I'll list a few

*SENDLATER* examples 
bp-707d04b2-aea1-4dec-b359-78c2f2160218 (jscm)
0 	xul.dll	ReleaseObjects	xpcom/glue/nsCOMArray.cpp
1 	xul.dll	nsCOMArray_base::Clear()	xpcom/glue/nsCOMArray.cpp
2 	xul.dll	nsArrayBase::Clear()	xpcom/ds/nsArray.cpp
3 	xul.dll	nsArrayBase::~nsArrayBase()	xpcom/ds/nsArray.cpp
4 	xul.dll	nsArrayCC::`scalar deleting destructor'(unsigned int)	
5 	xul.dll	nsArrayCC::DeleteCycleCollectable()	xpcom/ds/nsArray.cpp
6 	xul.dll	nsArrayCC::cycleCollection::DeleteCycleCollectable(void*)	xpcom/ds/nsArray.h
7 	xul.dll	SnowWhiteKiller::~SnowWhiteKiller()	xpcom/base/nsCycleCollector.cpp
8 	xul.dll	nsCycleCollector::FreeSnowWhite(bool)	xpcom/base/nsCycleCollector.cpp
9 	xul.dll	AsyncFreeSnowWhite::Run()	js/xpconnect/src/XPCJSRuntime.cpp
10 	kernelbase.dll	InitOnceExecuteOnce	
11 	xul.dll	mozilla::HangMonitor::NotifyActivity(mozilla::HangMonitor::ActivityType)	xpcom/threads/HangMonitor.cpp
12 	mozglue.dll	arena_malloc_small	memory/mozjemalloc/jemalloc.c
13 	mozglue.dll	arena_malloc	memory/mozjemalloc/jemalloc.c
14 	xul.dll	js::HashMap<JSAddonId*, nsCOMPtr<nsIAddonInterposition>, js::PointerHasher<JSAddonId*, 3>, js::SystemAllocPolicy>::add<JSAddonId*&, nsIAddonInterposition*&>(js::detail::HashTable<js::HashMapEntry<JSAddonId*, nsCOMPtr<nsIAddonInterposition> >, js::HashMap<JSAddonId*, nsCOMPtr<nsIAddonInterposition>, js::PointerHasher<JSAddonId*, 3>, js::SystemAllocPolicy>::MapHashPolicy, js::SystemAllocPolicy>::AddPtr&, JSAddonId*&, nsIAddonInterposition*&)	js/public/HashTable.h
15 	xul.dll	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)	ipc/glue/MessagePump.cpp
16 	xul.dll	nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity(unsigned int, unsigned int)	xpcom/glue/nsTArray-inl.h
17 	xul.dll	MessageLoop::Run()	ipc/chromium/src/base/message_loop.cc 

bp-ee3afeec-4b4d-4358-b6a9-8ee812160218 (jscm) bp-c8009e0f-0e5a-4c7a-91c5-ee02c2160219 is another
bp-b419b9c7-01af-4be7-aec2-8cadb2160213 (andi)

other addons, or no addons
bp-9b12b7a3-95bb-46e3-abb6-50f2d2160225 mailmerge addon, which uses Outbox
bp-30714db0-7391-4164-950d-25de12160217 only calendar addon
Another mailmerge user bp-0a6cde01-cc38-4173-896d-181b22160310, and Thunderbird asked him if he wanted to send remaining messages from the Outbox.

no mailmerge or sendlater addon - bp-f19930d5-e8f7-4176-a3cf-5aa972160311
I attempted to find earliest crashes. There's plenty of 38.2.0 crashes. https://crash-stats.mozilla.com/search/?signature=~ReleaseObjects&product=Thunderbird&date=%3C2015-09-10&date=%3E2015-09-01&version=!38.2.0&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports  suggests *perhaps* an equally high rate for version 31.*

However, it's inclear how many are Outbox related. There's not an obvious correlation standout in https://crash-analysis.mozilla.com/crash_analysis/20150616/20150616_Thunderbird_38.0.1-interesting-modules.txt (including the sendlater addon) The top items are
    71% (10/14) vs.  29% (1010/3432) ksuser.dll
     71% (10/14) vs.  30% (1017/3432) avrt.dll
     57% (8/14) vs.  16% (532/3432) thumbcache.dll
     57% (8/14) vs.  19% (649/3432) igd10iumd32.dll
     57% (8/14) vs.  19% (650/3432) igdusc32.dll

Most crashes contain SnowWhiteKiller.  But most, like bp-4a2f5fac-f554-4098-a8ae-e19862160308, don't have a clean stack
 0 	xul.dll	ReleaseObjects	xpcom/glue/nsCOMArray.cpp
1 	xul.dll	nsCOMArray_base::Clear()	xpcom/glue/nsCOMArray.cpp
2 	xul.dll	nsArrayBase::Clear()	xpcom/ds/nsArray.cpp
3 	xul.dll	nsArrayBase::~nsArrayBase()	xpcom/ds/nsArray.cpp
4 	xul.dll	nsArrayCC::`scalar deleting destructor'(unsigned int)	
5 	xul.dll	nsArrayCC::DeleteCycleCollectable()	xpcom/ds/nsArray.cpp
6 	xul.dll	nsArrayCC::cycleCollection::DeleteCycleCollectable(void*)	xpcom/ds/nsArray.h
7 	xul.dll	SnowWhiteKiller::~SnowWhiteKiller()	xpcom/base/nsCycleCollector.cpp
8 	xul.dll	nsCycleCollector::FreeSnowWhite(bool)	xpcom/base/nsCycleCollector.cpp
9 	xul.dll	AsyncFreeSnowWhite::Run()	js/xpconnect/src/XPCJSRuntime.cpp
10 	user32.dll	GetInputBits	
11 	xul.dll	mozilla::HangMonitor::NotifyActivity(mozilla::HangMonitor::ActivityType)	xpcom/threads/HangMonitor.cpp
12 	xul.dll	xul.dll@0x1c6b700	

but bp-fd16d955-ba61-4fe7-bd6e-da1762150907 from version 31.7.0 with crash address 0x5a5a5a62 does
 0 	xul.dll	ReleaseObjects	xpcom/glue/nsCOMArray.cpp
1 	xul.dll	nsCOMArray_base::Clear()	xpcom/glue/nsCOMArray.cpp
2 	xul.dll	nsArray::Clear()	xpcom/ds/nsArray.cpp
3 	xul.dll	nsArray::~nsArray()	xpcom/ds/nsArray.cpp
4 	xul.dll	nsArray::`scalar deleting destructor'(unsigned int)	
5 	xul.dll	mozilla::dom::TableRowsCollection::DeleteCycleCollectable()	parser/htmlparser/src/nsExpatDriver.cpp
6 	xul.dll	mozilla::dom::HTMLOptionsCollection::cycleCollection::DeleteCycleCollectable(void*)	content/html/content/src/nsDOMStringMap.h
7 	xul.dll	SnowWhiteKiller::~SnowWhiteKiller()	xpcom/base/nsCycleCollector.cpp
8 	xul.dll	nsCycleCollector::FreeSnowWhite(bool)	xpcom/base/nsCycleCollector.cpp
9 	xul.dll	nsCycleCollector_doDeferredDeletion()	xpcom/base/nsCycleCollector.cpp
10 	xul.dll	AsyncFreeSnowWhite::Run()	js/xpconnect/src/XPCJSRuntime.cpp
11 	xul.dll	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp 



Jonathan, the author of the sendlater addon, kindly writes "you're going to see Send Later installed in some of the profiles where the bug manifests. Send Later's use of the Outbox is entirely through supported Thunderbird APIs, so whatever the problem is, it's not Send Later's fault, it's just that Send Later is triggering a bug in Thunderbird core."

perhaps a coincidence, but I've encountered at least two people who also crash with  nsMsgDBFolder::NotifyItemAdded bug 873426, like bp-83ea0fb5-cd89-465c-88f7-95d0c2151024
Attached file crash report comments
Attached are 94 crash comments
7 mention compact
7 mention send and in some cases NOT being able to send
12 mention deleting mail
16 mention archiving

didn't attempt to categorize the other 50
#5 crash for version 45.1.0

perhaps this is related to bug 1133892.  but I wonder if this is related to filters.
Component: General → Backend
Product: Thunderbird → MailNews Core
See Also: → 1133892
bp-4596423c-f265-4ebb-b67d-617b12160517  "running filters on Inbox"
bp-8479a7b9-2848-4fdb-ba9e-7e4b12160521  "Was doing message filters on a large folder."
bp-7d77845d-3d8f-449a-b6be-d00cc2160518  "trying to delete messages"
jscm who uses sendlater and reported bp-c8009e0f-0e5a-4c7a-91c5-ee02c2160219, says the crash went away after changing "the ACCOUNT drafts folder from Local Folders (which was not the default) back to the drafts folder in the account". In other words, it was crashing when Drafts was pointing to Local Folders
ReleaseObjects signature is gone in 55.0b2.  Perhaps this morphed into a different signature, like bug 1368786.  Will need to evaluate 56 beta.  It did (and still does) exist in signaficant numbers in 54.0b3.
See Also: → 1439271
See Also: → 835798
See Also: → 815141

bug 1454170 may be the Mac version of this crash, which is also Mac topcrash at #12 for 60.6.0

Blocks: 1454170
See Also: → 583365
Summary: crash in ReleaseObjects. Outbox related? → crash in ReleaseObjects moving or deleting thousands of emails. Outbox related?
Whiteboard: [bulkoperations]

This signature is long gone - needs a new signature.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: