1401858 - Startup Crash in mozilla::mailnews::EncodedHeader

Status: RESOLVED FIXED

(Thunderbird :: Mail Window Front End, defect)

Description

[Frederic Bezies]

This bug was filed from the Socorro interface and is 
report bp-372815b5-4a27-4250-87ea-a04910170920.
=============================================================

Comment 1

[Wayne Mery (:wsmwk)]

>  duplicate of #1388723 ?
perhaps

Do you have steps to reproduce this crash or a testcase message that reliably crashes?


bp-372815b5-4a27-4250-87ea-a04910170920
0	libxul.so	mozilla::mailnews::EncodedHeader	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/mime/src/MimeHeaderParser.cpp:101
1	libxul.so	nsMsgSearchTerm::MatchRfc822String	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/base/search/src/nsMsgSearchTerm.cpp:1218
2	libxul.so	nsMsgSearchOfflineMail::ProcessSearchTerm	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/base/search/src/nsMsgLocalSearch.cpp:529
3	libxul.so	nsMsgSearchBoolExpression::OfflineEvaluate	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/base/search/src/nsMsgLocalSearch.cpp:141
4	libxul.so	nsMsgSearchOfflineMail::MatchTerms	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/base/search/src/nsMsgLocalSearch.cpp:687
5	libxul.so	nsMsgSearchOfflineMail::MatchTermsForFilter	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/base/search/src/nsMsgLocalSearch.cpp:316
6	libxul.so	nsMsgFilter::MatchHdr	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/base/search/src/nsMsgFilter.cpp:705
7	libxul.so	nsMsgFilterList::ApplyFiltersToHdr	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/base/search/src/nsMsgFilterList.cpp:307
8	libxul.so	nsParseNewMailState::ApplyFilters	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/local/src/nsParseMailbox.cpp:1962
9	libxul.so	nsParseNewMailState::PublishMsgHeader	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/local/src/nsParseMailbox.cpp:1885
10	libxul.so	nsPop3Sink::IncorporateComplete	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/local/src/nsPop3Sink.cpp:898
11	libxul.so	nsPop3Protocol::HandleLine	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/local/src/nsPop3Protocol.cpp:3575
12	libxul.so	nsPop3Protocol::RetrResponse	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/local/src/nsPop3Protocol.cpp:3359
13	libxul.so	nsPop3Protocol::ProcessProtocolState	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/local/src/nsPop3Protocol.cpp:3990
14	libxul.so	nsMsgProtocol::OnDataAvailable	/builds/slave/tb-c-cen-l64-ntly-000000000000/build/mailnews/base/util/nsMsgProtocol.cpp:298
15	libxul.so	nsInputStreamPump::OnStateTransfer	netwerk/base/nsInputStreamPump.cpp:617

Comment 2

[Frederic Bezies]

No steps besides using a crashing build and grabbing my mail. Nothing less, nothing more. Sorry.

By the way, using a september 19th thunderbird daily build and no crashes at all...

So, maybe not a duplicate, but something looking strangely like it.

Comment 3

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #1)
> >  duplicate of #1388723 ?
> perhaps
 
or perhaps only related. 

We have a massive spike of crashes starting with 0920 build, multiple users, all OS (not just linux), as seen in these graphs
https://crash-stats.mozilla.com/signature/?product=Thunderbird&signature=mozilla%3A%3Amailnews%3A%3AEncodedHeader&date=%3E%3D2017-09-08T12%3A07%3A31.000Z&date=%3C2017-09-22T12%3A07%3A31.000Z#graphs
https://crash-stats.mozilla.com/crashes-per-day/?p=Thunderbird

What's the cause? https://hg.mozilla.org/comm-central/pushloghtml?startdate=2017-09-15+03%3A05%3A00&enddate=2017-09-20+05%3A05%3A00

And is Fred's crash report a match to this new regression, or only to the older bug 1388723

Fred, do you have other crash?   I find only one report.

Comment 4

[Jorg K (CEST = GMT+2)]

In bug 1388723 the crash site is MimeHeaderParser.cpp:100 or MimeHeaderParser.cpp:101. There are various direct callers in the call stacks: nsSpamSettings.cpp:809, nsMsgDBView.cpp:407, nsMsgSearchTerm.cpp:1218.

The code reads:
100   nsresult rv = headerParser->ParseEncodedHeader(aHeader, aCharset,
101     false, &length, &addresses);

So I'd say that this bug here is the same as bug 1388723. Hard to tell why that crashes.

Looking at the graph/spite quoted in comment #3, you have 44, 59 and 10 crashes on 20th, 21st and 22nd of Sept. So it spiked and dropped.

Given bug 1388723, reported in early August 2017, I doubt there is anything in the range that caused it. That said, I did some (heavy) refactoring in bug 1340972.

We need to keep an eye on it and of course, like always, get a reproducible case ;-)

Comment 5

[Frederic Bezies]

(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #3)
[...]
> 
> And is Fred's crash report a match to this new regression, or only to the
> older bug 1388723
> 
> Fred, do you have other crash?   I find only one report.

Nope. No other reports or crash. After the first one, I downgraded my local thunderbird installation...

Comment 7

[Wayne Mery (:wsmwk)]

There was a big spike for nightly build 20170920030209 which lasted a few days and, judging by install dates, hit many users. But  then was mostly gone. 

That said, there are still rare nightly crashes, including two from Thomas on 10-12
bp-b98c9765-a9ef-4ccb-ad5a-884dd0171012
bp-50ac2215-18d6-49ff-8517-c642b0171012 

[1] https://crash-stats.mozilla.com/signature/?product=Thunderbird&signature=mozilla%3A%3Amailnews%3A%3AEncodedHeader&date=%3E%3D2017-09-01T00%3A56%3A00.000Z&date=%3C2017-10-24T00%3A56%3A19.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=install_time&_columns=email&_sort=-date&page=2

Comment 8

[Wayne Mery (:wsmwk)]

Turns out all linux crashes are Thomas.

Comment 9

[Wayne Mery (:wsmwk)]

still rare
bp-c69c178e-9609-4b0c-8954-47ca40181015 60.2.1

Comment 10

[Wayne Mery (:wsmwk)]

bp-16cdc973-7afb-4194-97a9-1507e0181115 60.3.0
0	xul.dll	mozilla::mailnews::EncodedHeader(nsTSubstring<char> const&, char const*)	comm/mailnews/mime/src/MimeHeaderParser.cpp:100
1	xul.dll	nsMsgDBView::FetchAuthor(nsIMsgDBHdr*, nsTSubstring<char16_t>&)	comm/mailnews/base/src/nsMsgDBView.cpp:414
2	xul.dll	nsMsgDBView::CellTextForColumn(int, char16_t const*, nsTSubstring<char16_t>&)	comm/mailnews/base/src/nsMsgDBView.cpp:2226
3	xul.dll	nsMsgGroupView::CellTextForColumn(int, char16_t const*, nsTSubstring<char16_t>&)	comm/mailnews/base/src/nsMsgGroupView.cpp:1027
4	xul.dll	nsMsgDBView::GetCellText(int, nsITreeColumn*, nsTSubstring<char16_t>&)	comm/mailnews/base/src/nsMsgDBView.cpp:2178
5	xul.dll	nsTreeBodyFrame::PaintText(int, nsTreeColumn*, nsRect const&, nsPresContext*, gfxContext&, nsRect const&, int&)	layout/xul/tree/nsTreeBodyFrame.cpp:3718
6	xul.dll	nsTreeBodyFrame::PaintCell(int, nsTreeColumn*, nsRect const&, nsPresContext*, gfxContext&, nsRect const&, int&, nsPoint, nsDisplayListBuilder*)	layout/xul/tree/nsTreeBodyFrame.cpp:3402
7	xul.dll	nsTreeBodyFrame::PaintRow(int, nsRect const&, nsPresContext*, gfxContext&, nsRect const&, nsPoint, nsDisplayListBuilder*)	layout/xul/tree/nsTreeBodyFrame.cpp:3163

https://hg.mozilla.org/releases/comm-esr60/annotate/tip/mailnews/base/src/nsMsgDBView.cpp#l414
409   nsCString headerCharset;
410   aHdr->GetEffectiveCharset(headerCharset);
411
412   nsCString emailAddress;
413   nsString name;
414   ExtractFirstAddress(EncodedHeader(author, headerCharset.get()),
415                       name,
416                       emailAddress);

https://hg.mozilla.org/releases/comm-esr60/annotate/tip/mailnews/mime/src/MimeHeaderParser.cpp#l100
(last touched by bug 1177702?)
97  nsCOMPtr<nsIMsgHeaderParser> headerParser(services::GetHeaderParser());
98  msgIAddressObject **addresses = nullptr;
99  uint32_t length;
100 nsresult rv = headerParser->ParseEncodedHeader(aHeader, aCharset,
101     false, &length, &addresses);
102 MOZ_ASSERT(NS_SUCCEEDED(rv), "This should never fail!");

Comment 11

[Jorg K (CEST = GMT+2)]

Attachment: 1401858-mimeparser-crash.patch

No idea why that would ever be returned as null.

Comment 12

[Magnus Melin [:mkmelin]]

Comment on attachment 9027406 [details] [diff] [review]
1401858-mimeparser-crash.patch

Review of attachment 9027406 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah no idea, but shouldn't hurt to check. r=mkmelin

Comment 13

[Jorg K (CEST = GMT+2)]

Startup crash, maybe something isn't quite initialised yet.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/269065e13f69
add null check to avoid crash in EncodedHeader()/DecodedHeader(). r=mkmelin

Comment 15

[Jorg K (CEST = GMT+2)]

Comment on attachment 9027406 [details] [diff] [review]
1401858-mimeparser-crash.patch

Harmless null check that will avoid a crash.

Comment 16

[Jorg K (CEST = GMT+2)]

TB 60.3.2 ESR:
https://hg.mozilla.org/releases/comm-esr60/rev/879f355b920c29492bf3867c7406df174d26f08b

Comment 17

[Jorg K (CEST = GMT+2)]

Beta (TB 60 beta 4):
https://hg.mozilla.org/releases/comm-beta/rev/acbb511ca378e68243236d413f2040be83f7efac

Comment 18

[Jorg K (CEST = GMT+2)]

Beta (TB 64 beta 4):
https://hg.mozilla.org/releases/comm-beta/rev/acbb511ca378e68243236d413f2040be83f7efac