1439271 - Crash in nsMappedAttributes::GetAttr and other random signatures (memory corruption?)

Status: RESOLVED WORKSFORME

(Thunderbird :: General, defect)

Description

[MC]

I keep Thunderbird (52.6.0 (32-bit)) running constantly on my laptop and every now and again it just crashes without me doing anything.  That is, not doing anything with Thunderbird or, indeed, anything on the laptop at all; it's just sitting there and suddenly up pops the crash report dialog.

It seems to happen in bunches, with no problems most of the time but then several such crashes happen in the same day.  Here's the crash reports.  Thanks.

bp-d6b6158a-c336-49b0-beaf-f6aa40180218	2/18/18	9:22 PM
bp-03b5419d-7d52-445f-8779-ea0fe0180218	2/18/18	1:19 PM
bp-d1803070-b8e1-49d6-b8a6-791a40180218	2/18/18	1:07 PM
bp-29f93bcd-9ba6-454b-962e-946920180214	2/14/18	12:02 AM
bp-63720326-38dc-45be-bfaf-c8c810180205	2/5/18	6:53 PM
bp-bfe0ce9a-c1eb-49a3-be41-396300180205	2/5/18	6:19 PM
bp-cbe3569d-4089-4fd4-8c47-905960180205	2/5/18	2:46 PM
bp-8eb30463-aea5-4bd4-a34b-7e5970180129	1/29/18	5:29 PM
bp-e7a517d6-e9ef-4c52-b793-0c3d20180124	1/24/18	12:58 PM
bp-c2bd3ed0-d9e0-4777-832d-91fe20180124	1/24/18	8:12 AM
bp-8c299ab2-0507-4b33-b357-0e86c0180117	1/17/18	10:40 PM
bp-7e336899-298e-4d65-b6bd-0e2380180117	1/17/18	5:44 PM
bp-a8f67e15-23d8-4c0e-9355-4b8340180117	1/17/18	5:32 PM
bp-b6dcef88-0fc3-4495-a3d8-268810180114	1/14/18	10:46 PM
bp-e9fa76e1-0bb0-4163-9ff1-2eaf20180105	1/5/18	11:34 PM
bp-ed2b15d5-7a1e-4bfd-b509-5537b0180105	1/5/18	4:05 PM
bp-2fd2abd0-02c5-4753-8947-8a7ff0180101	1/1/18	9:53 PM
bp-454fb8f3-a197-471a-9389-e13f30171231	12/31/17	8:05 AM
bp-7f8f65f4-37ff-47d6-99e7-de1120171229	12/29/17	8:44 AM
bp-644c7fb4-74a6-4f41-b3d3-a620e0171227	12/27/17	9:14 PM
bp-ae142940-709e-4b78-a64d-46a320171227	12/27/17	7:18 PM
bp-ccdd837a-46ac-4801-a182-106640171222	12/22/17	7:46 PM

-------------------------------------------------------------  

This bug was filed from the Socorro interface and is
report bp-d6b6158a-c336-49b0-beaf-f6aa40180218.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsMappedAttributes::GetAttr dom/base/nsMappedAttributes.cpp:112
1 xul.dll nsAttrAndChildArray::GetAttr dom/base/nsAttrAndChildArray.cpp:313
2 xul.dll nsIContent::DoGetID dom/base/Element.cpp:164
3 xul.dll RuleHash::EnumerateAllRules layout/style/nsCSSRuleProcessor.cpp:618
4 xul.dll nsCSSRuleProcessor::RulesMatching layout/style/nsCSSRuleProcessor.cpp:2552
5 xul.dll EnumRulesMatching<ElementRuleProcessorData> layout/style/nsStyleSet.cpp:804
6 xul.dll nsStyleSet::FileRules layout/style/nsStyleSet.cpp:1128
7 xul.dll nsStyleSet::ResolveStyleFor layout/style/nsStyleSet.cpp:1366
8 xul.dll mozilla::ElementRestyler::RestyleSelf layout/base/RestyleManager.cpp:2872
9 xul.dll mozilla::ElementRestyler::Restyle layout/base/RestyleManager.cpp:2136

=============================================================

Comment 1

[Wayne Mery (:wsmwk)]

You have 9 crash signatures [1] and about 11 add-ons [2].  This suggests the following possibilities.
1. caused by add-on.
2. caused by antivirus or similar software
3. caused by bad memory 

test 
1. https://support.mozilla.org/en-US/kb/safe-mode-thunderbird
2. https://support.microsoft.com/en-us/help/12376/windows-10-start-your-pc-in-safe-mode 
3. https://windowsreport.com/mdsched-exe-windows-10/

Please post your results

[1]
 js::GCMarker::mark<T>   
js::UncheckedUnwrap   h
CCGraphBuilder::NoteXPCOMChild   
JSScript::ensureNonLazyCanonicalFunction   
RtlEnterCriticalSection | PR_Lock | PR_RWLock_Rlock | ssl3_SendClientHello | ssl_BeginClientHandshake | ssl_Do1stHandshake | ssl_SecureRecv | ssl_Recv | PSMRecv   
detail::ProxyReleaseEvent<T>::Run   
js::detail::HashTable<T>::Enum::Enum<T> | js::Shape::fixupShapeTreeAfterMovingGC   
js::detail::HashTable<T>::lookup | js::PropertyTree::getChild  
ntdll.dll@0x2c6b5   

[2] 
[e-mail]	1.0	
{bfa92939-6ded-4a3f-885f-55dfcce728b8}	1.1.2	
[e-mail]	1.1.1	
{6e071e83-d8d6-8ca9-6129-eb8e8144596f}	5.1	
[e-mail]	1.1	
jorgk@thunderHTMLedit	1.8.1	
{532269cf-a10e-4396-8613-b5d9a9a516d4}	5.1	
{58D4392A-842E-11DE-B51A-C7B855D89593}	2.1.4	
{e2fda1a4-762b-4020-b5ad-a41df1933103}	5.4.6	
[e-mail]	3.5.35	
[e-mail]	2.0	
[e-mail]	1.19.3

Comment 2

[MC]

The Memory Diagnostic Tool, mdsched, reports no errors (unsurprisingly, as I'm having no other problems on the system).

TB comes up and works ok in TB safe mode (with Windows running normally), and also comes up and works ok under Windows safe mode in both TB normal and TB safe mode.

However, as the crashes are random and infrequent, with often a week or more between them (or groups of them), I'm not willing to live in safe mode (either in TB and most definitely not in Windows) continuously for a week or two to see what does or doesn't happen, that'd be just too inconvenient.

Re add-ons, as the crashes happen while TB is idle, i.e. without any user interaction, that would imply they occur when TB decides to do something autonomously, i.e. on a timer.  Of the add-ons I've got* I don't believe any of them do anything in the background on timers, other than possibly Lightning, which I've now disabled as I don't use it anyway.  Of course, the crashes could be a second order effect, with an add on corrupting something that TB's timer later hits, however I have exactly the same set of add-ins installed with TB on another PC and don't get any crashes there.

I appreciate that this kind of crash -- random, infrequent and not reproducible on demand -- is difficult to diagnose, and that's why I've held off reporting it for so long, but I'm hoping that now, with a good number of crash dumps filed, someone who knows TB innards might be able to find the cause :-)

BTW, AV is Windows Defender, and the Windows Event Logs show nothing at or near the times of the crashes.

* Allow HTML Temp, CompactHeader, Get/Send-Button, Lightning, Manually Sort Folders, Send Later Button, SortPref, ThunderHTMLedit, Toggle Header, Deselect on Delete, and the theme Phoenity Shredder

Comment 3

[Wayne Mery (:wsmwk)]

> Re add-ons, as the crashes happen while TB is idle, i.e. without any user interaction, that would imply they occur when TB decides to do something autonomously, i.e. on a timer.  

Very little in Thunderbird is done on timers.  But there is much that is simply done in the background.

Comment 4

[MC]

Background tasks don't run in a loop continuously, so for TB to crash when it's been sitting untouched for a while (sometimes a few hours), something must have woken it up.

I can tell you that it's not a new mail (or status change) notification from an IMAP server; I've checked that.

Comment 5

[Wayne Mery (:wsmwk)]

What I mean is, apart from checking for new mail there are not many things done on timers. The fact that there may be no new mail doesn't necessarily have a great impact.

I see you are using yahoo.  Beta has at least one fix for yahoo.  Suggest you try it from http://www.mozilla.org/en-US/thunderbird/channel/

Comment 6

[MC]

Actually I don't usually use Yahoo, I've just revived an old dormant Yahoo account for Bugzilla (as it reveals the email address to the world...)

Comment 7

[Wayne Mery (:wsmwk)]

I see you continue to have crashes.

89d80c34-8de2-4b85-a8a6-5d5b90180318	2018-03-18 01:33:08 	js::ShapeTable::searchUnchecked<T>   Add term
10f14473-91b7-46d5-a0e0-d076c0180317	2018-03-17 16:08:23 	nsNSSSocketInfo::SetNotificationCallbacks   Add term
21a570fc-ae48-455c-8466-c1f490180317	2018-03-17 08:49:45 	detail::ProxyReleaseEvent<T>::Run   Add term
216e99ac-79b6-474b-afd3-6da1e0180316	2018-03-16 12:14:20 	detail::ProxyReleaseEvent<T>::Run   Add term
ea95334d-9ef6-4b43-b12e-058590180315	2018-03-15 01:31:24 	mozilla::EventListenerManager::Listener::~Listener   Add term
5cb1b590-af81-41fc-a91e-9a4330180314	2018-03-14 00:50:54 	js::GCMarker::mark<T>   Add term
6a9a34f5-fa37-4afc-9b0a-1b1c20180313	2018-03-13 19:15:42 	XPCWrappedNative::SweepTearOffs   Add term
6e0a4b45-5ec2-4416-8d14-25b8c0180313	2018-03-13 16:56:03 	PLDHashTable::Add | nsBaseHashtable<T>::Put | nsBaseHashtable<T>::Put | mozilla::image::CopyOnWrite<T>::Write<T>   Add term
c39507d1-cb2b-420d-bb44-457060180311	2018-03-11 19:04:49 	memcpy | NS_CopySegmentToBuffer   Add term
83de1276-5a02-4cef-b999-029940180302	2018-03-02 21:10:43 	js::GCMarker::mark<T>   Add term 

Again, Beta has at least one fix for yahoo.  

Can you try it from http://www.mozilla.org/en-US/thunderbird/channel/ ?

Comment 8

[Wayne Mery (:wsmwk)]

only a couple crashes in the past month. Thanks much less frequent.
bp-3b007768-fc8c-421a-a790-b37170180421
bp-d38cb785-f0e5-4f2a-b02e-1133b0180406

Comment 10

[Wayne Mery (:wsmwk)]

MC seems to be gone.
This isn't actionable without additional information, like steps to reproduce

Comment 11

[MC]

I'm still here, I just, as I explained earlier, don't normally use the Yahoo a/c you sent your message to.

There's no additional information I can give and it's not on-demand reproducible.  As I've already explained, it just randomly, sometimes weeks apart, suddenly pops up the crash report dialog when I'm not doing anything, either with Thunderbird or on the laptop at all.

Only one crash since updated to 52.8.0 but that could just be luck of the random draw...

Comment 12

[Wayne Mery (:wsmwk)]

But again, this isn't actionable.  It's just general random corruption. And in addition likely better covered under some other bug report. 

Until it becomes reproducible, or happens to other people we don't want to be watching it as an open bug, but you can continue reporting better info and crashes.

Comment 13

[MC]

LOL! Well whether you like watching it as an open bug or not it's still A BUG somewhere, and one which results in *crashes*, and is hardly "resolved" just 'cos it's not "actionable".

If you feel it's better covered under some other bug report feel free to move it/link it/whatever to another report.

Comment 14

[Patrick Brunschwig]

I got several reports that this happens when clicking on the Enigmail menu in the composer window.
https://sourceforge.net/p/enigmail/bugs/961/

Comment 16

[MC]

I don't use Enigmail.

Comment 17

[Wayne Mery (:wsmwk)]

MC, do you still crash?

From the current selection of crash reports I selected 6 and none have enigmail installed. And there are only two 68.x crashes in past 3 months, so I'm inclined to close this bug as reolution WFM.

Comment 18

[MC]

No, very few crashes in the last year, and none related to this, so close it. I'm several upgrades on now anyway (now on 68.4.2).