1447370 - Thunderbird crashes with random signature at address 0xffffffffa4000265 and 0x6c696175

Status: RESOLVED DUPLICATE of bug 1439271

(Thunderbird :: Untriaged, defect)

Description

[tcl_de]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Build ID: 20180315233128

Steps to reproduce:

Thunderbird is running in the background.


Actual results:

Thunderbird crashes every once in a while. Recently I started in Windbg and set up the  Microsoft and Mozilla symbol servers. It crashes at
(1a9c.19bc): Access violation - code c0000005 (!!! second chance !!!)
xul!detail::ProxyReleaseEvent<mozilla::mscom::WeakReferenceSupport>::Run+0x11:
52f7d52e ff5008          call    dword ptr [eax+8]    ds:002b:6c696175=????????

!analyze -v says
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Failed calling InternetOpenUrl, GLE=12029

FAULTING_IP: 
xul!detail::ProxyReleaseEvent<mozilla::mscom::WeakReferenceSupport>::Run+11 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\objdir-tb\dist\include\nsproxyrelease.h @ 36]
52f7d52e ff5008          call    dword ptr [eax+8]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0000000052f7d52e (xul!detail::ProxyReleaseEvent<mozilla::mscom::WeakReferenceSupport>::Run+0x0000000000000011)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000000006c696175
Attempt to read from address 000000006c696175

FAULTING_THREAD:  00000000000019bc

PROCESS_NAME:  thunderbird.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000000006c696175

READ_ADDRESS:  000000006c696175 

FOLLOWUP_IP: 
xul!detail::ProxyReleaseEvent<mozilla::mscom::WeakReferenceSupport>::Run+11 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\objdir-tb\dist\include\nsproxyrelease.h @ 36]
52f7d52e ff5008          call    dword ptr [eax+8]

MOD_LIST: <ANALYSIS/>

APPLICATION_VERIFIER_FLAGS:  0

BUGCHECK_STR:  APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_READ_ZEROED_STACK

PRIMARY_PROBLEM_CLASS:  STRING_DEREFERENCE

DEFAULT_BUCKET_ID:  STRING_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 0000000052bd7740 to 0000000052f7d52e

STACK_TEXT:  
0040f734 52bd7740 0cccfa50 007680c0 00747130 xul!detail::ProxyReleaseEvent<mozilla::mscom::WeakReferenceSupport>::Run+0x11 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\objdir-tb\dist\include\nsproxyrelease.h @ 36]
0040f7a4 52bec739 00745160 00000000 0040f7c3 xul!nsThread::ProcessNextEvent+0x224 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\xpcom\threads\nsthread.cpp @ 1216]
0040f7b8 52e64c5e 01745160 00000000 007680c0 xul!NS_ProcessNextEvent+0x26 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\xpcom\glue\nsthreadutils.cpp @ 361]
0040f7e4 52e539f8 007680c0 5e749fd8 090f0350 xul!mozilla::ipc::MessagePump::Run+0x153 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\ipc\glue\messagepump.cpp @ 96]
0040f81c 52e537e9 00745160 00000001 52e4c100 xul!MessageLoop::RunHandler+0x53 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\ipc\chromium\src\base\message_loop.cc @ 226]
0040f83c 53b0b4df 090f1a40 00000000 0040f85c xul!MessageLoop::Run+0x19 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\ipc\chromium\src\base\message_loop.cc @ 206]
0040f84c 53b4fa3e 090f0350 090f1a40 0040f870 xul!nsBaseAppShell::Run+0x2c [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\widget\nsbaseappshell.cpp @ 158]
0040f85c 54053fab 090f0350 0040fa88 00747250 xul!nsAppShell::Run+0x1f [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\widget\windows\nsappshell.cpp @ 270]
0040f870 5409418d 090f1a40 0071d340 0040fa88 xul!nsAppStartup::Run+0x22 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\toolkit\components\startup\nsappstartup.cpp @ 284]
0040fa4c 54092760 0071d2e0 0040fbb0 00000001 xul!XREMain::XRE_mainRun+0xa47 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\toolkit\xre\nsapprunner.cpp @ 4488]
0040fa70 540949fb 00000000 00701050 0071d340 xul!XREMain::XRE_main+0x175 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\toolkit\xre\nsapprunner.cpp @ 4621]
0040fb8c 01321972 00000001 00701050 0040fbb0 xul!XRE_main+0x34 [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\toolkit\xre\nsapprunner.cpp @ 4712]
0040fd20 0132145f 00000001 00701050 0018e690 thunderbird!do_main+0x32b [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mail\app\nsmailapp.cpp @ 245]
0040fd7c 01321c88 00000001 00701050 0018e690 thunderbird!NS_internal_main+0xba [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mail\app\nsmailapp.cpp @ 378]
0040fdbc 0133d4cf 00000001 ffa8e0a0 00191c78 thunderbird!wmain+0x12b [c:\builds\moz2_slave\tb-rel-c-esr52-w32_bld-0000000\build\mozilla\toolkit\xre\nswindowswmain.cpp @ 118]
0040fe04 76d7343d fffde000 0040fe50 77a39832 thunderbird!__scrt_common_main_seh+0xf9 [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 253]
0040fe10 77a39832 fffde000 77f53caa 00000000 kernel32!BaseThreadInitThunk+0xe
0040fe50 77a39805 0133d545 fffde000 00000000 ntdll32!__RtlUserThreadStart+0x70
0040fe68 00000000 0133d545 fffde000 00000000 ntdll32!_RtlUserThreadStart+0x1b


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  xul!detail::ProxyReleaseEvent<mozilla::mscom::WeakReferenceSupport>::Run+11

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: xul

IMAGE_NAME:  xul.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5a68575e

STACK_COMMAND:  ~0s ; kb

FAILURE_BUCKET_ID:  STRING_DEREFERENCE_c0000005_xul.dll!detail::ProxyReleaseEvent_mozilla::mscom::WeakReferenceSupport_::Run

BUCKET_ID:  X64_APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_READ_ZEROED_STACK_xul!detail::ProxyReleaseEvent_mozilla::mscom::WeakReferenceSupport_::Run+11

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/thunderbird_exe/52_6_0_6597/5a685617/xul_dll/52_6_0_6597/5a68575e/c0000005/006ed52e.htm?Retriage=1

Followup: MachineOwner
---------


Expected results:

No crash

Comment 1

[Wayne Mery (:wsmwk)]

Did you previously not get any mozilla crash reports, with crash IDs?  https://support.mozilla.org/en-US/kb/mozilla-crash-reporter-tb

What types of things are you doing when it crashes?

What addons do you have installed?

Comment 2

[tcl_de]

Oh nice, I didn't know about the crash IDs. My IDs from this year are:
bp-2e3e124b-a02d-4475-b202-380b70180309
bp-6b73964d-27a4-4239-a1f5-493c10180306
bp-1887943a-d285-4ca3-92fb-546610180226
bp-00d97a7d-b41f-49b0-ab4d-8d6b30180222
bp-a0710f35-c069-44dd-bedb-559b60180218
bp-62790d2b-54ae-4790-a358-ac9eb0180208
bp-57734414-d06f-4130-bb0b-a36bc0180127
bp-3627d2e8-9b02-455d-afb9-56bc20180124
bp-600a8beb-c964-4cad-9b06-bc6a00180107
bp-0dc78301-f4e0-42e3-81e5-9f0030180106

I think usually it happens when I am browsing in Firefox while Thunderbird is running in the background.
The installed addons are:
Enigmail	1.9.9	enabled	{847b3a00-7ab1-11d4-8f02-006008948af5}
Lightning	5.4.6	enabled	{e2fda1a4-762b-4020-b5ad-a41df1933103}
Change quote and reply format	0.8.7.1	disabled	{f6090211-2004-44d8-9090-be3c2adfd66f}

Comment 3

[Wayne Mery (:wsmwk)]

Your crash signatures are all over the map - which is consistent with memory corruption or interference from outside sources like antivirus software.  Which AV software do you use?  And have you run memory tests?

Sampling:
* nsMsgDatabase::GetHdrFromUseCache  bp-2e3e124b-a02d-4475-b202-380b70180309 Bug 617073
* mozilla::net::nsSocketTransport::InitiateSocket  bp-6b73964d-27a4-4239-a1f5-493c10180306
* mozilla::ipc::MessagePump::Run  bp-00d97a7d-b41f-49b0-ab4d-8d6b30180222 Bug 1439074
* CanonicalizeParticipant  bp-a0710f35-c069-44dd-bedb-559b60180218 
* memcpy | NS_CopySegmentToBuffer  bp-62790d2b-54ae-4790-a358-ac9eb0180208
* js::GCMarker::mark<T>  bp-5cb1b590-af81-41fc-a91e-9a4330180314
* nsCSSValue::Array::Release  bp-3627d2e8-9b02-455d-afb9-56bc20180124
* nsNSSSocketInfo::SetNotificationCallbacks  bp-0dc78301-f4e0-42e3-81e5-9f0030180106
* detail::ProxyReleaseEvent<T>::Run  bp-600a8beb-c964-4cad-9b06-bc6a00180107 (perhaps the most prevalent)

Examples of the last:
bp-5ef71eda-9aef-44cd-bf60-d89a40180312 (chuck)
bp-21a570fc-ae48-455c-8466-c1f490180317 (mc09)

Comment 4

[Wayne Mery (:wsmwk)]

Also, can you try the beta from http://www.mozilla.org/en-US/thunderbird/channel/ ?

Comment 5

[tcl_de]

I checked my crash IDs again. The first crash occurred on 28 Nov 2017, which is a few days after I upgraded to 52.5.0 on 25 Nov 2017. The ID is bp-b393ce34-0646-42c6-a5b0-8b4630171128 which does not seem to be available any more. Before that I haven't had any crash in 3 years.

I was also thinking of memory corruption and ran memtest86+ a few weeks ago without finding any errors. 
Actually I don't have any AV software installed.
I will let you know when I know more about other versions (not) crashing.

Comment 6

[tcl_de]

The past few days I was running the comm-esr52 20171102 nightly, as I found it interesting to try an old version, but it also crashed: bp-59e7309a-a420-4ebc-93ff-f11530180327

When I try the beta, can I still use my profile when I go back to version 52? I remember that with Firefox there is some incompatibility.

Comment 7

[Wayne Mery (:wsmwk)]

(In reply to tcl_de from comment #6)
> The past few days I was running the comm-esr52 20171102 nightly, as I found
> it interesting to try an old version, but it also crashed:
> bp-59e7309a-a420-4ebc-93ff-f11530180327

perhaps related to bug 1444378 -- Crash in detail::ProxyReleaseEvent<T>::Run

> When I try the beta, can I still use my profile when I go back to version 52?

yes

Comment 8

[tcl_de]

Thunderbird 60.0b3 also just crashed. Please have a look at bp-7e2556ec-b0f4-49d0-a077-a992c0180420 . 
Are there some memory corruption debugging features I could turn on ?

Comment 9

[Wayne Mery (:wsmwk)]

> Are there some memory corruption debugging features I could turn on ?
no

What add-on do you have installed that is at version 2.0.2?

Comment 10

[tcl_de]

(In reply to Wayne Mery (:wsmwk) from comment #9)
> > Are there some memory corruption debugging features I could turn on ?
> no
> 
> What add-on do you have installed that is at version 2.0.2?

It's Enigmail, which has been updated from 1.9.9 to 2.0.2 in the meantime.

Comment 11

[Wayne Mery (:wsmwk)]

Most of the addresses are 0xffffffffa4000265 and 0x6c696175.
And I suspect your issue will end up being the same as bug 1439271, so let's combine into that bug. (If they end up not being the same we can always undup)