Open Bug 1664356 Opened 4 years ago Updated 2 years ago

Crash in [@ memcmp | mozilla::detail::nsTStringRepr<T>::Compare<T> | nsUConvPropertySearch::SearchPropertyValue] via libmime

Categories

(MailNews Core :: MIME, defect)

x86
Windows 10
defect

Tracking

(thunderbird_esr68 unaffected, thunderbird_esr78+ affected)

Tracking Status
thunderbird_esr68 --- unaffected
thunderbird_esr78 + affected

People

(Reporter: wsmwk, Unassigned)

References

Details

(Keywords: crash, Whiteboard: [rare])

Crash Data

Attachments

(1 file)

#50 crash for 78.2.1.
First appears in 78.1.0 bp-78c4a590-6b0f-466e-ac34-e57b30200804

Crash report: https://crash-stats.mozilla.org/report/index/df65e4c4-8759-46f4-bfec-952200200910

Top 10 frames of crashing thread:

0 vcruntime140.dll memcmp 
1 xul.dll mozilla::detail::nsTStringRepr<char>::Compare<char, void> const xpcom/string/nsStringObsolete.cpp:886
2 xul.dll static nsUConvPropertySearch::SearchPropertyValue intl/locale/nsUConvPropertySearch.cpp:30
3 xul.dll static nsCharsetAlias::GetPreferredInternal comm/mailnews/intl/nsCharsetAlias.cpp:32
4 xul.dll static nsCharsetAlias::GetPreferred comm/mailnews/intl/nsCharsetAlias.cpp:50
5 xul.dll nsCharsetConverterManager::GetCharsetAlias comm/mailnews/intl/nsCharsetConverterManager.cpp:110
6 xul.dll ConvertToUTF8 comm/mailnews/mime/src/mimemoz2.cpp:769
7 xul.dll MimeInlineText_convert_and_parse_line comm/mailnews/mime/src/mimetext.cpp:325
8 xul.dll MimeInlineText_rotate_convert_and_parse_line comm/mailnews/mime/src/mimetext.cpp:451
9 xul.dll mime_LineBuffer comm/mailnews/mime/src/mimebuf.cpp:206
Flags: needinfo?(mkmelin+mozilla)

I don't see anything obvious. Best I could tell, we're somehow passing down something bad from libmime.

Flags: needinfo?(mkmelin+mozilla)

Currently ranked not even in the top 100.
Most crashes I have viewed do not have any addons.

Severity: S2 → S3
Component: General → MIME
Product: Thunderbird → MailNews Core
Summary: Crash in [@ memcmp | mozilla::detail::nsTStringRepr<T>::Compare<T> | nsUConvPropertySearch::SearchPropertyValue] → Crash in [@ memcmp | mozilla::detail::nsTStringRepr<T>::Compare<T> | nsUConvPropertySearch::SearchPropertyValue] via libmime

bp-f70b9efb-9db8-4380-8c46-862610210630 78.11.0
0 @0xca8d context
1 xul.dll static nsUConvPropertySearch::SearchPropertyValue(nsUConvProp const*, int, nsTSubstring<char> const&, nsTSubstring<char>&) intl/locale/nsUConvPropertySearch.cpp:30 frame_pointer
2 xul.dll static nsCharsetAlias::GetPreferredInternal(nsTSubstring<char> const&, nsTSubstring<char>&) comm/mailnews/intl/nsCharsetAlias.cpp:32 cfi
3 xul.dll static nsCharsetAlias::GetPreferred(nsTSubstring<char> const&, nsTSubstring<char>&) comm/mailnews/intl/nsCharsetAlias.cpp:50 cfi
4 xul.dll nsCharsetConverterManager::GetCharsetAlias(char const*, nsTSubstring<char>&) comm/mailnews/intl/nsCharsetConverterManager.cpp:110 cfi
5 xul.dll ConvertToUTF8(char const*, int, char const*, nsTSubstring<char>&) comm/mailnews/mime/src/mimemoz2.cpp:769 cfi
6 xul.dll MimeInlineText_convert_and_parse_line(char*, int, MimeObject*) comm/mailnews/mime/src/mimetext.cpp:325 cfi
7 xul.dll MimeInlineText_rotate_convert_and_parse_line(char*, int, MimeObject*) comm/mailnews/mime/src/mimetext.cpp:451 cfi
8 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*) comm/mailnews/mime/src/mimebuf.cpp:205 cfi
9 xul.dll MimeInlineText_parse_decoded_buffer(char const*, int, MimeObject*) comm/mailnews/mime/src/mimetext.cpp:285 cfi
10 xul.dll MimeLeaf_parse_buffer(char const*, int, MimeObject*) comm/mailnews/mime/src/mimeleaf.cpp:142 cfi
11 xul.dll MimeMultipart_parse_child_line(MimeObject*, char const*, int, bool) comm/mailnews/mime/src/mimemult.cpp:596 cfi
12 xul.dll MimeMultipart_parse_line(char const*, int, MimeObject*) comm/mailnews/mime/src/mimemult.cpp:294 cfi
13 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*) comm/mailnews/mime/src/mimebuf.cpp:205 cfi
14 xul.dll MimeObject_parse_buffer(char const*, int, MimeObject*) comm/mailnews/mime/src/mimeobj.cpp:223 cfi
15 xul.dll MimeMessage_parse_line(char const*, int, MimeObject*) comm/mailnews/mime/src/mimemsg.cpp:179 cfi
16 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*) comm/mailnews/mime/src/mimebuf.cpp:205 cfi
17 xul.dll MimeObject_parse_buffer(char const*, int, MimeObject*) comm/mailnews/mime/src/mimeobj.cpp:223 cfi

Severity: S3 → S4
Crash Signature: [@ memcmp | mozilla::detail::nsTStringRepr<T>::Compare<T> | nsUConvPropertySearch::SearchPropertyValue] → [@ memcmp | mozilla::detail::nsTStringRepr<T>::Compare<T> | nsUConvPropertySearch::SearchPropertyValue] [@ nsUConvPropertySearch::SearchPropertyValue ]
Whiteboard: [rare]
Version: unspecified → 68

91.2.0 bp-01a7fce6-ec3f-4427-b51c-1e2850211022 memcmp | mozilla::detail::nsTStringRepr<T>::Compare<T> | nsUConvPropertySearch::SearchPropertyValue
0 vcruntime140.dll memcmp(void const*, void const*, unsigned int)
1 xul.dll mozilla::detail::nsTStringRepr<char>::Compare<char, void>(char const*, bool, int) const
2 xul.dll static nsUConvPropertySearch::SearchPropertyValue(nsUConvProp const*, int, nsTSubstring<char> const&, nsTSubstring<char>&)
3 xul.dll static nsCharsetAlias::GetPreferredInternal(nsTSubstring<char> const&, nsTSubstring<char>&)
4 xul.dll static nsCharsetAlias::GetPreferred(nsTSubstring<char> const&, nsTSubstring<char>&)
5 xul.dll nsCharsetConverterManager::GetCharsetAlias(char const*, nsTSubstring<char>&)
6 xul.dll ConvertToUTF8(char const*, int, char const*, nsTSubstring<char>&)
7 xul.dll MimeInlineText_convert_and_parse_line(char*, int, MimeObject*)
8 xul.dll MimeInlineText_rotate_convert_and_parse_line(char*, int, MimeObject*)
9 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*)
10 xul.dll MimeInlineText_parse_decoded_buffer(char const*, int, MimeObject*)
11 xul.dll MimeLeaf_parse_buffer(char const*, int, MimeObject*)
12 xul.dll MimeMultipart_parse_child_line(MimeObject*, char const*, int, bool)
13 xul.dll MimeMultipart_parse_line(char const*, int, MimeObject*)
14 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*)
15 xul.dll MimeObject_parse_buffer(char const*, int, MimeObject*)
16 xul.dll MimeMessage_parse_line(char const*, int, MimeObject*)
17 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*)
18 xul.dll MimeObject_parse_buffer(char const*, int, MimeObject*)
19 xul.dll mime_display_stream_write(_nsMIMESession*, char const*, int)
20 xul.dll nsStreamConverter::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long long, unsigned int)
21 xul.dll nsMailboxProtocol::ReadMessageResponse(nsIInputStream*, unsigned long long, unsigned int)
22 xul.dll nsMailboxProtocol::ProcessProtocolState(nsIURI*, nsIInputStream*, unsigned long long, unsigned int)
23 xul.dll nsMsgProtocol::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long long, unsigned int)
24 xul.dll nsInputStreamPump::OnStateTransfer()
25 xul.dll nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)
26 xul.dll mozilla::SlicedInputStream::OnInputStreamReady(nsIAsyncInputStream*)
27 xul.dll nsInputStreamReadyEvent::Run()
28 xul.dll mozilla::RunnableTask::Run()
29 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
30 xul.dll mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
31 xul.dll mozilla::TaskController::ProcessPendingMTTask(bool)
32 xul.dll mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:135:7'>::Run()

nsUConvPropertySearch::SearchPropertyValue - no recent crashes

Attached image image.png

Strong crash at the time that crash-stats stopped accepting Thunderbird crashes, due to a sudden increase in memcmp | mozilla::detail::nsTStringRepr<T>::Compare<T> (comment 4)

(In reply to Wayne Mery (:wsmwk) from comment #5)

Created attachment 9255647 [details]
image.png

Strong crash at the time that crash-stats stopped accepting Thunderbird crashes, due to a sudden increase in memcmp | mozilla::detail::nsTStringRepr<T>::Compare<T> (comment 4)

In fact a strong spike just in 91.3.0 buildid 20211101223011 https://crash-stats.mozilla.org/signature/?signature=memcmp%20%7C%20mozilla%3A%3Adetail%3A%3AnsTStringRepr%3CT%3E%3A%3ACompare%3CT%3E%20%7C%20nsUConvPropertySearch%3A%3ASearchPropertyValue&date=%3E%3D2021-10-08T16%3A20%3A00.000Z&date=%3C2022-01-08T16%3A20%3A00.000Z#graphs - all crashes from different users (so not a small set of users), and all with crash address 0x00000001

bp-0012db60-734d-48f8-8509-f5a380211104
0 vcruntime140.dll memcmp(void const*, void const*, unsigned int)
1 xul.dll mozilla::detail::nsTStringRepr<char>::Compare<char, void>(char const*, bool, int) const xpcom/string/nsStringObsolete.cpp:890
2 xul.dll static nsUConvPropertySearch::SearchPropertyValue(nsUConvProp const*, int, nsTSubstring<char> const&, nsTSubstring<char>&) intl/locale/nsUConvPropertySearch.cpp:30
3 xul.dll static nsCharsetAlias::GetPreferredInternal(nsTSubstring<char> const&, nsTSubstring<char>&) comm/mailnews/intl/nsCharsetAlias.cpp:32
4 xul.dll static nsCharsetAlias::GetPreferred(nsTSubstring<char> const&, nsTSubstring<char>&) comm/mailnews/intl/nsCharsetAlias.cpp:50
5 xul.dll nsCharsetConverterManager::GetCharsetAlias(char const*, nsTSubstring<char>&) comm/mailnews/intl/nsCharsetConverterManager.cpp:110
6 xul.dll ConvertToUTF8(char const*, int, char const*, nsTSubstring<char>&) comm/mailnews/mime/src/mimemoz2.cpp:779
7 xul.dll MimeInlineText_convert_and_parse_line(char*, int, MimeObject*) comm/mailnews/mime/src/mimetext.cpp:311
8 xul.dll MimeInlineText_rotate_convert_and_parse_line(char*, int, MimeObject*) comm/mailnews/mime/src/mimetext.cpp:437
9 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*) comm/mailnews/mime/src/mimebuf.cpp:205
10 xul.dll MimeInlineText_parse_decoded_buffer(char const*, int, MimeObject*) comm/mailnews/mime/src/mimetext.cpp:271
11 xul.dll MimeDecoderWrite(MimeDecoderData*, char const*, int, int*) comm/mailnews/mime/src/mimeenc.cpp:753
12 xul.dll MimeLeaf_parse_buffer(char const*, int, MimeObject*) comm/mailnews/mime/src/mimeleaf.cpp:139
13 xul.dll MimeMultipart_parse_child_line(MimeObject*, char const*, int, bool) comm/mailnews/mime/src/mimemult.cpp:602
14 xul.dll MimeMultipart_parse_line(char const*, int, MimeObject*) comm/mailnews/mime/src/mimemult.cpp:293
15 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*) comm/mailnews/mime/src/mimebuf.cpp:205
16 xul.dll MimeObject_parse_buffer(char const*, int, MimeObject*) comm/mailnews/mime/src/mimeobj.cpp:223
17 xul.dll MimeMessage_parse_line(char const*, int, MimeObject*) comm/mailnews/mime/src/mimemsg.cpp:174
18 xul.dll mime_LineBuffer(char const*, int, char**, int*, unsigned int*, bool, int ()(char, unsigned int, void*), void*) comm/mailnews/mime/src/mimebuf.cpp:205
19 xul.dll MimeObject_parse_buffer(char const*, int, MimeObject*) comm/mailnews/mime/src/mimeobj.cpp:223
20 xul.dll mime_display_stream_write(_nsMIMESession*, char const*, int) comm/mailnews/mime/src/mimemoz2.cpp:861
21 xul.dll nsStreamConverter::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long long, unsigned int) comm/mailnews/mime/src/nsStreamConverter.cpp:804

Flags: needinfo?(mkmelin+mozilla)

I don't think we have much to go on here.

Flags: needinfo?(mkmelin+mozilla)
See Also: → 1776633
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: