1735508 - Crashes during autocomplete when entering group alias from mac's or Windows contacts. @ mozilla::SegmentedVector<T>::PopLastN @ nsArrayBase::QueryElementAt

Status: RESOLVED FIXED

(Thunderbird :: Message Compose Window, defect, P1)

Description

[Benjamin Grinstein]

Attachment: log.odt Copy pasted content of error console

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Thunderbird/91.2.0

Steps to reproduce:

Entered the name of a "Group" that was defined in Mac OS X Contacts. After typing a few letters into the "To" field a short list of possible completions showed up and I selected the desired one, a Groups defined in contacts. Then hit entered and Thunderbird immediately crashed and the crash report window opened up. This is 100% reproducible

Actual results:

Crashed

Expected results:

?? I should have been able to enter text in Subject and in the body of the email

Comment 1

[Wayne Mery (:wsmwk)]

Perhaps related to bug 1718862 comment 3.

What is your crash ID from Help > More troubleshooting information?

Comment 2

[Benjamin Grinstein]

(In reply to Wayne Mery (:wsmwk) from comment #1)

Perhaps related to bug 1718862 comment 3.

What is your crash ID from Help > More troubleshooting information?
Any of these (I think they were all caused by the same, as I was first stubborn and then just wanted to insure it was reproducible)

ID: bp-a7b4976a-55f1-409e-ba71-5524c0211013 91.2.0
ID: bp-cbc4eb48-a1e6-4d01-8d51-bc9330211013 91.2.0
ID: bp-41e1098c-fd7d-49fb-aa97-4bc5b0211013 91.2.0
ID: bp-cca5cea6-010a-48c5-8bcb-93bc60211013 91.2.0
ID: bp-a7b4976a-55f1-409e-ba71-5524c0211013 91.2.0

Comment 3

[Wayne Mery (:wsmwk)]

All four crashes (the last one is a duplicate of the first) are @ mozilla::SegmentedVector<T>::PopLastN.

The last three all have uptime of only 20 seconds. Are you really getting into compose and providing an alias in the compose field for those crashes?

bp-a7b4976a-55f1-409e-ba71-5524c0211013
0 XUL mozilla::SegmentedVector<nsCOMPtr<nsISupports>, (unsigned long)4096, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) mfbt/SegmentedVector.h:262
1 XUL mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) dom/bindings/BindingUtils.h:2753
2 XUL mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) xpcom/base/CycleCollectedJSRuntime.cpp:1648
3 XUL mozilla::IncrementalFinalizeRunnable::Run() xpcom/base/CycleCollectedJSRuntime.cpp:1685
4 XUL IdleRunnableWrapper::Run() xpcom/threads/nsThreadUtils.cpp:310
5 XUL mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:502
6 XUL mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:805

Comment 4

[Benjamin Grinstein]

(In reply to Wayne Mery (:wsmwk) from comment #3)

All four crashes (the last one is a duplicate of the first) are @ mozilla::SegmentedVector<T>::PopLastN.

The last three all have uptime of only 20 seconds. Are you really getting into compose and providing an alias in the compose field for those crashes?

bp-a7b4976a-55f1-409e-ba71-5524c0211013
0 XUL mozilla::SegmentedVector<nsCOMPtr<nsISupports>, (unsigned long)4096, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) mfbt/SegmentedVector.h:262
1 XUL mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) dom/bindings/BindingUtils.h:2753
2 XUL mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) xpcom/base/CycleCollectedJSRuntime.cpp:1648
3 XUL mozilla::IncrementalFinalizeRunnable::Run() xpcom/base/CycleCollectedJSRuntime.cpp:1685
4 XUL IdleRunnableWrapper::Run() xpcom/threads/nsThreadUtils.cpp:310
5 XUL mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:502
6 XUL mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:805

Yes. I had the crash report dialogue restart Thunderbird and I immediately hit compose, entered the address (the group name) and it crashed. Then I repeated this a few times, as stated. BTW I just tried it with a new group, just to check that it was not somethiung specifically wrong about that Group. It crashed again

Comment 5

[Magnus Melin [:mkmelin]]

I don't have any further input, and no mac to reproduce either.

Comment 6

[Benjamin Grinstein]

Maybe I should add, this is a macbook pro with the M1 chip running Big Sur (OS X 11.6)

Comment 7

[Wayne Mery (:wsmwk)]

This is easily reproduced. I'm on Macbook pro 2016 running 11.6, Thunderbird 94.0b2. But I get a variety of crash signatures:

• ChildFinder::NoteXPCOMChild bp-d8842f33-3f31-4e9d-8a2c-6a6900211014
• mozilla::SegmentedVector<T>::PopLastN bp-e5d4a0a8-a28e-4519-8916-11ef10211014
• XPCConvert::JSObject2NativeInterface bp-e4a3832e-1e0b-4fa5-9cbc-64bf30211014

Did this work for you when using version 78?

Comment 8

[Makoto Kato [:m_kato]]

Although this signature is in cycle collector or gc, if we have the reproduce step, I guess that something thunderbird's XPCOM object will be released/destroyed in non-main thread.

Comment 9

[Benjamin Grinstein]

(In reply to Wayne Mery (:wsmwk) from comment #7)

This is easily reproduced. I'm on Macbook pro 2016 running 11.6, Thunderbird 94.0b2. But I get a variety of crash signatures:

• ChildFinder::NoteXPCOMChild bp-d8842f33-3f31-4e9d-8a2c-6a6900211014
• mozilla::SegmentedVector<T>::PopLastN bp-e5d4a0a8-a28e-4519-8916-11ef10211014
• XPCConvert::JSObject2NativeInterface bp-e4a3832e-1e0b-4fa5-9cbc-64bf30211014

Did this work for you when using version 78?
Crashes only started when I updated to v 91, it worked without a problem previous to that update

While the bug was changed to crashes when "autocomplete", I just checked that it still crashes even when I input the complete group name by hand

Comment 10

[Wayne Mery (:wsmwk)]

I installed 93.0b5 - address lookup for Mac contacts doesn't happen at all. So it's not possible to say whether 93 would crash.

Comment 12

[Magnus Melin [:mkmelin]]

Kai, please have a look

Comment 13

[Kai Engert (:KaiE:)]

I can reproduce using a local esr91 build. I have the full stack. It's crashing while trying to delete elements. The crash suggests that some of the assertions isn't true, but the assertion checks are no-ops in the optimized build.

I will do a local debug build, hopefully this will allow me to find the first time an assertion check fails.

Comment 14

[mactest]

Attachment: stack.txt

Comment 15

[mactest]

Attachment: real-stack.txt

This is the stack of the first crash when running a debug build.

Comment 16

[Kai Engert (:KaiE:)]

I'm guessing we have a pointer to an object from the OS (probably a pointer to an OS address book object), and it's being incorrectly deleted.

Comment 17

[Kai Engert (:KaiE:)]

Does the stack help you to understand what might be wrong?

Comment 18

[Kai Engert (:KaiE:)]

Magnus, I suggest to re-review the past year's patches that touched the implementation for mac OS address books. Maybe that code incorrectly copies a system handle to two different places, causing it to deleted twice.

Comment 19

[Magnus Melin [:mkmelin]]

There's many such patches though... I guess https://hg.mozilla.org/comm-central/log/tip/mailnews/addrbook/src/nsAbOSXDirectory.mm and related files.

Comment 20

[Makoto Kato [:m_kato]]

(In reply to Kai Engert (:KaiE:) from comment #17)

Does the stack help you to understand what might be wrong?

I guess https://searchfox.org/comm-central/rev/0e154d21c2179c0f4cad51fa61bbab20f494dbc2/mailnews/addrbook/src/nsAbDirProperty.cpp#371.

We should use listDir.forget(aResult) instead.

Comment 21

[Kai Engert (:KaiE:)]

(In reply to Makoto Kato [:m_kato] from comment #20)

I guess https://searchfox.org/comm-central/rev/0e154d21c2179c0f4cad51fa61bbab20f494dbc2/mailnews/addrbook/src/nsAbDirProperty.cpp#371.
We should use listDir.forget(aResult) instead.

Thank you very much! With that change, I can no longer reproduce the crash!

Comment 22

[Kai Engert (:KaiE:)]

Attachment: Bug 1735508 - Fix pointer ownership to prevent crash when entering group alias in mac address book. r=mkmelin

Comment 23

[Magnus Melin [:mkmelin]]

Sharp eyes! Many thanks m_kato!

Comment 24

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/aa53cab20da1
Fix pointer ownership to prevent crash when entering group alias in mac address book. r=mkmelin

Comment 25

[Kai Engert (:KaiE:)]

Comment on attachment 9247774 [details]
Bug 1735508 - Fix pointer ownership to prevent crash when entering group alias in mac address book. r=mkmelin

[Approval Request Comment]
Regression caused by (bug #): 1712601
User impact if declined: crash
Testing completed (on c-c, etc.): manual
Risk to taking this patch (and alternatives if risky): very low, obvious fix to avoid duplicate pointer delete

Comment 26

[Rob Lemley [:rjl]]

Comment on attachment 9247774 [details]
Bug 1735508 - Fix pointer ownership to prevent crash when entering group alias in mac address book. r=mkmelin

[Triage Comment]
Crash fix for 94 beta.

Comment 27

[Rob Lemley [:rjl]]

Thunderbird 94.0b5:
https://hg.mozilla.org/releases/comm-beta/rev/9ed35867789f

Comment 28

[Wayne Mery (:wsmwk)]

Comment on attachment 9247774 [details]
Bug 1735508 - Fix pointer ownership to prevent crash when entering group alias in mac address book. r=mkmelin

[Triage Comment]
approved for esr91

It hasn't yet shipped in beta, but the patch is simple, and only impacts Mac AB - i.e. it can't get get much worse for Mac.

Comment 29

[Wayne Mery (:wsmwk)]

We probably want to file another bug report for @ mozilla::SegmentedVector<T>::PopLastN which has reporters using Windows

Comment 30

[Rob Lemley [:rjl]]

Thunderbird 91.3.0:
https://hg.mozilla.org/releases/comm-esr91/rev/51fb6cee4bb1

Comment 31

[Makoto Kato [:m_kato]]

(In reply to Wayne Mery (:wsmwk) from comment #29)

We probably want to file another bug report for @ mozilla::SegmentedVector<T>::PopLastN which has reporters using Windows

If user uses Outlook's address book integration, I guess that same issue may occur on Windows too.

Comment 32

[Eckard Berberich]

I tried to reproduce this issue in TB 91 on my iMac running macOS 10.14.6.
TB didn't crash when I entered the first letters of a list name in my Mac "Contacts" and let autocomplete do its work. TB did not crash when I hit the Tab key to navigate to the text field of the compose window. So I saved the message as a draft in the Drafts folder.
When I edit the saved draft message TB crashes.
Crash IDs
7d278f2f-2e77-40da-a049-e2f5e0211028
1b5f2575-32fe-454c-bbe1-495b30211028

Comment 33

[Magnus Melin [:mkmelin]]

bp-7d278f2f-2e77-40da-a049-e2f5e0211028 -> @ nsArrayBase::QueryElementAt 91.2.1 Mac
bp-1b5f2575-32fe-454c-bbe1-495b30211028 ->@ ChildFinder::NoteXPCOMChild 91.2.1 Mac

Comment 35

[Wayne Mery (:wsmwk)]

We will have to check the results at backtrace to see if the crash rate reduces

Comment 36

[Antony]

Ha, as much as I run a mac, (though not mad on MS stuff either), I do not have contacts in the Mac AB, never use Safri, mail, or any MAc app, much. Bout only app is Finder
I will need to set up contcts and test if still a concern

Comment 37

[Makoto Kato [:m_kato]]

(In reply to Magnus Melin [:mkmelin] from comment #33)

bp-7d278f2f-2e77-40da-a049-e2f5e0211028 -> @ nsArrayBase::QueryElementAt
bp-1b5f2575-32fe-454c-bbe1-495b30211028 ->@ ChildFinder::NoteXPCOMChild

Build id is old (20211020014537), try newer build when newer is released.

Comment 38

[Wayne Mery (:wsmwk)]

Benjamin,
Is the crash gone for you?

Comment 39

[Benjamin Grinstein]

Hi Wayne.
Yes, no more crashes, the bug seems to have been fixed.
Thx