1743138 - Startup crash in [@ nsMsgAttachmentData::~nsMsgAttachmentData]

Status: RESOLVED WORKSFORME

(Thunderbird :: General, defect)

Description

[Wayne Mery (:wsmwk)]

95 beta has these crash reports up to the day when crash-stats stopped accepting them. The first crash appears in the vicinity of buildid 20211103010303 bp-de99b52c-2362-4e3a-92bd-584810211109.

Unclear whether this is a regression, or just another example of imap threading?

Crash report: https://crash-stats.mozilla.org/report/index/4a551aa0-1dce-4892-ac9e-4ddc50211108

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll nsMsgAttachmentData::~nsMsgAttachmentData comm/mailnews/compose/src/nsMsgAttachmentData.cpp:18
1 xul.dll mime_display_stream_complete comm/mailnews/mime/src/mimemoz2.cpp:889
2 xul.dll nsStreamConverter::OnStopRequest comm/mailnews/mime/src/nsStreamConverter.cpp:914
3 xul.dll nsImapCacheStreamListener::OnStopRequest comm/mailnews/imap/src/nsImapProtocol.cpp:8907
4 xul.dll nsInputStreamPump::OnStateStop netwerk/base/nsInputStreamPump.cpp:636
5 xul.dll nsInputStreamPump::OnInputStreamReady netwerk/base/nsInputStreamPump.cpp:381
6 xul.dll nsInputStreamReadyEvent::Run xpcom/io/nsStreamUtils.cpp:94
7 xul.dll mozilla::RunnableTask::Run xpcom/threads/TaskController.cpp:468
8 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:771
9 xul.dll mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:607

Comment 1

[Magnus Melin [:mkmelin]]

Idk. Shouldn't be able to crash: https://searchfox.org/comm-central/rev/fad3678a02e392e8a80f942eeed46d6a789d826e/mailnews/compose/src/nsMsgAttachmentData.cpp#18

Comment 2

[sfhowes]

OS X case: https://support.mozilla.org/en-US/questions/1359535

Comment 3

[Wayne Mery (:wsmwk)]

(In reply to sfhowes from comment #2)

OS X case: https://support.mozilla.org/en-US/questions/1359535

Thanks Steve. We will want to get a testcase/steps from the reporter.

Comment 4

[Wayne Mery (:wsmwk)]

#6 crash for 95 beta.

And in the time period of version 95 mangled messages https://mzl.la/3E1Dw8X

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to sfhowes from comment #2)

OS X case: https://support.mozilla.org/en-US/questions/1359535

I have pinged the reporter to get more information.

Mitra in bug 1748119 also crashes, and comments " this also happens when I'm doing nothing".

Comment 6

[Christian Riechers]

I've got more of these crashes. This started with TB 96.0 beta4.
bp-315c71f1-316f-4c18-826e-66b061220111
bp-ec41ba74-1f02-44cf-b47f-38cda1220111
bp-8afc3780-3d64-47ca-89be-c31c41220111

Crashes continue with TB 97.0 beta1.
bp-730013a1-cfed-4762-a5b4-df9d51220112

Happens on both, Linux, and Win10. It's crashing also when starting TB beta in safe mode.
Once TB finished loading it starts connecting to a number of IMAP accounts, and then it just crashes after about 10 sec. I'm doing nothing.
This is not intermittent, it happens every time when Thunderbird starts.
The release version 91.5.0 running on the same computer(s) and accessing the exact same IMAP accounts has no problem.

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to Christian Riechers from comment #6)

I've got more of these crashes. This started with TB 96.0 beta4.
bp-315c71f1-316f-4c18-826e-66b061220111 https://crash-stats.thunderbird.net/report/bp-315c71f1-316f-4c18-826e-66b061220111
bp-ec41ba74-1f02-44cf-b47f-38cda1220111 https://crash-stats.thunderbird.net/report/bp-315c71f1-316f-4c18-826e-66b061220111

I also have newsgroups. So perhaps this is a flavor of Bug 1674954? Startup Crash in [@ mozilla::dom::quota::(anonymous namespace)::PrincipalVerifier::Run] via DoExecuteNextTaskOnlyMainThreadInternal which doesn't have a prognosis

Magnus, do you have any newsgroups in your profile that frequently have messages?

Comment 9

[Magnus Melin [:mkmelin]]

I have a suspicion bug 1753299 will fix this.
My main profile has some newsgroups, but not checking them too frequently.

Comment 10

[Christian Riechers]

Still crashing with TB98.0b1.

Comment 11

[Wayne Mery (:wsmwk)]

(In reply to Christian Riechers from comment #10)

Still crashing with TB98.0b1.

It's plaguing me too. I'm hoping Magnus is right, and next build will fix it.

Comment 12

[Christian Riechers]

TB 98.0b2 is not crashing anymore for me.

Comment 13

[Magnus Melin [:mkmelin]]

Wayne, resolved for you too?

Comment 14

[Wayne Mery (:wsmwk)]

(In reply to Magnus Melin [:mkmelin] from comment #13)

Wayne, resolved for you too?

I haven't been using stock beta on my Mac for over a month (been using Ben's custom build), so I hadn't noticed. Now, using 99.0b2, yes it does seem to be gone for non-safe mode.

And backtrace does show a large decrease since about Feb 18, just after 98.0b2 released. If it was fixed in 98.0b2 it would match the shipping of bug 1753299 in beta. But bug 1753299 presumably isn't a regression.

If that wasn't the fix, 98.0b1 was only shortly before that, and was slow in ramping up. (rate set to 100 on 2022-02-11)

Comment 16

[Wayne Mery (:wsmwk)]

(In reply to Magnus Melin [:mkmelin] from comment #13)

Wayne, resolved for you too?

No, still seeing it. bp-4ff275f1-e2e6-4e24-9aed-58aff0220714 and bp-3cb46202-39c3-451c-b65c-8d90f0220714 are recent examples with 103 beta.

Plus bug 1674954 @ mozilla::dom::quota::(anonymous namespace)::PrincipalVerifier::Run bp-d835eccb-2ff3-44c8-af2e-7498f0220716

Comment 17

[Magnus Melin [:mkmelin]]

First 2 ones are bug 1749276 though. If you don't have a crash with nsMsgAttachmentData::~nsMsgAttachmentData on the stack I'd say this is gone.

Comment 18

[Wayne Mery (:wsmwk)]

(In reply to Magnus Melin [:mkmelin] from comment #17)

First 2 ones are bug 1749276 though. If you don't have a crash with nsMsgAttachmentData::~nsMsgAttachmentData on the stack I'd say this is gone.

Yes, according to crash-stats this signature does seem to be gone since bug 1753299 was fixed