1878469 - Crash in [@ nsCOMArray_base::Count ]

Status: RESOLVED DUPLICATE of bug 646168

(Thunderbird :: Mail Window Front End, defect)

Description

[Matt]

Attachment: INBOX 298.eml

Crash report: https://crash-stats.mozilla.org/report/index/c26b6449-2861-4f57-b99a-8a2590240203

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::Length const  mailnews/base/src/nsMsgGroupThread.cpp:647
0  xul.dll  nsCOMArray_base::Count const  xpcom/ds/nsCOMArray.h:90
0  xul.dll  nsMsgXFGroupThread::Clone  mailnews/base/src/nsMsgGroupThread.cpp:647
1  xul.dll  nsMsgGroupView::CopyDBView  mailnews/base/src/nsMsgGroupView.cpp:469
2  xul.dll  nsMsgQuickSearchDBView::CopyDBView  mailnews/base/src/nsMsgQuickSearchDBView.cpp:64
3  xul.dll  nsMsgQuickSearchDBView::CloneDBView  mailnews/base/src/nsMsgQuickSearchDBView.cpp:51
4  xul.dll  XPTC__InvokebyIndex  
5  xul.dll  CallMethodHelper::Invoke  js/xpconnect/src/XPCWrappedNative.cpp:1627
5  xul.dll  CallMethodHelper::Call  js/xpconnect/src/XPCWrappedNative.cpp:1180
5  xul.dll  XPCWrappedNative::CallMethod  js/xpconnect/src/XPCWrappedNative.cpp:1126

Attached is the email which Thunderbird failed to display in the message list, despite showing an unread count for it, and crashed when the quick filter was used to display unread messages and the result was clicked on. It is SPAM. But even so it should have appeared in the message list and not crashed Thunderbird when selected.

Additional information from Troubleshooting information.

Add-ons
Name Type Version Enabled ID
Amazon.co.uk extension 1.1 true [e-mail]
Bing extension 1.0 true [e-mail]
DuckDuckGo extension 1.0 true [e-mail]
Google extension 1.0 true [e-mail]
Wikipedia (en) extension 1.0 true [e-mail]
System theme — auto theme 1.3 true [e-mail]
Unified Folders Debugging extension 115.4 false [e-mail]
Dark theme 1.3 false [e-mail]
Light theme 1.3 false [e-mail]
Security Software
Type Name
Antivirus Microsoft Defender Antivirus
Antispyware
Firewall Windows Firewall

Comment 1

[Hartmut Welpmann [:welpy-cw]]

So your daily build is from just one day before a related patch was checked in, see bug 646168 comment 94. Could you update to the latest daily build and see if that makes a difference?

Comment 2

[Hartmut Welpmann [:welpy-cw]]

Sorry, I just didn't look right. So this is after that fix. Does this only happen with that specific message and is reproducible for you? With the latest daily, after copying the message to one IMAP inbox and marking it unread, I don't see any problem with displaying it in a unified folder.

Comment 3

[Magnus Melin [:mkmelin]]

Is that reproducible for you? I moved it to a folder and quick searched it + selected, but did not crash.

Comment 4

[Wayne Mery (:wsmwk)]

I crashed earlier today, but it is unclear to me which bug report it matches to. The virtual folder on which I clicked had group by sort enabled.

Crash report: https://crash-stats.mozilla.org/report/index/66845beb-5834-48d4-b6a7-957440240211

mozilla::detail::InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | nsTArray_Impl<T>::operator[] | nsMsgGroupView::OnHdrDeleted

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0  libmozglue.dylib  MOZ_Crash  mfbt/Assertions.h:301
0  libmozglue.dylib  mozilla::detail::InvalidArrayIndex_CRASH  mfbt/Assertions.cpp:50
1  XUL  nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::ElementAt  xpcom/ds/nsTArray.h:1208
1  XUL  nsTArray_Impl<unsigned int, nsTArrayInfallibleAllocator>::operator[]  xpcom/ds/nsTArray.h:1245
1  XUL  nsMsgGroupView::OnHdrDeleted  mailnews/base/src/nsMsgGroupView.cpp
2  XUL  nsMsgXFVirtualFolderDBView::UpdateCacheAndViewForFolder  mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:198
3  XUL  nsMsgXFVirtualFolderDBView::UpdateCacheAndViewForPrevSearchedFolders  mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:215
4  XUL  nsMsgXFVirtualFolderDBView::OnSearchDone  mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:290
5  XUL  nsMsgSearchSession::NotifyListenersDone  mailnews/search/src/nsMsgSearchSession.cpp:466
6  XUL  nsMsgSearchSession::TimerCallback  mailnews/search/src/nsMsgSearchSession.cpp:409

The signature is quite rare https://crash-stats.mozilla.org/signature/?product=Thunderbird&signature=mozilla%3A%3Adetail%3A%3AInvalidArrayIndex_CRASH%20%7C%20nsTArray_Impl%3CT%3E%3A%3AElementAt%20%7C%20nsTArray_Impl%3CT%3E%3A%3Aoperator%5B%5D%20%7C%20nsMsgGroupView%3A%3AOnHdrDeleted&date=%3E%3D2023-08-12T01%3A41%3A00.000Z&date=%3C2024-02-12T01%3A41%3A00.000Z

Comment 5

[Hartmut Welpmann [:welpy-cw]]

(In reply to Wayne Mery (:wsmwk) from comment #4)

I crashed earlier today, but it is unclear to me which bug report it matches to. The virtual folder on which I clicked had group by sort enabled.

[...]
1 XUL nsMsgGroupView::OnHdrDeleted mailnews/base/src/nsMsgGroupView.cpp
[...]

Did you delete a message from that virtual folder in another folder beforehand, possibly via another Thunderbird instance? Did that virtual folder cover IMAP. POP3 and/or local folders?

Comment 6

[Wayne Mery (:wsmwk)]

(In reply to Hartmut Welpmann [:welpy-cw] from comment #5)

Did you delete a message from that virtual folder in another folder beforehand, possibly via another Thunderbird instance? Did that virtual folder cover IMAP. POP3 and/or local folders?

I surely deleted a message from an underlying folder. But not deleted via virtual folder - I hadn't been in that virtual folder for at least a week or two.

Comment 7

[Matt]

For me, this was a one off. However, I do not know how the folder view unread Vs all are built. Is one perhaps a virtual folder in the background. Or using the same code as a virtual folder to build the unread view?

Comment 8

[Magnus Melin [:mkmelin]]

The only think I could think of is that possibly https://searchfox.org/comm-central/rev/803933402d765dead8a156192127c3197ee4ade0/mailnews/search/src/nsMsgSearchSession.cpp#462-466 should be removing things from starting from the last not the first.

Comment 9

[Hartmut Welpmann [:welpy-cw]]

I just had another close look at the original crash report in comment 0. It seems to be just another instance of the problem that has since been fixed in the follow-up patch in bug 646168 comment 101.

The crash in comment 4 seems to be a different matter ...

Comment 10

[Wayne Mery (:wsmwk)]

(In reply to Hartmut Welpmann [:welpy-cw] from comment #9)

I just had another close look at the original crash report in comment 0. It seems to be just another instance of the problem that has since been fixed in the follow-up patch in bug 646168 comment 101.

Patch will finally appear in 115.9.0.

That patch is on 124 beta, and so far there are no 124 beta crashes. See also bug 646168 comment 101. But the beta crash rate is so low that I'm not sure I trust the stats as an indication of success - about two per week for beta 123, and there are no beta 122 crashes.

Comment 11

[Hartmut Welpmann [:welpy-cw]]

Closing this as duplicate of bug 646168, as the crash report in comment 0 was a temporary regression by the fix for that one, see comment 9. The crash report in comment 4 is covered by bug 1883955.