237240 - Thunderbird crashes while composing a new plain text message

Status: RESOLVED WORKSFORME

(Thunderbird :: Message Compose Window, defect)

Description

[Alexander Boronka]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; de-DE; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla Thunderbird 0.5 (20040207)

Sometimes Thunderbird crashes while writing a new plain text message.

There are some special things I observed:

1. I observerd that the crashes seem to occur only if Thunderbird has been
running/open for serveral hours when creating the message.

2. The crash only happens when the focus is in the text area. I did not observe
any crash while editing the subject or the recipients.

3. The crash may happen after a few typed characters as well as after some hundred.

I never write HTML mails so I can only talk about plain text mails.

Reproducible: Sometimes
Steps to Reproduce:
1.
2.
3.

Comment 1

[Alexander Boronka]

Still crashes with Build 20040326.

However:

1.  I have the feeling that the crashes only occur when I change the "From"
field while writing a message. (I use multiple accounts)

I have to observe this.

2.  Some crashes occur immediately after the launsch of Thunderbird. So it has
obviously nothing to do with the up-time of Thunderbird.

Comment 2

[Torsten]

Confirmed.
I regulary have the same crashes when composing a new mail with Thunderbird
version 0.8 (20040913) on Windows 98SE (Page fault in module MSVCRT.DLL at
017f:7800d16a).  

The cursor is in the text area and I am entering text when the crash occurs. The
amount of entered text before the crash is generally small (one or two lines).
The crashes happen without editing the "From"-field. As far as I can remember,
all crashes occured when the Mozilla Calendar (as thunderbird extension) was
also active.

Comment 3

[Torsten]

(In reply to comment #2)
> [...] As far as I can remember,
> all crashes occured when the Mozilla Calendar (as thunderbird extension) was
> also active.

Crashes also occure when Calendar is not active!

Comment 4

[timeless]

please run the installer and custom install Talkback. report a talkbackid

Comment 5

[Adam Hauner]

Alexander Boronka and Torsten Lilge: Could you reproduce this bug with
Thunderbird 1.0 and provide Talkback ID for your crash?

Comment 6

[Torsten]

(In reply to comment #5)
> Alexander Boronka and Torsten Lilge: Could you reproduce this bug with
> Thunderbird 1.0 and provide Talkback ID for your crash?

Just before upgrading to Thunderbird 1.0 I also upgraded from Win 98 to Win XP.
The combination TB 1.0 and Win XP never crashed since then.

Comment 7

[Alexander Boronka]

I did not observe any crashes with TB 1.0.
To me, it seems to be fixed.

Comment 8

[Adam Hauner]

Alex, thank you for information. Marking as WFM.

Comment 9

[Bernie Innocenti]

Not sure if we're talking about the same bug.

I'm using Thunderbird 1.0.2 on Fedora Core 4
(thunderbird-1.0.2-6).

Crash happened three times while replying to the
same message... after typing a few lines of text.

The exact moment it crashed I was playing with
the cursor keys.

This is a GDB stack trace, unfortunately on the
stripped binary:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208801600 (LWP 12784)]
0x00318926 in free () from /lib/libc.so.6
(gdb) bt
#0  0x00318926 in free () from /lib/libc.so.6
#1  0x00cbb7b9 in operator delete () from /usr/lib/libstdc++.so.6
#2  0x00cbb805 in operator delete[] () from /usr/lib/libstdc++.so.6
#3  0x0110e9f5 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#4  0x011110db in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#5  0x01225a43 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#6  0x01225e27 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#7  0x010fe928 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#8  0x068bda1d in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libeditor.so
#9  0x0052e76a in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libembedcomponents.so
#10 0x0052b076 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libembedcomponents.so
#11 0x01332d67 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#12 0x004af06a in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libwidget_gtk2.so
#13 0x04f81cf9 in gtk_marshal_VOID__UINT_STRING () from /usr/lib/libgtk-x11-2.0.so.0
#14 0x05f46285 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#15 0x05f5478b in g_signal_stop_emission () from /usr/lib/libgobject-2.0.so.0
#16 0x05f55631 in g_signal_emitv () from /usr/lib/libgobject-2.0.so.0
#17 0x04ec2705 in gtk_bin_get_child () from /usr/lib/libgtk-x11-2.0.so.0
#18 0x04ec36d9 in gtk_binding_set_by_class () from /usr/lib/libgtk-x11-2.0.so.0
#19 0x04ec3949 in gtk_binding_set_by_class () from /usr/lib/libgtk-x11-2.0.so.0
#20 0x04ec3a2b in gtk_bindings_activate () from /usr/lib/libgtk-x11-2.0.so.0
#21 0x004af385 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libwidget_gtk2.so
#22 0x01333092 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#23 0x01332a51 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#24 0x0124f73f in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#25 0x01388af5 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#26 0x013764a4 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#27 0x0134a699 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#28 0x013bd9d3 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#29 0x013bd9a9 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#30 0x013bd9a9 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#31 0x013bd9a9 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#32 0x013bd9a9 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#33 0x013b9237 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#34 0x013764a4 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#35 0x011e2295 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#36 0x0120691e in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#37 0x01100dba in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#38 0x01107f28 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
---Type <return> to continue, or q <return> to quit---
#39 0x013617b6 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#40 0x013632e3 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#41 0x0135ae46 in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libgklayout.so
#42 0x004a54bc in NSGetModule () from
/usr/lib/thunderbird-1.0.2/components/libwidget_gtk2.so
#43 0x0049e6e2 in ?? () from /usr/lib/thunderbird-1.0.2/components/libwidget_gtk2.so
#44 0x0049e745 in ?? () from /usr/lib/thunderbird-1.0.2/components/libwidget_gtk2.so
#45 0x04f80352 in gtk_marshal_VOID__UINT_STRING () from /usr/lib/libgtk-x11-2.0.so.0
#46 0x05f46285 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#47 0x05f5478b in g_signal_stop_emission () from /usr/lib/libgobject-2.0.so.0
#48 0x05f55c53 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#49 0x05f56254 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#50 0x0505bac3 in gtk_widget_activate () from /usr/lib/libgtk-x11-2.0.so.0
#51 0x0506a587 in gtk_window_propagate_key_event () from
/usr/lib/libgtk-x11-2.0.so.0
#52 0x0506e706 in gtk_window_activate_key () from /usr/lib/libgtk-x11-2.0.so.0
#53 0x04f80352 in gtk_marshal_VOID__UINT_STRING () from /usr/lib/libgtk-x11-2.0.so.0
#54 0x05f45d9b in g_cclosure_new_swap () from /usr/lib/libgobject-2.0.so.0
#55 0x05f46285 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#56 0x05f54917 in g_signal_stop_emission () from /usr/lib/libgobject-2.0.so.0
#57 0x05f55c53 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#58 0x05f56254 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#59 0x0505bac3 in gtk_widget_activate () from /usr/lib/libgtk-x11-2.0.so.0
#60 0x04f7ebc9 in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#61 0x04f7eef4 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#62 0x051a8d6e in gdk_screen_get_setting () from /usr/lib/libgdk-x11-2.0.so.0
#63 0x00d5f3ee in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#64 0x00d623f6 in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#65 0x00d626e3 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#66 0x04f7e1b5 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#67 0x004a3e7c in ?? () from /usr/lib/thunderbird-1.0.2/components/libwidget_gtk2.so
#68 0x00416b19 in ?? () from /usr/lib/thunderbird-1.0.2/components/libnsappshell.so
#69 0x08051815 in ?? ()
#70 0x0804daa1 in ?? ()
#71 0x002c9de6 in __libc_start_main () from /lib/libc.so.6
#72 0x0804d9fd in ?? ()

Comment 10

[timeless]

[e-mail]: if you're going to crash w/ a vendor supplied build, get the
vendor supplied symbols before you report a stack trace. for information about
getting such symbols, contact your vendor's support mechanism.

Comment 11

[Bernie Innocenti]

I've tried the latest Thunderbird nightly snapshot
and the bug is still there.

I managed to get this stack trace from glibc's
malloc debug feature.

Please reopen this bug.


*** glibc detected *** ./thunderbird-bin: free(): invalid pointer: 0xffff9c01 ***
======= Backtrace: =========
/lib/libc.so.6[0x53a424]
/lib/libc.so.6(__libc_free+0x77)[0x53a95f]
/usr/lib/libstdc++.so.5(_ZdlPv+0x23)[0x6c1cd3]
/usr/lib/libstdc++.so.5(_ZdaPv+0x1f)[0x6c1d2f]
./thunderbird-bin[0x82bc0e6]
./thunderbird-bin[0x82a6a44]
./thunderbird-bin[0x82a8b1e]
./thunderbird-bin[0x8254165]
./thunderbird-bin[0x8601756]
./thunderbird-bin[0x85774b0]
./thunderbird-bin[0x857495e]
./thunderbird-bin[0x8420e4d]
./thunderbird-bin[0x8209bc2]
/usr/lib/libgtk-x11-2.0.so.0[0xbdccf9]
/usr/lib/libgobject-2.0.so.0(g_closure_invoke+0x10a)[0xa47285]
/usr/lib/libgobject-2.0.so.0[0xa5578b]
/usr/lib/libgobject-2.0.so.0(g_signal_emitv+0x144)[0xa56631]
/usr/lib/libgtk-x11-2.0.so.0[0xb1d705]
/usr/lib/libgtk-x11-2.0.so.0[0xb1e6d9]
/usr/lib/libgtk-x11-2.0.so.0[0xb1e949]
/usr/lib/libgtk-x11-2.0.so.0(gtk_bindings_activate+0xb7)[0xb1ea2b]
./thunderbird-bin[0x820a001]
./thunderbird-bin[0x8421105]
./thunderbird-bin[0x8421201]
./thunderbird-bin[0x83cb7b9]
./thunderbird-bin[0x83ce436]
./thunderbird-bin[0x8469c41]
./thunderbird-bin[0x8453524]
./thunderbird-bin[0x8436d06]
./thunderbird-bin[0x842d3f9]
./thunderbird-bin[0x842d2c0]
./thunderbird-bin[0x842d2c0]
./thunderbird-bin[0x842d2c0]
./thunderbird-bin[0x842d2c0]
./thunderbird-bin[0x842fae6]
./thunderbird-bin[0x8453524]
./thunderbird-bin[0x839f149]
./thunderbird-bin[0x83adaaa]
./thunderbird-bin[0x8259b13]
./thunderbird-bin[0x8259333]
./thunderbird-bin[0x84497ef]
./thunderbird-bin[0x8448a2a]
./thunderbird-bin[0x84427c8]
./thunderbird-bin[0x8219129]
./thunderbird-bin[0x82122b7]
./thunderbird-bin[0x82164f2]
/usr/lib/libgtk-x11-2.0.so.0[0xbdb352]
/usr/lib/libgobject-2.0.so.0(g_closure_invoke+0x10a)[0xa47285]
/usr/lib/libgobject-2.0.so.0[0xa5578b]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x41e)[0xa56c53]
/usr/lib/libgobject-2.0.so.0(g_signal_emit+0x29)[0xa57254]
/usr/lib/libgtk-x11-2.0.so.0[0xcb6ac3]
/usr/lib/libgtk-x11-2.0.so.0(gtk_window_propagate_key_event+0x108)[0xcc5587]
/usr/lib/libgtk-x11-2.0.so.0[0xcc9706]
/usr/lib/libgtk-x11-2.0.so.0[0xbdb352]
/usr/lib/libgobject-2.0.so.0[0xa46d9b]
/usr/lib/libgobject-2.0.so.0(g_closure_invoke+0x10a)[0xa47285]
/usr/lib/libgobject-2.0.so.0[0xa55917]
/usr/lib/libgobject-2.0.so.0(g_signal_emit_valist+0x41e)[0xa56c53]
/usr/lib/libgobject-2.0.so.0(g_signal_emit+0x29)[0xa57254]
/usr/lib/libgtk-x11-2.0.so.0[0xcb6ac3]
/usr/lib/libgtk-x11-2.0.so.0(gtk_propagate_event+0x1d3)[0xbd9bc9]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main_do_event+0x329)[0xbd9ef4]
======= Memory map: ========
00101000-00108000 r-xp 00000000 fe:01 1461156                           
/usr/X11R6/lib/libXrender.so.1.2.2
00108000-00109000 rwxp 00007000 fe:01 1461156                           
/usr/X11R6/lib/libXrender.so.1.2.2
0010b000-0011d000 r-xp 00000000 fe:01 1461157                           
/usr/X11R6/lib/libXft.so.2.1.2
0011d000-0011e000 rwxp 00012000 fe:01 1461157                           
/usr/X11R6/lib/libXft.so.2.1.2
00120000-00129000 r-xp 00000000 fe:01 1461161                           
/usr/X11R6/lib/libXcursor.so.1.0.2
00129000-0012a000 rwxp 00008000 fe:01 1461161                           
/usr/X11R6/lib/libXcursor.so.1.0.2
0012c000-0012e000 r-xp 00000000 fe:01 1461160                           
/usr/X11R6/lib/libXinerama.so.1.0
0012e000-0012f000 rwxp 00001000 fe:01 1461160                           
/usr/X11R6/lib/libXinerama.so.1.0
00131000-00134000 r-xp 00000000 fe:01 1461158                           
/usr/X11R6/lib/libXrandr.so.2.0
00134000-00135000 rwxp 00002000 fe:01 1461158                           
/usr/X11R6/lib/libXrandr.so.2.0
00137000-0013e000 r-xp 00000000 fe:01 1461159                           
/usr/X11R6/lib/libXi.so.6.0
0013e000-0013f000 rwxp 00006000 fe:01 1461159                           
/usr/X11R6/lib/libXi.so.6.0
00141000-0014b000 r-xp 00000000 fe:01 2277410                           
/usr/lib/libpangox-1.0.so.0.800.1
0014b000-0014c000 rwxp 00009000 fe:01 2277410