325986 - glibc detected free error causes Thunberbird hang [@ nsMsgDatabase::HeaderEnumerator]

Status: RESOLVED WORKSFORME

(Thunderbird :: General, defect)

Description

[Tom Williams]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.1) Gecko/20060124 Firefox/1.5.0.1
Build Identifier: Thunderbird version 1.5 (20051201)

Recently, I've been encountering glibc detected free errors causing Thunderbird to crash while Thunderbird is minimized.

Here are two talkback ids documenting the crashes:

TB14780447E
TB14744812E

Here is the error printed to the console:

 *** glibc detected *** free(): invalid next size (fast): 0x0ac7a1e8 ***

Here is some system information:

Linux 2.6.15 kernel
glibc-2.3.4
glib-2.8.5
gtk+-2.8.11

Reproducible: Sometimes

Steps to Reproduce:
1.I don't know how to reproduce other than Leaving Thunderbird minimized over night.
2.
3.

Actual Results:  
At some point, the glibc error is reported and Thunberbird hangs.

Expected Results:  
The glibc error shouldn't be generated and Thunderbird shouldn't hang.

Comment 1

[David :Bienvenu]

Here's the stack trace. It looks like new pop3 mail arrived and was filtered, while you were minimized. When we finished filtering, we closed the destination db, and some sort of memory corruption caused the crash. Beyond that, I don't know what could be going on. 

thunderbird-bin + 0x410 (0xffffe410)
libc.so.6 + 0x2a059 (0xb74fe059)
libc.so.6 + 0x5c0ba (0xb75300ba)
libc.so.6 + 0x61f86 (0xb7535f86)
libc.so.6 + 0x62a4b (0xb7536a4b)
libstdc++.so.5 + 0x8f283 (0xb768d283)
nsMsgHdr::Release()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/db/msgdb/src/nsMsgHdr.cpp, line 48]
nsMsgDatabase::HeaderEnumerator()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 311]
PL_DHashTableEnumerate()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/xpcom/build/pldhash.c, line 622]
nsMsgDatabase::ClearHdrCache()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 383]
nsMsgDatabase::ClearCachedObjects()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 368]
nsMsgDatabase::ClearCachedHdrs()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 353]
nsMsgDBFolder::SetMsgDatabase()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/util/nsMsgDBFolder.cpp, line 795]
nsMsgDBFolder::CloseDBIfFolderNotOpen()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/util/nsMsgDBFolder.cpp, line 4960]
nsMsgLocalMailFolder::OnCopyCompleted()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/local/src/nsLocalMailFolder.cpp, line 1626]
nsMsgLocalMailFolder::EndMove()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/local/src/nsLocalMailFolder.cpp, line 141]
nsCopyMessageStreamListener::EndCopy()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/src/nsCopyMessageStreamListener.cpp, line 848]
nsCopyMessageStreamListener::OnStopRequest()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/src/nsCopyMessageStreamListener.cpp, line 195]
nsMsgProtocol::OnStopRequest()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 848]
nsMailboxProtocol::OnStopRequest()  [/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/local/src/nsMailboxProtocol.cpp, line 395]

Comment 2

[Tom Williams]

Well, I might have found some additional information about this.  A few weeks ago, I started using the "Grouped By" message sorting in the inboxes for a few e-mail accounts I have defined to TB.  Last night, I changed ALL of the inboxes to use unthreaded sorting and I didn't get any crashes.

I'll change them back to using "Grouped By" sorting and see if the crash occurs.

I've got about 10 POP3 accounts defined to TB.

Peace...

Comment 3

[Tom Williams]

Ok, it's NOT the "Grouped By" setting since I've enabled it and it's been working fine.  When I disabled the "Grouped By" setting, I *also* compressed a number of mail folders.  I'm wondering (more like thinking) this is what did the trick.

Anyway, I'll post more info as I gather it.

Peace...

Comment 4

[Tom Williams]

Attachment: Screenshot of Thunderbird inbox when crash occurred.

I encountered this problem again but now, instead of getting the glibc error, Thunderbird crashes.  I'm working on getting a stack trace but when TB crashes, the terminal where I started it gets some kind of dump generated.

Here is the latest talkback incident id I filed today:
TB19752519Z

In the attached screenshot, notice how the subject of a message appears above "Yesterday".  I have "Grouped By Sort G" sort option enabled.  I this particular case, TB was minimized over night.  When I maximized it to read my e-mail, I saw what was in the screenshot.  I then click "Junk" and the crash occurred.

I'll post a stack trace once I can generate one.

I'm now running in this environment:

2.6.16.20 kernel
glibc 2.4
gcc 4.1.1
TB 1.5.0.4

Let me know if you have any questions or need other info.

Comment 5

[Jean-Michel Reghem]

Don't know if it is the same bug ...
But i got a crash on windows XP SP2 yesterday ...
22h30 --> i was sleeping, so, as i check my mails each 10' it seems that pop3 mail check was the only thing TB did ...

( TB19926294E )

Incident ID: 19926294
Stack Signature	0x408b0574 0ce7e69e
Product ID	Thunderbird2
Build ID	2006061309
Trigger Time	2006-06-15 22:45:14.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	
User Comments	crash at startup
Since Last Crash	33 sec
Total Uptime	58595 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x408b0574
nsMsgDatabase::HeaderEnumerator  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 315]
nsMsgDatabase::ClearHdrCache  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 387]
XPTC_InvokeByIndex  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_CallMethod  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1445]
js_Invoke  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1188]
js_Interpret  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3584]
js_Execute  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1435]
JS_ExecuteScript  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/js/src/jsapi.c, line 4019]
nsXULDocument::ExecuteScript  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3648]
nsXULDocument::ResumeWalk  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3103]
nsXULDocument::OnStreamComplete  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3602]
nsStreamLoader::OnStopRequest  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsStreamLoader.cpp, line 137]
nsJARChannel::OnStopRequest  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/modules/libjar/nsJARChannel.cpp, line 712




--> and when i restart TB this morning, i got also a crash ( TB19926250H ):

Incident ID: 19926250
Stack Signature	0x63222866 ec385480
Product ID	Thunderbird2
Build ID	2006061309
Trigger Time	2006-06-15 08:07:46.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	
User Comments	
Since Last Crash	58562 sec
Total Uptime	58562 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x63222866
nsMsgDatabase::HeaderEnumerator  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 315]
nsMsgDatabase::ClearHdrCache  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 387]
nsMailDatabase::ForceClosed  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMailDatabase.cpp, line 109]

--> a second restart was succesfull

Comment 6

[Jean-Michel Reghem]

Got a similar crash on windows XP SP2 during the night ...
Don't know if TB was minimised (i believe) but the behaviour is the same

TB 2.0a1 build 2006061911

Incident ID: 20355742
Stack Signature	0x6d222866 22b3eaf7
Product ID	Thunderbird2
Build ID	2006061911
Trigger Time	2006-06-27 07:51:22.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	
User Comments	
Since Last Crash	174483 sec
Total Uptime	266916 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x6d222866
nsMsgDatabase::HeaderEnumerator  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 315]
nsMsgDatabase::ClearHdrCache  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 387]
nsMailDatabase::ForceClosed  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMailDatabase.cpp, line 122]



Line 315 of HeaderEnumerator is NS_IF_RELEASE(element->mHdr); 
which thus called element->mHdr->Release if not null as the linux stack trace of  comment #1 ... so it seems to be the same bug



See comment #5 for the same crash one week ago

Comment 7

[Jean-Michel Reghem]

ohlà ... big information ...
Yesterday, i've closed my TB (i'm pretty sure of that).
But it seems that the thunderbird process was not closed (windows XP)...

This morning, i'm seeing that TB was crashing ... (Error windows dialog box asking to send a report to microsoft + talkback) ... the crash, in fact occurs at 17h40 local time ... thus +/- 5 minutes after i went out the office

--> TB20395976H
Incident ID: 20395976
Stack Signature	0x73656d2f 49fcfe95
Product ID	Thunderbird2
Build ID	2006061911
Trigger Time	2006-06-28 08:40:58.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	
User Comments	crash during night
Since Last Crash	33532 sec
Total Uptime	300448 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x73656d2f
nsMsgDatabase::HeaderEnumerator  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 315]
nsMsgDatabase::ClearHdrCache  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 387]
nsMailDatabase::ForceClosed  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMailDatabase.cpp, line 122]

and thus, i start TB, and after +/- 1 minutes, i got a new crash (the same as described in comment #5)

Incident ID: 20396486
Stack Signature	0x046b6c18 429c7ee5
Product ID	Thunderbird2
Build ID	2006061911
Trigger Time	2006-06-28 23:26:16.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	crash after restart
User Comments	
Since Last Crash	1300 sec
Total Uptime	301748 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x046b6c18
nsCaret::StartBlinking  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/layout/base/nsCaret.cpp, line 495]
PresShellViewEventListener::DidRefreshRegion  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 7903]
nsViewManager::DispatchEvent  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 2047]
HandleEvent  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1349]
nsWindow::ProcessMessage  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4512]
nsWindow::WindowProc  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1538]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0xb4c0 (0x77d4b4c0)
USER32.dll + 0xb50c (0x77d4b50c)
ntdll.dll + 0xeae3 (0x7c90eae3)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mail/app/nsMailApp.cpp, line 62]
kernel32.dll + 0x16d4f (0x7c816d4f)


After the next restart, there was no more error

Comment 8

[Jean-Michel Reghem]

Yet a crash this night (TB was running on my computer)
Checking on talkback-public: http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsMsgDatabase%3A%3AHeaderEnumerator&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid&rlimit=500

there is 42 reported incindent in june for this stack ... most with a 2.0 or trunk version (all platforms)

most of the crash are located at  [ ... /mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 315]
like this bug

Comment 9

[Scott MacGregor]

this doesn't appear to be showing up in talkback on the branch anymore. It appears to be 1.5 only.

Comment 10

[David :Bienvenu]

I'm pretty sure this was fixed under some other bug.

Comment 11

[Jean-Michel Reghem]

Yes ... i didn't have this crash since a long time using TB 2.0b1pre ...
so, WFM too