332700 - Frequent Crashes on the trunk and branch [crash @ nsMsgDatabase::GetHdrFromUseCache]

Status: RESOLVED FIXED

(Thunderbird :: General, defect)

Description

[Scott MacGregor]

Some of the forum testers are seeing a lot of crashes in the last couple days while getting new mail on the branch:

Most of the Talkback IDs look the same.

TB17139074K, TB17139068Q 
TB17129640K, TB17129484W, TB17129426X, TB17129386K

nsMsgDatabase::GetHdrFromUseCache  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 438]
nsMsgDatabase::CreateNewHdr  
nsParseMailMessageState::FinalizeHeaders  
nsParseMailMessageState::ParseFolderLine  
nsPop3Sink::WriteLineToMailbox  
nsPop3Protocol::HandleLine  
nsPop3Protocol::RetrResponse  
nsPop3Protocol::ProcessProtocolState  OnDataAvailable

Comment 1

[David :Bienvenu]

my initial guess was that these are all people using FAT file systems and started crashing after the daylight savings time change and not because of any recent code change. But I'm not at all sure, and I've never seen a crash like that for that reason...it's hard to tell with auto-update because everyone running the branch builds would be running the latest branch code. The cause of the crash is not clear either - perhaps the db has been closed out from under this code.

BTW, who do we talk to about fixing the links in talkback? they're pointing at the 1_8_0 branch instead of the 1_8 branch for TB 2.0

Comment 2

[Scott MacGregor]

Hmm, I seem to remember some of them saying they went back to an earlier build to avoid the crash. I'll double check.

Comment 3

[Andreas Morawietz]

I created a message rule for my incoming mails (Tools -> message filters):
If an incoming message in "Lokale Ordner" contains the string " [de-users] " in subject, thunderbird should move it into my subfolder "Computerkram"

If thunderbird receives an email which contains " [de-users] ", it crashs! 

All is fine without any message rules.

screenshot and more see here
http://forums.mozillazine.org/viewtopic.php?t=400355

Comment 4

[John Benes]

OK, I've got some more information and talkbacks on this bug

On NTFS file system (that was in the bug)

Build 2006-03-29-15 - NO CRASH.

ID:2006033110 (aka 2006-03-30-12) is crashing. - Talkback ID: TB17188458Y

Build 2006-03-31-11 crashed. - Talkback: TB17186276W

It works when there are no messages to be downloaded though.  I suspect the message filters as well.

Comment 5

[David :Bienvenu]

it seems likely that it was my fix for bug 324467 that somehow caused the problem, since I checked that in the morning of 3/31. Do you have filters that search on the message body? And do you have message quaranting turned off (tools | options | privacy and security | anti-virus)

Comment 6

[John Benes]

My current filters filter based on To or CC: or From:

I turned off the AV filtering and will see how that goes.

Comment 7

[John Benes]

It seems like turning off the AV quaranting option is working.

I was able to download the latest tinderbox build 2006040418, and it works...

Comment 8

[Scott MacGregor]

giving this to David since this was caused by Bug 324467

Comment 9

[David :Bienvenu]

I wish I could reproduce this, but I've never seen it. It's also unclear to me what's causing the crash, exactly...I can't tell if the hdr is hosed, or the db.

Comment 10

[John Benes]

Note that this only happens with the AV filtering option turned on.

If I turn it off, it works in the same exact build.

Talkback ID from today's build:
TB17513134G

Comment 11

[David :Bienvenu]

I finally recreated this. I believe now it's a ref-counting problem with msg hdrs, such that a header has been deleted but it's still in the use cache. In my crash, I was trying to add a hdr for a newly downloaded message, but there was aleady a corrupt header in the use cache - presumably, we had downloaded a previous message to the same location, filtered it elsewhere, truncated the inbox, and then downloaded the new message to the same location in the inbox, so that it got the same key.

As to how the use cache could get confused like that, I wonder if the header gets created with one message key and then the message key changes, so it doesn't match the original key in the use cache.

Comment 12

[David :Bienvenu]

Attachment: proposed fix

I think this will fix it - we should definitely end up with the same msg key as before my change with this patch. I'll run with it for a bit...

Comment 13

[David :Bienvenu]

fixed on trunk, 1.8 branch is closed at the moment.

Comment 14

[David :Bienvenu]

should be fixed on both the trunk and branch - can anyone verify this?

Comment 15

[John Benes]

TB18017161K - ID 2006042411 (quarentining ON)

But that Talkback looks a lot different from the ones posted earlier...

I'm getting a lot of freezes on 2006042615 with the message quarenting ON, this does _not_ happen with it off.

Comment 16

[David :Bienvenu]

that stack makes no sense.

Comment 17

[David :Bienvenu]

this fix caused a different problem, crash on shutdown - new fix upcoming.

Comment 18

[David :Bienvenu]

Attachment: proposed fix

third time's the charm, I hope!

Comment 19

[timeless]

this broke movemail. no lucky charms for you.

Comment 20

[David :Bienvenu]

last patch checked in on trunk and branch.

Comment 21

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.3 using talkback data and also no crashs with Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.0 ID:2007032620