355594 - Thunderbird crashes upon startup with the Talkback extension enabled [@ PR_GetEnv][@ nsAutoVoidArray::Clear] or [@ PRMJ_LocalGMTDifference]

Status: RESOLVED WONTFIX

(Thunderbird :: General, defect)

Description

[(no longer active)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0 XpcomViewer/0.9
Build Identifier: version 1.5.0.7 (20060909)

I used the windowsupdate.com site to install a number of non-critical updates (most of them for hardware such as WLAN card, modem, mouse, touchpad, etc.), and I was prompted to restart the computer.  After the restart, Thunderbird wouldn't start, and all attempts to run it led to crashes.  I've recorded their talkback incident IDs:

TB24183650G, TB24183503H, TB24183452H, TB24183377G, TB24183308W, TB24183256X, TB24183008H, TB24182957G, TB24182936Q

Reproducible: Always

Steps to Reproduce:
1. Try to open Thunderbird.
2. Watch it crash.
3. Open Thunderbird in Safe Mode.
4. Disable the Talkback extension.
5. Close Thunderbird.
6. Open Thunderbird (in normal mode).
7. Watch it get opened.
8. Enable the Talkback extension.
9. Restart Thunderbird.
10. Make it crash upon startup.

I could go on and on with the same procedure.




A similar problem happened with Firefox 2.0-RC1 as well.  I'm filing it in another bug, and I'll post the bug's ID here soon.

Comment 1

[Scott MacGregor]

stack trace doesn't show much:

PR_GetEnv  [mozilla/nsprpub/pr/src/misc/prenv.c, line 82]
0x013256f0
nsAutoVoidArray::Clear  [mozilla/xpcom/ds/nsVoidArray.cpp, line 685]
0xf98b5708

Comment 2

[(no longer active)]

(In reply to comment #0)
> A similar problem happened with Firefox 2.0-RC1 as well.  I'm filing it in
> another bug, and I'll post the bug's ID here soon.

It's bug #355597.  If it matters, I have SeaMonkey "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060729 SeaMonkey/1.0.4" installed, and this problem doesn't seem to affect it.

Comment 3

[(no longer active)]

(In reply to comment #1)
> stack trace doesn't show much:
> 
> PR_GetEnv  [mozilla/nsprpub/pr/src/misc/prenv.c, line 82]
> 0x013256f0
> nsAutoVoidArray::Clear  [mozilla/xpcom/ds/nsVoidArray.cpp, line 685]
> 0xf98b5708

Check out the rest of the talkback IDs as well.  It seems like they're not similar to each other, except for the offset in msvcrt.dll where the crash happens.

Comment 4

[(no longer active)]

(In reply to comment #3)
> Check out the rest of the talkback IDs as well.  It seems like they're not
> similar to each other, except for the offset in msvcrt.dll where the crash
> happens.

Actually, at a closer look, there seem to be only two patterns of stack traces.  One if the trace you mentioned.  The other one is:

PRMJ_LocalGMTDifference  [mozilla/js/src/prmjtime.c, line 104]
js_InitDateClass  [mozilla/js/src/jsdate.c, line 2136]
JS_ResolveStandardClass  [mozilla/js/src/jsapi.c, line 1418]
BackstagePass::NewResolve  [mozilla/js/src/xpconnect/src/xpcruntimesvc.cpp, line 71]
XPC_WN_Helper_NewResolve  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1064]
js_LookupPropertyWithFlags  [mozilla/js/src/jsobj.c, line 2840]
js_LookupProperty  [mozilla/js/src/jsobj.c, line 2745]
js_FindProperty  [mozilla/js/src/jsobj.c, line 2954]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3643]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1207]
nsXPCWrappedJSClass::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1410]
nsXPCWrappedJS::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462]
SharedStub  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2156]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1445]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1187]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3584]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1207]
nsXPCWrappedJSClass::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1410]
nsXPCWrappedJS::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462]
SharedStub  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsObserverService::NotifyObservers  [mozilla/xpcom/ds/nsObserverService.cpp, line 235]
nsXREDirProvider::DoStartup  [mozilla/toolkit/xre/nsXREDirProvider.cpp, line 595]
XRE_main  [mozilla/toolkit/xre/nsAppRunner.cpp, line 2243]
main  [mozilla/mail/app/nsMailApp.cpp, line 62]
kernel32.dll + 0x16fd7 (0x7c816fd7)

Let me know if there is anything I can do to help track this down, because it seems to be 100% reproducible.

Comment 5

[(no longer active)]

The same problem seems to affect the trunk builds as well.  Check out bug #355597 comment #4.

Comment 6

[Wayne Mery (:wsmwk)]

is this same as x64 bugs ..
FF bug 349871 Crash on startup with Talkback enabled using XP x64
SM bug 345695 also x64

Comment 7

[(no longer active)]

(In reply to comment #6)
> is this same as x64 bugs ..
> FF bug 349871 Crash on startup with Talkback enabled using XP x64
> SM bug 345695 also x64

For whatever it's worth, the machine which is affected with this bug (and it seems to be with all versions of Thunderbird and Firefox) has a x86-64 CPU (albeit, running a 32-bit Windows OS).

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to comment #4)
> (In reply to comment #3)
> > Check out the rest of the talkback IDs as well.  It seems like they're not
> > similar to each other, except for the offset in msvcrt.dll where the crash
> > happens.
> 
> Actually, at a closer look, there seem to be only two patterns of stack traces.
>  One if the trace you mentioned.  The other one is:
> 
> PRMJ_LocalGMTDifference  [mozilla/js/src/prmjtime.c, line 104]
> js_InitDateClass  [mozilla/js/src/jsdate.c, line 2136]
> JS_ResolveStandardClass  [mozilla/js/src/jsapi.c, line 1418]

PRMJ_LocalGMTDifference shows up in 233765, see bug 233765 comment 28 and 64

dupe?

Comment 9

[(no longer active)]

(In reply to comment #8)
> PRMJ_LocalGMTDifference shows up in 233765, see bug 233765 comment 28 and 64
> 
> dupe?

Interesting.  My processor is AMD Turion 64 Mobile (ML-37), 2GHz, which comes with the NX capability.

Comment 10

[Wayne Mery (:wsmwk)]

Ehsan,
can you test one at a time and report results of :
* disable talkback
* workaround bug 233765 comment 36

Comment 11

[(no longer active)]

(In reply to comment #10)
> Ehsan,
> can you test one at a time and report results of :
> * disable talkback
> * workaround bug 233765 comment 36

I would have loved to, but that laptop's HD died a while back and I have not replaced it yet.  Anyway I should mention that I'm using Firefox 2.0.0.9 right now on a machine with an AMD Athlon64 X2 3600+, *with* DEP enabled, and Firefox and Thunderbird work just fine with the Talkback extension.  Just to make it clear that the problem does not happen in all such cases...

Comment 12

[Serge Gautherie (:sgautherie)]

Is this a WorksForMe/WontFix on older versions/software?
Otherwise, what is expected nowadays?

Comment 13

[Ludovic Hirlimann [:Usul]]

(In reply to comment #12)
> Is this a WorksForMe/WontFix on older versions/software?
> Otherwise, what is expected nowadays?

We are moving to Breakpad. Talkcback is an unmaintained piece of software.