358820 - Thunderbird crashes on exit if a compose window was opened during the session [@ nsTextServicesDocument::~nsTextServicesDocument()]

Status: RESOLVED DUPLICATE of bug 357861

(Thunderbird :: General, defect)

Description

[Nir]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

I'm using Thunderbird-3 alpha 1 (20061030) under Fedora core 5.
Every time I close Thunderbird , using File>Quit or 'X' button , Thunderbird crashes ( 'talkback' pops up and send crash Reports ).
In 'Console' window , I use to find like bellow(copied from console window ) :

[root@localhost thunderbird]# ./thunderbird -safe-mode

(thunderbird-bin:13150): Gdk-WARNING **: locale not supported by Xlib

(thunderbird-bin:13150): Gdk-WARNING **: cannot set locale modifiers

(thunderbird-bin:13150): Gdk-WARNING **: locale not supported by Xlib

(thunderbird-bin:13150): Gdk-WARNING **: cannot set locale modifiers
Element  not found in SetElementEnabled
Save from XUL
SaveAsDraft from XUL
GenericSendMessage from XUL
Identity = [nsIMsgIdentity: id1]

ComposeUnload from XUL
./run-mozilla.sh: line 131: 13150 Segmentation fault      "$prog" ${1+"$@"}

Here is a Talkback Report :
http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB25272337M

I have successfully reproduced this problem while running Thunderbird in safe mode. 

Reproducible: Always

Steps to Reproduce:
1.Open Thunderbird ( normal mode or safe mode )
2.receive or send emails .
3.Click on exit ('X')  button or goto File>Quit to close Thunderbird

Actual Results:  
Thunderbird crashes and Talkback window pop up  

Expected Results:  
Thunderbird will close without any crash

Here are some Talkback crash ID:

TB25272337M
TB25271559M
TB25258487Q
TB25255048Y

Comment 1

[David :Bienvenu]

nsTextServicesDocument::~nsTextServicesDocument()  [mozilla/editor/txtsvc/src/nsTextServicesDocument.cpp, line 106]
nsTextServicesDocument::Release()  [mozilla/editor/txtsvc/src/nsTextServicesDocument.cpp, line 160]
nsCOMPtr_base::~nsCOMPtr_base()  [mozilla/xpcom/build/nsCOMPtr.cpp, line 81]
mozInlineSpellChecker::~mozInlineSpellChecker()  [mozilla/extensions/spellcheck/src/mozInlineSpellChecker.cpp, line 521]
mozInlineSpellChecker::Release()  [mozilla/extensions/spellcheck/src/mozInlineSpellChecker.cpp, line 511]
nsCOMPtr_base::~nsCOMPtr_base()  [mozilla/xpcom/build/nsCOMPtr.cpp, line 81]
nsEditor::~nsEditor()  [mozilla/editor/libeditor/base/nsEditor.cpp, line 117]
nsPlaintextEditor::~nsPlaintextEditor()  [mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 116]
nsHTMLEditor::~nsHTMLEditor()  [mozilla/editor/libeditor/html/nsHTMLEditor.cpp, line 236]
nsEditor::Release()  [mozilla/editor/libeditor/base/nsEditor.cpp, line 220]
XPCJSRuntime::GCCallback()  [mozilla/js/src/xpconnect/src/xpcjsruntime.cpp, line 590]
DOMGCCallback()  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 3168]
js_GC()  [mozilla/js/src/jsgc.c, line 3141]
JS_GC()  [mozilla/js/src/jsapi.c, line 1882]
nsXREDirProvider::DoShutdown()  [mozilla/toolkit/xre/nsXREDirProvider.cpp, line 731]
ScopedXPCOMStartup::~ScopedXPCOMStartup()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 595]

Comment 2

[Scott MacGregor]

This is a dupe but this linux talkback stack trace shows a lot more than the various windows reports we've been looking at!

The crash happens if you've ever opened a compose window during the session.

Comment 3

[Nir]

(In reply to comment #2)
> This is a dupe but this linux talkback stack trace shows a lot more than the
> various windows reports we've been looking at!
> 
> The crash happens if you've ever opened a compose window during the session.
> 
No. it only happens when i try to close Thundebrird

Comment 4

[Adam Guthrie]

The Windows equivalent is bug 356439. 

I think this is related to the "we leak the world on shutdown" stuff I saw a while back. Just grab a debug build, `export XPCOM_MEM_LEAK_LOG=log.txt', launch Thunderbird, open a compose window, close it and then look at the log.txt. If you don't crash, you'll see that tons of stuff is leaked.

Comment 5

[Nir]

(In reply to comment #4)
> The Windows equivalent is bug 356439. 
> 
> I think this is related to the "we leak the world on shutdown" stuff I saw a
> while back. Just grab a debug build, `export XPCOM_MEM_LEAK_LOG=log.txt',
> launch Thunderbird, open a compose window, close it and then look at the
> log.txt. If you don't crash, you'll see that tons of stuff is leaked.
> 
should i create a log.txt and submit that file here?

Comment 6

[Nir]

(In reply to comment #2)
> This is a dupe but this linux talkback stack trace shows a lot more than the
> various windows reports we've been looking at!
> 
> The crash happens if you've ever opened a compose window during the session.
> 

It now seems to me that this crash occurs if i try to close Thunderbird after ( successfully )sending mails.

Comment 7

[Nir]

This problem still persist , Talkback Id -TB27282544Z

Please note that I haven't been facing this problem for long time , TB started to crash again from from today . Seems any update triggered this bug or problem again .

Comment 8

[Nir]

It crashed again on exit , id-TB27284862K

Comment 9

[Nir]

crashed again on exit 
id - TB27642096Q
id - TB27640034Y

Comment 10

[Nir]

crashed again on exit :
id=TB27665872G

Comment 11

[Nir]

crash id - TB27684570Y

Comment 12

[Nir]

id=TB27686027X

Comment 13

[Nir]

Some other crash id -
TB27810354M
TB27796867K
TB27788265E
TB27788252Y
TB27787777Q
TB27787302H

Comment 14

[Caio Tiago Oliveira (asrail)]

I'm using SeaMonkey and I also can confirm this.

I would like to say that here this bug happens a lot of times just after sending the mail, even if I don't try to close the app.

Comment 15

[Caio Tiago Oliveira (asrail)]

My stack is a bit different from the others I've seen here, the reason is that it crashed while sending the message, instead of while closing, so we have a nsMsgCompose:

#0  0xffffe410 in __kernel_vsyscall ()
#1  0xb7538e66 in __nanosleep_nocancel () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7538c8f in sleep () from /lib/tls/i686/cmov/libc.so.6
#3  0x080532f2 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:134
#4  0xb5b797f7 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:210
#5  <signal handler called>
#6  0x0957c507 in ?? ()
#7  0x09230bd8 in ?? ()
#8  0xb3ed61f2 in ~nsCOMPtr (this=0x981e858) at ../../../dist/include/xpcom/nsCOMPtr.h:583
#9  0xb3f2cc1b in ~nsTextServicesDocument (this=0x981e838) at nsTextServicesDocument.cpp:124
#10 0xb3f24efa in nsTextServicesDocument::Release (this=0x981e838) at nsTextServicesDocument.cpp:159
#11 0xb146ae5e in ~nsCOMPtr (this=0x95bcbe8) at ../../../dist/include/xpcom/nsCOMPtr.h:583
#12 0xb1475abb in ~mozInlineSpellChecker (this=0x95bcbc8) at mozInlineSpellChecker.cpp:530
#13 0xb1475ff1 in mozInlineSpellChecker::Release (this=0x95bcbc8) at mozInlineSpellChecker.cpp:511
#14 0xb3f53aca in ~nsCOMPtr (this=0x85f7a88) at ../../../dist/include/xpcom/nsCOMPtr.h:583
#15 0xb3f51e87 in ~nsEditor (this=0x85f7a40) at nsEditor.cpp:217
#16 0xb3f3686f in ~nsPlaintextEditor (this=0x85f7a40) at nsPlaintextEditor.cpp:116
#17 0xb3ed1910 in ~nsHTMLEditor (this=0x85f7a40) at nsHTMLEditor.cpp:236
#18 0xb3f5176b in nsEditor::Release (this=0x85f7a40) at nsEditor.cpp:219
#19 0xb3ed1287 in nsHTMLEditor::Release (this=0x85f7a40) at nsHTMLEditor.cpp:246
#20 0xb3355390 in ~nsCOMPtr (this=0x94fa56c) at ../../../dist/include/xpcom/nsCOMPtr.h:583
#21 0xb339a9a2 in ~nsMsgCompose (this=0x94fa520) at nsMsgCompose.cpp:248
#22 0xb33872a7 in nsMsgCompose::Release (this=0x94fa520) at nsMsgCompose.cpp:251
#23 0xb6fff1a7 in XPCJSRuntime::GCCallback (cx=0x91e8258, status=JSGC_END) at xpcjsruntime.cpp:590
#24 0xb62def1c in DOMGCCallback (cx=0x91e8258, status=JSGC_END) at nsJSEnvironment.cpp:3173
#25 0xb7e1e07a in js_GC (cx=0x91e8258, gckind=GC_NORMAL) at jsgc.c:3198
#26 0xb7dea380 in JS_GC (cx=0x91e8258) at jsapi.c:1886
#27 0xb5b67a9d in nsProfile::ShutDownCurrentProfile (this=0x81d2020, shutDownType=1) at nsProfile.cpp:1354
#28 0x0804a673 in DoOnShutdown () at nsAppRunner.cpp:739
#29 0x0804dfff in main (argc=140475004, argv=0x19) at nsAppRunner.cpp:1726

Comment 16

[Caio Tiago Oliveira (asrail)]

There is even a stack with the crash after the new GC have landed, which you'll have to take into account.

Might I assign that one for you?

Comment 17

[Nir]

yes