crash in [@ nsMsgDBFolder::NotifyItemRemoved(nsISupports*)] because mailnews doesn't use proper references deleting mail/messages

NEW
Unassigned

Status

MailNews Core
Database
--
critical
11 years ago
2 years ago

People

(Reporter: arno renevier, Unassigned)

Tracking

(Depends on: 1 bug, {crash, qawanted})

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [rare], crash signature)

(Reporter)

Description

11 years ago
in a thunderbird extension, I have the following code:

var crashFolderListener = {
    
    QueryInterface: function(iid) {
        dump("QueryInterface" + iid + "\n");
        if (iid.equals(Components.interfaces.nsIFolderListener) ||
            iid.equals(Components.interfaces.nsISupportsWeakReference) ||
            iid.equals(Components.interfaces.nsISupports))
            return this;
        throw Components.results.NS_NOINTERFACE;
    },
     
     OnItemAdded: function(parentItem, item) {
         dump("OnItemAdded\n");
         },
     OnItemBoolPropertyChanged: function(item, property, oldValue, newValue) {
         dump("OnItemBoolPropertyChanged\n");
         },
     OnItemEvent: function(item, event) {
         dump("OnItemEvent\n");
         },
     OnItemIntPropertyChanged: function(item, property, oldValue, newValue) {
         dump("OnItemIntPropertyChanged\n");
         },
     OnItemPropertyChanged: function(item, property, oldValue, newValue) {
         dump("OnItemPropertyChanged\n");
         },
     OnItemPropertyFlagChanged: function(item, property, oldFlag, newFlag) {
         dump("OnItemPropertyFlagChanged\n");
         },
     OnItemRemoved: function(parentItem, item) {
         dump("OnItemRemoved\n");
         },
     OnItemUnicharPropertyChanged: function(item, property, oldValue, newValue) {
         dump("OnItemUnicharPropertyChanged\n");
         }
}

function crashOnLoad() {
    var mboxUri = 'mailbox://xxxx@xxxx@xxxx/Inbox'; // my mailbox uri

    var rdf = Components.classes["@mozilla.org/rdf/rdf-service;1"].getService(Components.interfaces.nsIRDFService);
    var resource = RDF.GetResource(mboxUri);

    var folder = resource.QueryInterface(Components.interfaces.nsIMsgFolder);

    folder.AddFolderListener(crashFolderListener);

}

window.addEventListener("load", crashOnLoad, false);



As soon as I try to download messages, QueryInterface method crashFolderListener is called, and thunderbird crashes directly after. More precisely, it happens because NotifyItemRemoved is called.

I've set some printf in mailnews/base/util/nsMsgDBFolder.cpp, and it seems that the crash occurs on that very line:  listener->OnItemRemoved(this, item);

I also observed the same crash in OnItemIntPropertyChanged on the line  listener->OnItemIntPropertyChanged(this, property, oldValue, newValue); 
and I suspect the bug may occur on any method of the folderlistener

#0  0xb62bb79c in nsMsgDBFolder::NotifyItemRemoved () from /home/arno/thunderbird/dist/bin/components/libmail.so
#1  0xb62b4ef1 in nsMsgDBFolder::OnHdrAddedOrDeleted () from /home/arno/thunderbird/dist/bin/components/libmail.so
#2  0xb62b90d8 in nsMsgDBFolder::OnParentChanged () from /home/arno/thunderbird/dist/bin/components/libmail.so
#3  0xb63cf8ea in nsMsgDatabase::NotifyParentChangedAll () from /home/arno/thunderbird/dist/bin/components/libmail.so
#4  0xb63db67f in nsMsgThread::ReparentNonReferenceChildrenOf () from /home/arno/thunderbird/dist/bin/components/libmail.so
#5  0xb63db7d9 in nsMsgThread::RerootThread () from /home/arno/thunderbird/dist/bin/components/libmail.so
#6  0xb63dcafa in nsMsgThread::AddChild () from /home/arno/thunderbird/dist/bin/components/libmail.so
#7  0xb63d0e7d in nsMsgDatabase::AddToThread () from /home/arno/thunderbird/dist/bin/components/libmail.so
#8  0xb63d19fd in nsMsgDatabase::ThreadNewHdr () from /home/arno/thunderbird/dist/bin/components/libmail.so
#9  0xb63ce00a in nsMsgDatabase::AddNewHdrToDB () from /home/arno/thunderbird/dist/bin/components/libmail.so
#10 0xb63622b6 in nsMsgMailboxParser::PublishMsgHeader () from /home/arno/thunderbird/dist/bin/components/libmail.so
#11 0xb63604af in nsMsgMailboxParser::HandleLine () from /home/arno/thunderbird/dist/bin/components/libmail.so
#12 0xb62b41dd in nsMsgLineBuffer::ConvertAndSendBuffer () from /home/arno/thunderbird/dist/bin/components/libmail.so
#13 0xb62b4a42 in nsMsgLineBuffer::BufferInput () from /home/arno/thunderbird/dist/bin/components/libmail.so
#14 0xb6361ddb in nsMsgMailboxParser::ProcessMailboxInputStream () from /home/arno/thunderbird/dist/bin/components/libmail.so
#15 0xb63601e4 in nsMsgMailboxParser::OnDataAvailable () from /home/arno/thunderbird/dist/bin/components/libmail.so
#16 0xb6366430 in nsMailboxProtocol::ReadFolderResponse () from /home/arno/thunderbird/dist/bin/components/libmail.so
#17 0xb636717d in nsMailboxProtocol::ProcessProtocolState () from /home/arno/thunderbird/dist/bin/components/libmail.so
#18 0xb62d551a in nsMsgProtocol::OnDataAvailable () from /home/arno/thunderbird/dist/bin/components/libmail.so
#19 0xb7162a55 in nsInputStreamPump::OnStateTransfer () from /home/arno/thunderbird/dist/bin/components/libnecko.so
#20 0xb7162b65 in nsInputStreamPump::OnInputStreamReady () from /home/arno/thunderbird/dist/bin/components/libnecko.so
#21 0xb7e34c25 in nsInputStreamReadyEvent::EventHandler () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#22 0xb7e47f57 in PL_HandleEvent () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#23 0xb7e48237 in PL_ProcessPendingEvents () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#24 0xb7e49dfd in nsEventQueueImpl::ProcessPendingEvents () from /home/arno/thunderbird/dist/bin/libxpcom_core.so
#25 0xb67bff45 in event_processor_callback () from /home/arno/thunderbird/dist/bin/components/libwidget_gtk2.so
#26 0xb777bc7f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0
#27 0xb7752731 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#28 0xb77557a6 in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#29 0xb7755b67 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#30 0xb7bc0281 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#31 0xb67c0345 in nsAppShell::Run () from /home/arno/thunderbird/dist/bin/components/libwidget_gtk2.so
#32 0xb6782ad7 in nsAppStartup::Run () from /home/arno/thunderbird/dist/bin/components/libtoolkitcomps.so
#33 0x0804f651 in XRE_main ()
#34 0x0804ae23 in main ()

Comment 1

11 years ago
This feels like a duplicate.
http://mxr.mozilla.org/seamonkey/source/mailnews/base/util/nsMsgDBFolder.h
 201   nsVoidArray mListeners; //This can't be an nsISupportsArray because due to
 202                           //ownership issues, listeners can't be AddRef'd

For now, you're going to need to change your code such that you have /something/ holding a strong reference to your object. You could register with the observerservice and ask to listen for xpcom-shutdown.

Somewhere, I have a patch that enables code to recognize javascript objects and complain (It'd protect you against the crash...).
Assignee: mscott → bienvenu
Component: General → MailNews: Database
Product: Thunderbird → Core
QA Contact: general → database
Summary: crash in nsMsgDBFolder::NotifyItemRemoved → crash in [@ nsMsgDBFolder::NotifyItemRemoved] because mailnews doesn't use proper references
(Assignee)

Updated

11 years ago
Product: Core → MailNews Core

Comment 2

10 years ago
(In reply to comment #1)
> This feels like a duplicate.
> http://mxr.mozilla.org/seamonkey/source/mailnews/base/util/nsMsgDBFolder.h
>  201   nsVoidArray mListeners; //This can't be an nsISupportsArray because due
> to
>  202                           //ownership issues, listeners can't be AddRef'd
> 
> For now, you're going to need to change your code such that you have
> /something/ holding a strong reference to your object. You could register with
> the observerservice and ask to listen for xpcom-shutdown.
> 
> Somewhere, I have a patch that enables code to recognize javascript objects and
> complain (It'd protect you against the crash...).

timeless, that would help extensions in general, right?  Since like it would be nice to have.

Comment 3

10 years ago
yes....

Comment 4

10 years ago
(In reply to comment #2)
> 
> timeless, that would help extensions in general, right?  Since[SEEMS] like it would be
> nice to have.
(In reply to comment #3)
> yes....

cool. will you file the bug if it isn't already? Or let me know if you want me to do somethin.

Comment 5

8 years ago
bienvenu, ref: comment 1 - do you think this is a duplicate?

examining ~10 crashes, I don't see any common add-ons in use. comments all mention deleting messages. #193 crash for v3.1.2

example crashes...

bp-35619614-723f-4e07-888b-bdd482100817 (u.b.muc)  v3.1.2
0	thunderbird.exe	nsMsgDBFolder::NotifyItemRemoved	 mailnews/base/util/nsMsgDBFolder.cpp:4877
1	thunderbird.exe	nsMsgDBFolder::OnHdrAddedOrDeleted	mailnews/base/util/nsMsgDBFolder.cpp:1080
2	thunderbird.exe	nsMsgDBFolder::OnHdrDeleted	mailnews/base/util/nsMsgDBFolder.cpp:1063
3	thunderbird.exe	nsMsgDatabase::NotifyHdrDeletedAll	mailnews/db/msgdb/src/nsMsgDatabase.cpp:724
4	thunderbird.exe	nsMsgDatabase::DeleteHeader	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1810
5	thunderbird.exe	nsMsgDatabase::DeleteMessages	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1753
6	thunderbird.exe	nsImapMailFolder::CopyMessagesOffline	mailnews/imap/src/nsImapMailFolder.cpp:7118
7	thunderbird.exe	nsImapMailFolder::CopyMessages	mailnews/imap/src/nsImapMailFolder.cpp:7276
8	thunderbird.exe	nsMsgCopyService::DoNextCopy	mailnews/base/src/nsMsgCopyService.cpp:321
9	thunderbird.exe	nsMsgCopyService::DoCopy	mailnews/base/src/nsMsgCopyService.cpp:263
10	thunderbird.exe	nsMsgCopyService::CopyMessages	mailnews/base/src/nsMsgCopyService.cpp:531 

bp-fb789f81-b3d3-42b1-9818-437c72100818 (arkon) v3.1.1
bp-9f6d7d17-39ce-45a9-ac8c-97c5f2100817 (harbant) v3.1
Status: NEW → UNCONFIRMED
Ever confirmed: false
OS: Linux → All
Summary: crash in [@ nsMsgDBFolder::NotifyItemRemoved] because mailnews doesn't use proper references → crash in [@ nsMsgDBFolder::NotifyItemRemoved(nsISupports*)] because mailnews doesn't use proper references deleting mail/messages

Updated

8 years ago
Status: UNCONFIRMED → NEW
Ever confirmed: true

Comment 6

8 years ago
yes, this is a duplicate, and timeless's analysis is correct.

Comment 7

8 years ago
(In reply to comment #6)
> yes, this is a duplicate, and timeless's analysis is correct.

I may have had the dup in my grip, but I've lost it. Perhaps someone else can find it
Whiteboard: dupme
(Assignee)

Updated

7 years ago
Crash Signature: [@ nsMsgDBFolder::NotifyItemRemoved(nsISupports*)]

Comment 8

6 years ago
This appears to be EXTREMELY rare starting with version 5, i.e. pretty much gone after v3.1. So something got fixed

I find only two examples from the past ~10 
bp-fdb74b4e-0306-41f1-b308-5164b2120324 v12
bp-3fd4542d-133a-4e3f-bcb4-687c22111220 v8
Crash Signature: [@ nsMsgDBFolder::NotifyItemRemoved(nsISupports*)] → [@ nsMsgDBFolder::NotifyItemRemoved(nsISupports*)] [@ nsCOMPtr_base::assign_with_AddRef(nsISupports*) | nsMsgDBFolder::NotifyItemRemoved(nsISupports*) ] [@ nsCOMPtr_base::assign_with_AddRef | nsMsgDBFolder::NotifyItemRemoved ]Th
Whiteboard: dupme → [rare][dupeme?][fixed?]

Updated

6 years ago
Assignee: mozilla → nobody

Comment 9

6 years ago
many comments mention deleting messages.
some mention compact.
not as rare any more

bp-f463a95e-bc42-4275-aff4-5f71f2121024
bp-eebe71a8-3ef5-4533-80b0-d8af32120920
Crash Signature: [@ nsMsgDBFolder::NotifyItemRemoved(nsISupports*)] [@ nsCOMPtr_base::assign_with_AddRef(nsISupports*) | nsMsgDBFolder::NotifyItemRemoved(nsISupports*) ] [@ nsCOMPtr_base::assign_with_AddRef | nsMsgDBFolder::NotifyItemRemoved ]Th → [@ nsMsgDBFolder::NotifyItemRemoved(nsISupports*)] [@ nsCOMPtr_base::assign_with_AddRef(nsISupports*) | nsMsgDBFolder::NotifyItemRemoved(nsISupports*) ] [@ nsCOMPtr_base::assign_with_AddRef | nsMsgDBFolder::NotifyItemRemoved ] [@ nsMsgDBFolder::…
Keywords: qawanted
Whiteboard: [rare][dupeme?][fixed?] → [rare]

Comment 10

5 years ago
I just noticed comment 1.  xref Bug 409458 - Crash when adding listener to local folder [@ nsMsgDBFolder::NotifyItemAdded(nsISupports*)

xref bug 458977

Updated

4 years ago
See Also: → bug 458977

Updated

2 years ago
Depends on: 409458
You need to log in before you can comment on or make changes to this bug.