403275 - crash [@ nsMsgAsyncWriteProtocol::UnblockPostReader()]

Status: VERIFIED FIXED

(MailNews Core :: Networking, defect)

Description

[Wayne Mery (:wsmwk)]

#10 crasher for TB 2.0.0.6  nsMsgAsyncWriteProtocol::UnblockPostReader
in nsMsgProtocol?

3 themes, most crashers after some spinning:
 sending mail
 password for return receipts
 opening attachment

odd that 2/3 of the crashes are linux.  linux stack only slightly different from win stack.  Will make more than one bug if needed, but stacks are basically the same.

---------------------------------------------------------------------------------
linux

TB37903772 trying to send a message. complained couldn't reach server, then crashed. (linux)
 Stack Signature	 nsMsgAsyncWriteProtocol::UnblockPostReader() 77706ba7
Product ID	Thunderbird2
Build ID	2007032622
Trigger Time	2007-11-09 16:01:03.0
Platform	LinuxIntel
Operating System	Linux 2.6.13-15.18-default
Module	thunderbird-bin + (00955a01)
URL visited	
User Comments	trying to send a message. It complained that it couldn't reach the server, then crashed.
Since Last Crash	29 sec
Total Uptime	384 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	/builds/tinderbox/Tb-Mozilla1.8/Linux_2.4.18-14_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 848
Stack Trace 	
nsMsgAsyncWriteProtocol::UnblockPostReader()  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 848]
nsMsgProtocolStreamProvider::OnOutputStreamReady()
nsOutputStreamReadyEvent::EventHandler()
PL_HandleEvent()  [mozilla/xpcom/threads/plevent.c, line 688]
PL_ProcessPendingEvents()  [mozilla/xpcom/threads/plevent.c, line 623]
nsEventQueueImpl::ProcessPendingEvents()  [mozilla/xpcom/threads/nsEventQueue.cpp, line 421]
event_processor_callback()  [mozilla/widget/src/gtk2/nsAppShell.cpp, line 71]
libglib-2.0.so.0 + 0x5215f (0x4068e15f)
libglib-2.0.so.0 + 0x2835c (0x4066435c)
libglib-2.0.so.0 + 0x2b7cb (0x406677cb)
libglib-2.0.so.0 + 0x2bae7 (0x40667ae7)
libgtk-x11-2.0.so.0 + 0x12e861 (0x4033d861)
nsAppShell::Run()  [mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
XRE_main()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 848]
main()  [mozilla/mail/app/nsMailApp.cpp, line 63]
libc.so.6 + 0x14ea0 (0x40b2fea0)

TB37885652 http://serpronet.serpro (linux) same stack

---------------------------------------------------------------------------------
windows

TB37774255 opening ... attachement and entering my password to send a mail read confirmation
TB37732096 access e-mails after a week's leave - over 5000 there.... getting messages "too many concurrent connections" 

TB37861389 WON'T LET ME RECEIVE OR SEND ANY MAIL!!! It says my hotmail account has "negative vibes"! I've done everything they say in the forums and it won't let me. 
Since Last Crash	2524824 sec
Total Uptime	2524824 sec
Source File, Line No.	e:/builds/tinderbox/Tb-Mozilla1.8-Release/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1403
Stack Trace 	
nsMsgAsyncWriteProtocol::UnblockPostReader  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1403]
nsMsgProtocolStreamProvider::OnOutputStreamReady  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1092]
nsOutputStreamReadyEvent::EventHandler  [mozilla/xpcom/io/nsStreamUtils.cpp, line 121]

stack variation
TB37810453 downloading mail
nsMsgAsyncWriteProtocol::UnblockPostReader  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1403]
nsMsgProtocolStreamProvider::OnOutputStreamReady  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1092]
nsOutputStreamReadyEvent::EventHandler  [mozilla/xpcom/io/nsStreamUtils.cpp, line 121]
0x778b0c24
nsDocumentOpenInfo::TryContentListener  [mozilla/uriloader/base/nsURILoader.cpp, line 749]  <<<<<<<<<<<<<<

stack variation 
TB37629326 Password with server failed. I chose 'quit' -> crash
nsMsgAsyncWriteProtocol::UnblockPostReader  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1403]
nsMsgProtocolStreamProvider::OnOutputStreamReady  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1092]
nsOutputStreamReadyEvent::EventHandler  [mozilla/xpcom/io/nsStreamUtils.cpp, line 121]
0x778b0c24
nsBindingManager::QueryInterface  [mozilla/content/xbl/src/nsBindingManager.cpp, line 305]  <<<<<<<<<<<<<<<<<<<<<<<


stack variation
TBsend confirmation receipt with not configured smpt server send confirmation receipt with not configured smpt server
nsMsgAsyncWriteProtocol::UnblockPostReader  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1403]
nsMsgProtocolStreamProvider::OnOutputStreamReady  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 1092]
nsOutputStreamReadyEvent::EventHandler  [mozilla/xpcom/io/nsStreamUtils.cpp, line 121]
0x778b0c24
nsFocusController::UpdateCommands  [mozilla/dom/src/base/nsFocusController.cpp, line 221] <<<<<<<<<<

Comment 1

[Wayne Mery (:wsmwk)]

#5 crasher for 2.0.0.12 - needs analysis.
not listed in trunk top crashers

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

It's #25 of the topcrasher list now. Still happens with 2.0.0.19 at least on OS X.

Happened for a friend when he clicked on Sent. No attachments are involved. Any plans to get it solved?

Thread 0 Crashed:
0   org.mozilla.thunderbird             0x004bd57c nsMsgAsyncWriteProtocol::UnblockPostReader() + 92
1   org.mozilla.thunderbird             0x00993892 nsMsgProtocolStreamProvider::OnOutputStreamReady(nsIAsyncOutputStream*) + 200
2   libxpcom_core.dylib                 0x00e7978d nsOutputStreamReadyEvent::EventHandler(PLEvent*) + 45
3   libxpcom_core.dylib                 0x00e4e549 PL_HandleEvent + 21
4   libxpcom_core.dylib                 0x00e4e802 PL_ProcessPendingEvents + 103
5   com.apple.CoreFoundation            0x950125f5 CFRunLoopRunSpecific + 3141
6   com.apple.CoreFoundation            0x95012cd8 CFRunLoopRunInMode + 88
7   com.apple.HIToolbox                 0x947722c0 RunCurrentEventLoopInMode + 283
8   com.apple.HIToolbox                 0x94772012 ReceiveNextEventCommon + 175
9   com.apple.HIToolbox                 0x947d0c6e _AcquireNextEvent + 58
10  com.apple.HIToolbox                 0x947cf3cb RunApplicationEventLoop + 207
11  org.mozilla.thunderbird             0x0036fb6f nsAppShell::~nsAppShell() + 133
12  org.mozilla.thunderbird             0x003d9f52 nsAppStartup::DestroyExitEvent(PLEvent*) + 148
13  org.mozilla.thunderbird             0x000066c6 XRE_main + 5892
14  org.mozilla.thunderbird             0x000032d0 main + 32
15  org.mozilla.thunderbird             0x00003256 start + 270
16  org.mozilla.thunderbird             0x00003171 start + 41

Comment 3

[Wayne Mery (:wsmwk)]

back up to #12 for 20019. However, still not seen in 2 weeks of 3.0b1 crashes.  It seems this might be TB2 only.

Comment 4

[Wayne Mery (:wsmwk)]

still a topcrash for TB2.  doesn't appear in top 100 of 3.0b2 or 3.0b3 (so far) - whih seems odd - but it does exist on trunk. So I think we should want this for TB3 and port this back to TB2

bp-272fc8a0-78e5-4213-8a18-8aa592090522

Comment 5

[Wayne Mery (:wsmwk)]

3.0b4 example ...

bp-7edc2db5-0097-4963-9467-5822a2090929
0	thunderbird.exe	nsMsgAsyncWriteProtocol::UnblockPostReader	 mailnews/base/util/nsMsgProtocol.cpp:1349
1	thunderbird.exe	nsMsgProtocolStreamProvider::OnOutputStreamReady	mailnews/base/util/nsMsgProtocol.cpp:1032
2	xpcom_core.dll	nsOutputStreamReadyEvent::Run	xpcom/io/nsStreamUtils.cpp:111
3	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:521
4	xpcom_core.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:227
5	thunderbird.exe	nsBaseAppShell::Run	widget/src/xpwidgets/nsBaseAppShell.cpp:170

Comment 6

[Wayne Mery (:wsmwk)]

Henrik in comment #2
> It's #25 of the topcrasher list now. Still happens with 2.0.0.19 at least on OS
> X.

currently #13 for 2.0.0.23

> Happened for a friend when he clicked on Sent. No attachments are involved. Any
> plans to get it solved?

there's no real push as it's not in top 300 for v3. If your friend still sees this, additional information might help.

v3.0 example bp-d44e0677-60bc-44d5-8b8f-8ee332091214
0	thunderbird.exe	nsMsgAsyncWriteProtocol::UnblockPostReader	 mailnews/base/util/nsMsgProtocol.cpp:1331
1	thunderbird.exe	nsMsgProtocolStreamProvider::OnOutputStreamReady	mailnews/base/util/nsMsgProtocol.cpp:1032
2	xpcom_core.dll	nsOutputStreamReadyEvent::Run	xpcom/io/nsStreamUtils.cpp:111
3	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:521
4	xpcom_core.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:236
5	thunderbird.exe	nsBaseAppShell::Run	widget/src/xpwidgets/nsBaseAppShell.cpp:170
6	thunderbird.exe	nsAppStartup::Run	toolkit/components/startup/src/nsAppStartup.cpp:193
7	thunderbird.exe	XRE_main	toolkit/xre/nsAppRunner.cpp:3321
8	thunderbird.exe	NS_internal_main
9	thunderbird.exe	wmain
10	thunderbird.exe	__tmainCRTStartup	objdir-tb/mozilla/memory/jemalloc/src/crtexe.c:591

Comment 7

[timeless]

comment 5, m_outputStream is null, and the code isn't being careful about it, fixing that is non trivial.

comment 6 is a different crash, nto sure what's up w/ it.

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to comment #7)
> comment 5, m_outputStream is null, and the code isn't being careful about it,
> fixing that is non trivial.

top 10 crash for v3.1.6
almost no comments. one report with german comment and address
bp-5f5191e7-c3c9-4680-9a33-4029e2101109 v3.1.6 (Christajura)
0	thunderbird.exe	nsMsgAsyncWriteProtocol::UnblockPostReader	mailnews/base/util/nsMsgProtocol.cpp:1343
1	thunderbird.exe	nsMsgProtocolStreamProvider::OnOutputStreamReady	mailnews/base/util/nsMsgProtocol.cpp:1044
2	xpcom_core.dll	nsOutputStreamReadyEvent::Run	xpcom/io/nsStreamUtils.cpp:112
3	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:527

Comment 9

[Wayne Mery (:wsmwk)]

top 10 crash for 3.1.6, so requesting 3.1 wanted

reporter at http://getsatisfaction.com/mozilla_messaging/topics/tb_crashes_when_going_online indicates problem occur immediately after login finishes with mail server - what most people think of is going online

bp-2a29826b-bb6c-4e73-afc4-d01ae2101113 is about sending mail - as are most crash comments.


comment 7, indicates comment 6 matches the original bug report?

Comment 10

[Wayne Mery (:wsmwk)]

bienvenu, would you be able to work up a patch with a tryserver build?

Comment 11

[Wayne Mery (:wsmwk)]

and/or, can you speculate on a potential workaround?

Comment 12

[David :Bienvenu]

I doubt that a protocol log would help here, though we could try (SMTP and/or POP). An nsSocketTransport log might give us more info about what's happening. I'm not sure of the cause of the crash (deleted object, null dereference, etc). I see that nsMsgFilePostHelper doesn't do any ref-counting on the protocol object, so that could be a problem - that's only used for SMTP, not POP3. I could try using a weak reference (strong reference would likely add cycles)

Comment 13

[Wayne Mery (:wsmwk)]

David, 

I think we should make a concerted effort to resolve this crash - it's a carryover from version 2, #15 for version 3.1.9 (there's only one other crash in mailnews code that's higher), and seems to be highly reproducible by those that experience it. https://crash-stats.mozilla.com/report/list?product=Thunderbird&query_search=signature&query_type=exact&query=nsMsgAsyncWriteProtocol%3A%3AUnblockPostReader%28%29&date=03%2F22%2F2011%2003%3A45%3A04&range_value=6&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=1&signature=nsMsgAsyncWriteProtocol%3A%3AUnblockPostReader%28%29

Which stack(s) should we focus on?  (ref comment 7)

I've msged a few people from crash stats and gfsn to ask for 
   timestamp,smtp:5,nsSocketTransport:5

Comment 14

[David :Bienvenu]

Attachment: use weak ref for protocol object

this is a patch against 3.1.x tree that uses a weak reference for the protocol object to see if the crashes are caused by the protocol object going away - I've requested 3.1.x try server builds as well - http://ftp.mozilla.org/pub/mozilla.org/thunderbird/tryserver-builds/[e-mail]-762f16984bd3 - wsmwk, if you get in contact with someone that can easily reproduce this, could you point them at a try server build with this patch and see if it helps? Thx!

Comment 15

[[e-mail]]

Comment on attachment 520999 [details] [diff] [review]
use weak ref for protocol object

It would be neater if you cast to and from nsIStreamListener or reordered the base classes of nsMsgProtocol to optimise the cast to and from nsIChannel.

>+      mMsgProtocol = do_GetWeakReference(static_cast<nsIChannel*> (aProtInstance));
Sigh. Ideally we'd have a version of do_GetWeakReference that works on an nsISupportsWeakReference* directly.

>+        nsMsgAsyncWriteProtocol *protInst = nsnull;
>+        nsCOMPtr<nsIChannel> callback = do_QueryReferent(mMsgProtocol);
>+        if (callback)
>+          protInst = static_cast<nsMsgAsyncWriteProtocol *>(callback.get());
>+        else
>+          return NS_ERROR_FAILURE;
"else before return" ;-)
> if (!callback)
>   return NS_ERROR_FAILURE;
> 
> nsMsgAsyncWriteProtocol *protInst = {more horrible casting...};
You should do something similar with your other cases too, rather than null-checking protInst. r=me with that fixed.

> NS_INTERFACE_MAP_BEGIN(nsMsgAsyncWriteProtocol)
>+   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
> NS_INTERFACE_MAP_END_INHERITING(nsMsgProtocol)
Nit: wrong indent

Comment 16

[David :Bienvenu]

Attachment: fix addressing comments

this is against the 3.1 branch. I'll land it on the trunk once I make sure it works (one chunk doesn't apply on the trunk)

Comment 17

[Mark Banner (:standard8)]

(In reply to comment #16)
> Created attachment 521570 [details] [diff] [review]
> fix addressing comments
> 
> this is against the 3.1 branch. I'll land it on the trunk once I make sure it
> works (one chunk doesn't apply on the trunk)

David: reminder ping. If we want it on the next 3.1, then it'll need to be ready by end of Wednesday really.

Comment 18

[David :Bienvenu]

marking fixed on trunk - http://hg.mozilla.org/comm-central/rev/eb68fbf5e153

though we'll really have to watch crash-stats to see if this is truly fixed.

Comment 19

[Wayne Mery (:wsmwk)]

(In reply to comment #18)
> marking fixed on trunk - http://hg.mozilla.org/comm-central/rev/eb68fbf5e153
> 
> though we'll really have to watch crash-stats to see if this is truly fixed.

the crash is only visible on the released branch builds so we'll need to land it on branch and watch 3.1.10 stats after release.  (in 4 months I see only one crash for all pre and trunk builds)

Comment 20

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #19)
> (In reply to comment #18)
> > marking fixed on trunk - http://hg.mozilla.org/comm-central/rev/eb68fbf5e153
> > 
> > though we'll really have to watch crash-stats to see if this is truly fixed.
> 
> the crash is only visible on the released branch builds so we'll need to
> land it on branch and watch 3.1.10 stats after release.  (in 4 months I see
> only one crash for all pre and trunk builds)

no crashes on crash-stats for version 5 and newer

Comment 21

[Wayne Mery (:wsmwk)]

Comment on attachment 521570 [details] [diff] [review]
fix addressing comments

still topcrash (#10) for version 3.
no regressions reported in 4 months, so requesting for 3.1.17

Comment 22

[David :Bienvenu]

If we had an ESR, I'd say to leave this out, but since we don't, I think it's a relatively safe fix (safer than the code there now).

Comment 23

[Mark Banner (:standard8)]

Checked into 3.1.x: http://hg.mozilla.org/releases/comm-1.9.2/rev/a2ee653d7b7a