411147 - crash [@ nsQueryInterface::operator()(nsID const&, void**)] (windows only)

Status: RESOLVED INCOMPLETE

(Thunderbird :: General, defect)

Description

[Wayne Mery (:wsmwk)]

Thunderbird crash, windows only per crash-stats.  Maybe a windows variation of bug 411145, which is "nsQueryInterface::operator()(nsID const&, void**) const" and on crash-stats is Mac and linux only.

began around 2007092900.  frequency seems to have escalated as of 2007121500.

I've had several myself in the past couple weeks. some call out the frame nsQueryInterface::operator()(nsID const&, void**), but some start with an address (with rest of stack being the same)

today's example is bp-597f8cca-bd2f-11dc-be9c-001a4bd43e5c.
reproducible: no
steps prior to this specific crash:
1. advanced search from a previous search (i.e. already open with one search term)
2. click "+" to add a second search term 
3. click in new input box, I didn't type anything
4. back tab (not click) once or twice
5. crash

Signature	nsQueryInterface::operator()(nsID const&, void**)
UUID	597f8cca-bd2f-11dc-be9c-001a4bd43e5c
Time	2008-01-07 06:45:25-08:00
Build ID	2007123103
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0

0  	nsQueryInterface::operator()(nsID const&, void**)  	 nsCOMPtr.cpp:47
1 	thunderbird.exe@0x795ae3 	
2 	nsCOMPtr<nsIContent>::nsCOMPtr<nsIContent>(nsQueryInterface) 	nsCOMPtr.h:645
3 	nsXULDocument::AttributeChanged(nsIDocument*, nsIContent*, int, nsIAtom*, int, unsigned int) 	mozilla/content/xul/document/src/nsXULDocument.cpp:956
4 	nsNodeUtils::AttributeChanged(nsIContent*, int, nsIAtom*, int, unsigned int) 	mozilla/content/base/src/nsNodeUtils.cpp:109
5 	nsGenericElement::SetAttrAndNotify(int, nsIAtom*, nsIAtom*, nsAString_internal const&, nsAttrValue&, int, int, int) 	mozilla/content/base/src/nsGenericElement.cpp:3710
6 	nsGenericElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, int) 	mozilla/content/base/src/nsGenericElement.cpp:3641
7 	nsGenericElement::SetAttribute(nsAString_internal const&, nsAString_internal const&) 	mozilla/content/base/src/nsGenericElement.cpp:1533
8 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
9 	AutoJSSuspendRequest::SuspendRequest() 	mozilla/js/src/xpconnect/src/xpcprivate.h:3407
10 	nsSelectMoveScrollCommand::DoCommandBrowseWithCaretOn(char const*, nsISelectionController*, nsIEventStateManager*) 	mozilla/dom/src/base/nsGlobalWindowCommands.cpp:291

Comment 1

[Wayne Mery (:wsmwk)]

top 25 crash for v3.1.2

however, stacks vary. for example
bp-3fc30d45-468f-4353-baa1-ac2772100812
bp-4775b96d-d579-4389-9363-f398d2100809
bp-81791686-c221-4557-a12f-620872100812
bp-d9bdde1e-468f-4815-b970-c07952100811

so we probably need a skiplist for nsQueryInterface::operator() so we don't need to rely on manual efforts to track unique stacks.

Comment 2

[Wayne Mery (:wsmwk)]

still topcrash, with the addition of _purecall | nsQueryInterface::operator()(nsID const&, void**)

Comment 3

[Scoobidiver (away)]

It's #63 top crasher in TB 17.0.2 so not a top crasher according to https://wiki.mozilla.org/CrashKill/Topcrash#Top_crash_identification_criteria

Comment 4

[Wayne Mery (:wsmwk)]

#96 crash for TB31, so still exists

who users crashing with address 0x5a5a5a5a
bp-e7e847eb-ab66-47e4-b290-e9cc82140826  dcarter
pb-8abe4327-7a74-431e-bc8a-fba462140829  jean.bidault
 0 	xul.dll	nsQueryInterface::operator()(nsID const&, void**)	xpcom/glue/nsCOMPtr.cpp
1 	xul.dll	nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&)	xpcom/glue/nsCOMPtr.cpp
2 	xul.dll	nsXULElement::GetBuilder()	content/xul/content/src/nsXULElement.cpp
3 	xul.dll	nsXULElement::GetDatabase()	content/xul/content/src/nsXULElement.cpp
4 	xul.dll	nsXULElement::GetDatabase(nsIRDFCompositeDataSource**)	content/xul/content/src/nsXULElement.cpp
5 	xul.dll	mozilla::dom::XULDocument::CheckTemplateBuilderHookup(nsIContent*, bool*)	content/xul/document/src/XULDocument.cpp

Comment 5

[gibran.santos]

Crashing with the latest beta version 38b6.
Report: https://crash-stats.mozilla.com/report/index/4b4e24a3-92b7-46ae-b031-8a8bb2150608

Comment 6

[Wayne Mery (:wsmwk)]

#56 crash for 45.7.0.  I don't think these stacks/this bug are actionable on their own. However, most users I checked have other crash signatures involving "shutdown xxx", like bug 1307963.

Comment 7

[Wayne Mery (:wsmwk)]

Eyballing last 7 days the crash rate of 52 vs 60 look rougly the same. None of the ones I checked have enigmail.  Also, crash rate of last 6 months across all versions remains the same, peaks at ~64 crashes per day https://crash-stats.mozilla.com/signature/?product=Thunderbird&signature=nsQueryInterface%3A%3Aoperator%28%29&date=%3E%3D2018-05-24T15%3A37%3A44.000Z&date=%3C2018-11-24T14%3A37%3A44.000Z#graphs


(In reply to Wayne Mery (:wsmwk) from comment #6)
> #56 crash for 45.7.0.  I don't think these stacks/this bug are actionable on
> their own. However, most users I checked have other crash signatures
> involving "shutdown xxx", like bug 1307963.

That was recently tied to bug 1410286 - enigmail.

Comment 8

[Wayne Mery (:wsmwk)]

nsQueryInterface::operator() doesn't exist for version 68 and we've never had information that describes any context or how to reproduce this. It's either gone or signature morphed to something else