466801 - Crash in [@ morkWriter::PutRowDict(morkEnv*, morkRow*)] ... [@ nsMsgDatabase::Commit]

Status: RESOLVED WONTFIX

(MailNews Core :: Database, defect)

Description

[Alexander Sack]

Forwarded from ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/thunderbird/+bug/279750 (reported against tbird 2.0.0.17).

#0  0xb7f80430 in __kernel_vsyscall ()
#1  0xb7dac4c0 in raise () from /lib/tls/i686/cmov/libpthread.so.0
#2  0x0805841e in nsProfileLock::FatalSignalHandler (signo=-1210368012) at nsProfileLock.cpp:206
	unblock_sigs = {__val = {1024, 0 <repeats 31 times>}}
	oldact = <value optimized out>
#3  <signal handler called>
#4  0xb262e151 in morkWriter::PutRowDict (this=0xc75edb0, ev=0xc7db168, ioRow=0xbf06608) at morkWriter.cpp:1886
	atom = (morkAtom *) 0x80
	stream = (class morkStream *) 0xcd43330
	yarn = {mYarn_Buf = 0x6d3a39, mYarn_Fill = 3216508232, mYarn_Size = 216129432, mYarn_More = 3216508284, 
  mYarn_Form = 216113048, mYarn_Grow = 0xbfb8054c}
	buf = "(±}\f\n\025a²03Ô\fÈiÝ\f\220±}\fô\177c²]\031\207\f|Gß\fl\005¸¿#%a²8\031\207\f\224\005¸¿\000\000\000\000\002\000\000\000t\005¸¿$_'"
	end = (morkCell *) 0xbf05e88
	cells = (morkCell *) 0xbf05e18
#5  0xb262e51b in morkWriter::PutTableDict (this=0xc75edb0, ev=0xc7db168, ioTable=0xcdaceb0) at morkWriter.cpp:1455
	end = (morkRow **) 0xcf98d1c
	r = <value optimized out>
	fill = <value optimized out>
	rows = (morkRow **) 0xcf92a6c
	next = <value optimized out>
#6  0xb262f027 in morkWriter::WriteAllStoreTables (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:1106
	table = (class morkTable *) 0xcdaceb0
	space = (class morkRowSpace *) 0xc8718c8
	c = <value optimized out>
	store = <value optimized out>
#7  0xb262f0dd in morkWriter::OnStoreRowSpacesTables (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:1186
	stream = (class morkStream *) 0xbf05e18
#8  0xb262f279 in morkWriter::WriteMore (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:377
No locals.
#9  0xb2629423 in morkThumb::DoMore_Commit (this=0xc75ec08, ev=0xc7db168) at morkThumb.cpp:514
	writer = (class morkWriter *) 0xc75edb0
#10 0xb262967f in morkThumb::DoMore (this=0xc75ec08, ev=0xc7db168, outTotal=0xbfb806f4, outCurrent=0xbfb806f8, 
    outDone=0xbfb806ec "", outBroken=0xbfb806f0 "") at morkThumb.cpp:530
No locals.
#11 0xb26297c5 in morkThumb::DoMore (this=0xc75ec08, mev=0xc7db190, outTotal=0xbfb806f4, outCurrent=0xbfb806f8, 
    outDone=0xbfb806ec "", outBroken=0xbfb806f0 "") at morkThumb.cpp:193
	outErr = <value optimized out>
	ev = (class morkEnv *) 0xc7db168
#12 0xb6e7cce8 in nsMsgDatabase::Commit (this=0xc517270, commitType=1) at nsMsgDatabase.cpp:1439
	outTotal = 13
	outCurrent = 0
	outDone = 0 '\0'
	outBroken = 0 '\0'
	err = 0
	commitThumb = (class nsIMdbThumb *) 0xc75ec30
	rv = <value optimized out>
	accountManager = {<nsCOMPtr_base> = {mRawPtr = 0xc55d238}, <No data fields>}
#13 0xb6e7c94e in nsMsgDatabase::DeleteHeader (this=0xc517270, msg=0xb689790, instigator=0x0, commit=1, notify=1)
    at nsMsgDatabase.cpp:1905
	key = 989
	flags = 9
	threadParent = 4294967295
	ret = 0
#14 0xb6e7c67e in nsMsgDatabase::DeleteMessages (this=0xc517270, nsMsgKeys=0xbfb80834, instigator=0x0)
    at nsMsgDatabase.cpp:1847
	key = 989
	msgHdr = {<nsCOMPtr_base> = {mRawPtr = 0xb689790}, <No data fields>}
	hasKey = 1
	err = <value optimized out>
	kindex = 0
#15 0xb6ebc522 in nsImapMailFolder::UpdateImapMailboxInfo (this=0xa083f88, aProtocol=0xccdc170, aSpec=0xc55d160)
    at nsImapMailFolder.cpp:2755
	keysToDelete = {<nsUInt32Array> = {_vptr.nsUInt32Array = 0xb6fdd7f0, m_nSize = 1, m_nMaxSize = 8, m_nGrowBy = 0, 
    m_pData = 0xc802430}, <No data fields>}
	flagState = {<nsCOMPtr_base> = {mRawPtr = 0xd046138}, <No data fields>}
	numNewUnread = <value optimized out>
	dbFolderInfo = {<nsCOMPtr_base> = {mRawPtr = 0xb5b2c40}, <No data fields>}
	imapUIDValidity = 1090334162
	supportedUserFlags = 60928
	existingKeys = {<nsUInt32Array> = {_vptr.nsUInt32Array = 0xb6fdd7f0, m_nSize = 7250, m_nMaxSize = 7715, 
    m_nGrowBy = 0, m_pData = 0xcd5b3c0}, <No data fields>}
	keysToFetch = {<nsUInt32Array> = {_vptr.nsUInt32Array = 0xb6fdd7f0, m_nSize = 1, m_nMaxSize = 8, m_nGrowBy = 0, 
    m_pData = 0xcfb5fc8}, <No data fields>}
	folderValidity = 1090334162
	numUnreadFromServer = <value optimized out>
	rv = 0
	folderSelected = 1
#16 0xb7e8edc9 in XPTC_InvokeByIndex () from /usr/lib/thunderbird/libxpcom_core.so
No locals.
#17 0xb7e7b39b in EventHandler (self=0xc55d130) at nsProxyEvent.cpp:561
	rv = <value optimized out>
#18 0xb7e74ca7 in PL_HandleEvent (self=0xc55d130) at plevent.c:688
	result = <value optimized out>
#19 0xb7e74fad in PL_ProcessPendingEvents (self=0x9715628) at plevent.c:623
	event = (PLEvent *) 0xbf05e18
	count = 0
#20 0xb7e76ba8 in nsEventQueueImpl::ProcessPendingEvents (this=0x96e7748) at nsEventQueue.cpp:448
	correctThread = <value optimized out>
	rv = 0
	caller = {mQueue = 0x96e7748, mListener = {<nsCOMPtr_base> = {mRawPtr = 0x970242c}, <No data fields>}}
#21 0xb5bda815 in event_processor_callback (source=0x9a46de8, condition=G_IO_IN, data=0x0) at nsAppShell.cpp:67
No locals.
#22 0xb76a372d in g_io_unix_dispatch (source=0x9a46e30, callback=0xb5bda800 <event_processor_callback>, 
    user_data=0x96e7748) at /build/buildd/glib2.0-2.18.1/glib/giounix.c:162
	buffer_condition = 0
#23 0xb766c6f8 in IA__g_main_context_dispatch (context=0x9697dc8) at /build/buildd/glib2.0-2.18.1/glib/gmain.c:2142
No locals.
#24 0xb766fda3 in g_main_context_iterate (context=0x9697dc8, block=1, dispatch=1, self=0x9670930)
    at /build/buildd/glib2.0-2.18.1/glib/gmain.c:2776
	max_priority = 2147483647
	timeout = -1
	some_ready = 1
	nfds = 12
	allocated_nfds = <value optimized out>
	fds = (GPollFD *) 0xaa1f808
	__PRETTY_FUNCTION__ = "g_main_context_iterate"
#25 0xb76702c2 in IA__g_main_loop_run (loop=0x9a46390) at /build/buildd/glib2.0-2.18.1/glib/gmain.c:2984
	self = (GThread *) 0x9670930
	__PRETTY_FUNCTION__ = "IA__g_main_loop_run"
#26 0xb7b22269 in IA__gtk_main () at /build/buildd/gtk+2.0-2.14.3/gtk/gtkmain.c:1200
	tmp_list = (GList *) 0xb5291010
	functions = (GList *) 0x0
	init = (GtkInitFunction *) 0x9786ee8
	loop = (GMainLoop *) 0x9a46390
#27 0xb5bdae76 in nsAppShell::Run (this=0x9786ee8) at nsAppShell.cpp:139
No locals.
#28 0xb5af3287 in nsAppStartup::Run (this=0x9792f00) at nsAppStartup.cpp:151
	rv = <value optimized out>
#29 0x0804fcaa in XRE_main (argc=1, argv=0xbfb80ee4, aAppData=0x805a8e0) at nsAppRunner.cpp:2817
	remoteService = {<nsCOMPtr_base> = {mRawPtr = 0x9a46150}, <No data fields>}
	obsService = {<nsCOMPtr_base> = {mRawPtr = 0x9715708}, <No data fields>}
	windowMediator = {<nsCOMPtr_base> = {mRawPtr = 0x986d0c0}, <No data fields>}
	windowEnumerator = {<nsCOMPtr_base> = {mRawPtr = 0x991cd40}, <No data fields>}
	more = 1
	appStartup = {<nsCOMPtr_base> = {mRawPtr = 0x9792f00}, <No data fields>}
	workingDir = {<nsCOMPtr_base> = {mRawPtr = 0x989b298}, <No data fields>}
	chromeObserver = {<nsCOMPtr_base> = {mRawPtr = 0x9716bd0}, <No data fields>}
	cmdLine = {<nsCOMPtr_base> = {mRawPtr = 0x989b270}, <No data fields>}
	noEMRestart = <value optimized out>
	xpcom = {mServiceManager = 0x96af84c}
	rv = 0
	ar = <value optimized out>
	gtkModules = <value optimized out>
	i = <value optimized out>
	dirProvider = {<nsIDirectoryServiceProvider2> = {<nsIDirectoryServiceProvider> = {<nsISupports> = {
        _vptr.nsISupports = 0x805aae8}, <No data fields>}, <No data fields>}, <nsIProfileStartup> = {<nsISupports> = {
      _vptr.nsISupports = 0x805ab0c}, <No data fields>}, mAppDir = {<nsCOMPtr_base> = {
      mRawPtr = 0x96709e0}, <No data fields>}, mXULAppDir = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}, 
  mProfileDir = {<nsCOMPtr_base> = {mRawPtr = 0x9699200}, <No data fields>}, mProfileLocalDir = {<nsCOMPtr_base> = {
      mRawPtr = 0x9699278}, <No data fields>}, mProfileNotified = 1}
	glib2 = (PRLibrary *) 0x96704f0
	nativeApp = {<nsCOMPtr_base> = {mRawPtr = 0x9697438}, <No data fields>}
	canRun = 1
	registryFile = {<nsCOMPtr_base> = {mRawPtr = 0x9698da8}, <No data fields>}
	xremotearg = <value optimized out>
	profileLock = {<nsCOMPtr_base> = {mRawPtr = 0x96a9948}, <No data fields>}
	startOffline = 0
	profD = {<nsCOMPtr_base> = {mRawPtr = 0x9699200}, <No data fields>}
	profLD = {<nsCOMPtr_base> = {mRawPtr = 0x9699278}, <No data fields>}
	upgraded = 0
	version = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0xb7ea8c68, 
          mData = 0xbfb80dd8 "2.0.0.17_2008092517/1.8.1.17_2008092517", mLength = 39, 
          mFlags = 65553}, <No data fields>}, <No data fields>}, mFixedCapacity = 63, 
    mFixedBuf = 0xbfb80dd8 "2.0.0.17_2008092517/1.8.1.17_2008092517"}, 
  mStorage = "2.0.0.17_2008092517/1.8.1.17_2008092517\000 \030æ·\004\000\000\000\030\016¸¿à\237.·ô\217ê·\034,ê·"}
	osABI = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0xb7ea8c68, 
        mData = 0x80588de "Linux_x86-gcc3", mLength = 14, 
        mFlags = 1}, <No data fields>}, <No data fields>}, <No data fields>}
	versionOK = <value optimized out>
	needsRestart = 0
	appInitiatedRestart = <value optimized out>
#30 0x0804ad0f in main (argc=210180296, argv=0x0) at nsMailApp.cpp:62
No locals.

Comment 1

[Wayne Mery (:wsmwk)]

appears to be same as these 3.0b4 crashes
bp-d33752af-6824-4153-9726-def3b2091018
bp-80f14980-3cff-4b81-b440-1eaf22091021

Comment 2

[Wayne Mery (:wsmwk)]

comment 0 report states "Thunderbird wasn't even the active window when it crashed. I assume it was doing a regular check for new mail when it crashed."

bp-8e6635ce-ffa6-4519-865e-de9802091214 comment is "browsing imap folders"

Comment 3

[Wayne Mery (:wsmwk)]

#159 crash for v3.1.7.  
related? to Bug 628381 - crash [@ morkWriter::PutTableDict(morkEnv*, morkTable*)] ... [@ nsMsgDatabase::Commit]


----------
line 1885

currently, majority of morkWriter::PutRowDict(morkEnv*, morkRow*) crashes are like
bp-11a6eda3-a291-4ba3-b17e-7ff5b2110121  
EXCEPTION_ACCESS_VIOLATION_READ
0x60004
0
1	thunderbird.exe	morkWriter::PutTableDict	db/mork/src/morkWriter.cpp:1455
2	thunderbird.exe	morkWriter::WriteAllStoreTables	db/mork/src/morkWriter.cpp:1106
3	thunderbird.exe	morkWriter::OnStoreRowSpacesTables	db/mork/src/morkWriter.cpp:1186
4	thunderbird.exe	morkWriter::WriteMore	db/mork/src/morkWriter.cpp:377
5	thunderbird.exe	morkThumb::DoMore_Commit	db/mork/src/morkThumb.cpp:514
6	thunderbird.exe	morkThumb::DoMore	db/mork/src/morkThumb.cpp:408
7	thunderbird.exe	morkThumb::DoMore	db/mork/src/morkThumb.cpp:193
8	thunderbird.exe	nsMsgDatabase::Commit	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1343
9	thunderbird.exe	nsMailDatabase::SetSummaryValid	mailnews/db/msgdb/src/nsMailDatabase.cpp:505
10	thunderbird.exe	nsMailDatabase::EndBatch	mailnews/db/msgdb/src/nsMailDatabase.cpp:164 


-----
line 1886

bp-31561f8c-beff-45f8-8c67-50c43210120 (saunders) v3.1.6
0	thunderbird.exe	morkWriter::PutRowDict	db/mork/src/morkWriter.cpp:1886
1	thunderbird.exe	morkWriter::PutTableDict	db/mork/src/morkWriter.cpp:1455
2	thunderbird.exe	morkWriter::WriteAllStoreTables	db/mork/src/morkWriter.cpp:1106
3	thunderbird.exe	morkWriter::OnStoreRowSpacesTables	db/mork/src/morkWriter.cpp:1186
4	thunderbird.exe	morkWriter::WriteMore	db/mork/src/morkWriter.cpp:377
5	thunderbird.exe	morkThumb::DoMore_Commit	db/mork/src/morkThumb.cpp:514
6	thunderbird.exe	morkThumb::DoMore	db/mork/src/morkThumb.cpp:408
7	thunderbird.exe	morkThumb::DoMore	db/mork/src/morkThumb.cpp:193
8	thunderbird.exe	nsMsgDatabase::Commit	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1343
9	thunderbird.exe	nsMsgDBFolder::SetStringProperty	mailnews/base/util/nsMsgDBFolder.cpp:2038
10	thunderbird.exe	nsMsgDBFolder::SetMRUTime	mailnews/base/util/nsMsgDBFolder.cpp:5629
11	thunderbird.exe	nsMsgDBFolder::SetHasNewMessages	mailnews/base/util/nsMsgDBFolder.cpp:525
12	thunderbird.exe	nsMsgDBFolder::CheckWithNewMessagesStatus	mailnews/base/util/nsMsgDBFolder.cpp:1042 

bp-203a6c32-8836-4b72-a4b7-9d6822101010 Mac v3.1.5 
bp-d0417ff8-8112-4465-860f-e11452110124 windows v3.1.7

Comment 4

[Wayne Mery (:wsmwk)]

@ morkWriter::PutRowDict for Mac and linux

Comment 5

[:aceman]

Just got this in TB11.0.1:
bp-f6d6d67d-62c7-4496-aa13-663b02120519

And the conditions were the same as in comment 1.

After TB restart I found 3 copies of the same message (same UIDL from POP3 server) in 2 folders (one in Inbox, 2 in the folder where a filter would normally put them).

Comment 6

[Wayne Mery (:wsmwk)]

(In reply to :aceman from comment #5)
> Just got this in TB11.0.1:
> bp-f6d6d67d-62c7-4496-aa13-663b02120519
> 
> And the conditions were the same as in comment 1.

do you mean comment 2?


freaky. 

unfortunately I have no further info to offer. none of the crashes for all releases of last 4 months have any comments.

Comment 7

[:aceman]

Yes, comment 2.
Other than this single crash, TB was stable for me for a long time (I do not remember any past crashes but I could look in about:crashes).

Comment 8

[Wayne Mery (:wsmwk)]

ranks as #1 mork crash

Comment 9

[Wayne Mery (:wsmwk)]

bp-4b752274-d8a5-4083-9003-086292130713
0	xul.dll	morkWriter::PutRowDict	db/mork/src/morkWriter.cpp:1854
1	xul.dll	morkWriter::PutTableDict	db/mork/src/morkWriter.cpp:1423
2	xul.dll	morkWriter::WriteAllStoreTables	db/mork/src/morkWriter.cpp:1074
3	xul.dll	morkWriter::OnStoreRowSpacesTables	db/mork/src/morkWriter.cpp:1154
4	xul.dll	morkWriter::WriteMore	db/mork/src/morkWriter.cpp:345
5	xul.dll	morkThumb::DoMore_Commit	db/mork/src/morkThumb.cpp:478
6	xul.dll	morkThumb::DoMore	db/mork/src/morkThumb.cpp:372
7	xul.dll	morkThumb::DoMore	db/mork/src/morkThumb.cpp:157
8	xul.dll	nsMsgDatabase::Commit	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1588
9	xul.dll	nsMsgDBFolder::SetStringProperty	mailnews/base/util/nsMsgDBFolder.cpp:2192
10	xul.dll	nsMsgDBFolder::SetMRUTime	mailnews/base/util/nsMsgDBFolder.cpp:5726
11	xul.dll	nsMsgDBFolder::SetHasNewMessages	mailnews/base/util/nsMsgDBFolder.cpp:483
12	xul.dll	nsMsgDBFolder::OnHdrAdded	mailnews/base/util/nsMsgDBFolder.cpp:1067
13	xul.dll	nsMsgDatabase::NotifyHdrAddedAll	mailnews/db/msgdb/src/nsMsgDatabase.cpp:875
14	xul.dll	nsMsgDatabase::AddNewHdrToDB	mailnews/db/msgdb/src/nsMsgDatabase.cpp:3551
15	xul.dll	nsParseNewMailState::PublishMsgHeader	mailnews/local/src/nsParseMailbox.cpp:1915
16	xul.dll	nsParseNewMailState::DoneParsingFolder	mailnews/local/src/nsParseMailbox.cpp:1810
17	xul.dll	nsMsgMailboxParser::OnStopRequest	mailnews/local/src/nsParseMailbox.cpp:166
18	xul.dll	nsMsgLocalMailFolder::AddMessageBatch	mailnews/local/src/nsLocalMailFolder.cpp:3551
19	xul.dll	nsMsgLocalMailFolder::AddMessage	mailnews/local/src/nsLocalMailFolder.cpp:3486 

matjk7@8377 1835 mork_bool
matjk7@8377 1836 morkWriter::PutRowDict(morkEnv* ev, morkRow* ioRow)
matjk7@8377 1837 {
matjk7@8377 1838 mWriter_RowForm = mWriter_TableForm;
matjk7@8377 1839
matjk7@8377 1840 morkCell* cells = ioRow->mRow_Cells;
matjk7@8377 1841 if ( cells )
matjk7@8377 1842 {
matjk7@8377 1843 morkStream* stream = mWriter_Stream;
matjk7@8377 1844 mdbYarn yarn; // to ref content inside atom
matjk7@8377 1845 char buf[ 64 ]; // buffer for staging the dict alias hex ID
matjk7@8377 1846 char* idBuf = buf + 1; // where the id always starts
matjk7@8377 1847 buf[ 0 ] = '('; // we always start with open paren
matjk7@8377 1848
matjk7@8377 1849 morkCell* end = cells + ioRow->mRow_Length;
matjk7@8377 1850 --cells; // prepare for preincrement:
matjk7@8377 1851 while ( ++cells < end && ev->Good() )
matjk7@8377 1852 {
matjk7@8377 1853 morkAtom* atom = cells->GetAtom();
matjk7@8377 1854 if ( atom && atom->IsAtomDirty() )

Comment 10

[Wayne Mery (:wsmwk)]

With bug 1572000 and addressbook rewrite coming, no mork crashes ranking above #160, and no one wanting to touch Mork code, it's safe to say that no one is going to fix any currently reported mork crash. Thus => wontfix (and we don't have to see these rare crashes as open bugs anymore)