crash [@ nsMsgDBFolder::CallFilterPlugins(nsIMsgWindow*, int*)]

RESOLVED FIXED in Thunderbird 3.1a1


MailNews Core
9 years ago
6 years ago


(Reporter: wsmwk, Assigned: rkent)


({crash, fixed-seamonkey2.0.3})

Thunderbird 3.1a1
Windows Vista
crash, fixed-seamonkey2.0.3

Firefox Tracking Flags

(blocking-thunderbird3.0 -, thunderbird3.0 .1-fixed)


(crash signature)


(1 attachment)

crash [@ nsMsgDBFolder::CallFilterPlugins] both TB2 and trunk - not a topcrash.

Mac - Pressed "dismiss all" on Lightening (16 events to dismiss, using caldev server)
nsMsgDBFolder::CallFilterPlugins	nsMsgDBFolder.cpp:2033
nsImapMailFolder::HeaderFetchCompleted	nsImapMailFolder.cpp:5154
NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
nsProxyObjectCallInfo::Run	xpcom/proxy/src/nsProxyEvent.cpp:181
nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:510
NS_ProcessNextEvent_P	nsThreadUtils.cpp:227
nsXULWindow::ShowModal	xpfe/appshell/src/nsXULWindow.cpp:397
nsWindowWatcher::OpenWindowJSInternal	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:959
nsWindowWatcher::OpenWindow	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:419
nsPromptService::DoDialog	embedding/components/windowwatcher/src/nsPromptService.cpp:786
nsPromptService::ConfirmEx	embedding/components/windowwatcher/src/nsPromptService.cpp:397
NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2424
XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1477 

W32 - 	reception de mail
nsMsgDBFolder::CallFilterPlugins  [mozilla/mailnews/base/util/nsMsgDBFolder.cpp, line 2038]
nsMsgLocalMailFolder::UpdateFolder  [mozilla/mailnews/local/src/nsLocalMailFolder.cpp, line 684]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1387]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3966]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1406]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1481]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4367]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1500]
nsJSEventListener::HandleEvent  [mozilla/dom/src/events/nsJSEventListener.cpp, line 195]


9 years ago
Severity: normal → critical
calendar issue??

still quite rare. eg.
bp-b4664cd4-2e36-442e-bd23-95eee2090305  Syncing via CalDav with Google with LOTS of changes. I imported a US Holidays ICS calendar via the mozilla site and it set a 10 minute reminder on ALL the events it imported. I was going through them to remove the reminders.
bp-058a311f-e576-4349-81db-2eac52090519  lightning: "dismiss all" on 106 reminders for a caldav calendar

talkback is down, so didn't get to recheck TB2 stats
Summary: crash [@ nsMsgDBFolder::CallFilterPlugins] → crash [@ nsMsgDBFolder::CallFilterPlugins(nsIMsgWindow*, int*)]
not in Thunderbird's top 10 crashes
#37 crasher and rising for Thunderbird v3.0.0.

80% of crashes with comments mention lightning/calendar.
however, not all crashes have calendar extension, eg

bp-a365eb43-afda-41a7-aa2d-425732091228 is called from pop
0	thunderbird.exe	nsMsgDBFolder::CallFilterPlugins	 mailnews/base/util/nsMsgDBFolder.cpp:2450
1	thunderbird.exe	nsPop3Sink::EndMailDelivery	mailnews/local/src/nsPop3Sink.cpp:425
2	thunderbird.exe	nsPop3Protocol::GetMsg	mailnews/local/src/nsPop3Protocol.cpp:2543
3	thunderbird.exe	nsPop3Protocol::ProcessProtocolState	mailnews/local/src/nsPop3Protocol.cpp:3633
4	thunderbird.exe	nsMsgProtocol::OnDataAvailable	mailnews/base/util/nsMsgProtocol.cpp:359
5	thunderbird.exe	nsInputStreamPump::OnStateTransfer	netwerk/base/src/nsInputStreamPump.cpp:508
6	thunderbird.exe	nsInputStreamPump::OnInputStreamReady	netwerk/base/src/nsInputStreamPump.cpp:398
7	xpcom_core.dll	nsOutputStreamReadyEvent::Run	xpcom/io/nsStreamUtils.cpp:111
8	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:521
9	xpcom_core.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:236 

but some are long loopers
bp-16cc832d-9c35-4c73-bf35-0bc3d2091218 (shutdown hang?)

Comment 4

8 years ago
This crash is on the last line of the following code:

2436 PRUint32 count, *proIndices, *antiIndices;
2437 rv = traitService->GetEnabledIndices(&count, &proIndices, &antiIndices);
2438 PRBool filterForOther = PR_FALSE;
2439 for (PRUint32 i = 0; i < count; ++i)
2440 {
2441 // The trait service determines which traits are globally enabled or
2442 // disabled. If a trait is enabled, it can still be made inactive
2443 // on a particular folder using an inherited property. To do that,
2444 // set "dobayes." + trait proID as an inherited folder property with
2445 // the string value "false"
2446 //
2447 // If any non-junk traits are active on the folder, then the bayes
2448 // processing will calculate probabilities for all enabled traits.
2450 if (proIndices[i] != nsIJunkMailPlugin::JUNK_TRAIT)

I am guessing that the traitService is failing, and leaving count as a random value, which then crashes the array. So the suggested fix would be to both check for errors, and initialize count to zero.
Component: Database → Filters
QA Contact: database → filters


8 years ago
Assignee: nobody → kent

Comment 5

8 years ago
Created attachment 419358 [details] [diff] [review]
assume that traitService is failing
Attachment #419358 - Flags: superreview?
Attachment #419358 - Flags: review?


8 years ago
blocking-thunderbird3.0: --- → ?


8 years ago
Whiteboard: [needs r/sr bienvenu]


8 years ago
Attachment #419358 - Flags: superreview?(bienvenu)
Attachment #419358 - Flags: superreview?
Attachment #419358 - Flags: review?(bienvenu)
Attachment #419358 - Flags: review?


8 years ago
Target Milestone: --- → Thunderbird 3.1a1

Comment 6

8 years ago
Comment on attachment 419358 [details] [diff] [review]
assume that traitService is failing

It's unclear to me how the trait service could be failing but the rest of your analysis makes sense.
Attachment #419358 - Flags: superreview?(bienvenu)
Attachment #419358 - Flags: superreview+
Attachment #419358 - Flags: review?(bienvenu)
Attachment #419358 - Flags: review+

Comment 7

8 years ago
Comment on attachment 419358 [details] [diff] [review]
assume that traitService is failing

checked in


8 years ago
Last Resolved: 8 years ago
Resolution: --- → FIXED
Whiteboard: [needs r/sr bienvenu] → [needs 3.0 approval]


8 years ago
Attachment #419358 - Flags: approval-thunderbird3.0.1?
Not blocking as this isn't in our significant top crasher range. Wanted thought. Will consider approval request later.
blocking-thunderbird3.0: ? → -
status-thunderbird3.0: --- → wanted
Attachment #419358 - Flags: approval-thunderbird3.0.1? → approval-thunderbird3.0.1+

Comment 9

8 years ago
Comment on attachment 419358 [details] [diff] [review]
assume that traitService is failing

Checked in for TB 3.0 as


8 years ago
status-thunderbird3.0: wanted → .1-fixed
Thanks Kent.

can't verify this is gone - we have no testcase, patch only just landed, and crash frequency is insufficient to say it's gone from trunk or 3.0.1pre (crash rate there is not even 1/month).  So verification can't happen until several days after 3.0.1 ships.

removed [needs 3.0 approval]
Whiteboard: [needs 3.0 approval] → [needs verification post 3.0.1]
calendar tie in to traitService? 
can anyone from calendar offer insight?

Bug 541879 filed for crashes that remain in 3.0.1. calendar related crashes with this sig seem to be gone in 3.0.1 - no comments mention calendar and none that I checked list the extension.  however, I can't explain why the crash rate for this sig is not significantly reduced, given that 80% of 3.0.0 crashes with comments cite calendar activity happening at the time of crash. And of crashes without comments, a high % have lightning installed (per spot check). 3.0.0 examples:
Whiteboard: [needs verification post 3.0.1]


8 years ago
Keywords: fixed-seamonkey2.0.3
Crash Signature: [@ nsMsgDBFolder::CallFilterPlugins(nsIMsgWindow*, int*)]
You need to log in before you can comment on or make changes to this bug.