Closed Bug 475280 Opened 16 years ago Closed 9 years ago

crashed on shutdown [@ nsTransactionItem::Release()]

Categories

(MailNews Core :: Networking: IMAP, defect)

Product:
MailNews Core
Component:
Networking: IMAP
Version:
1.9.0 Branch
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED WORKSFORME

People

(Reporter: whimboo, Unassigned)

Details

(Keywords: crash, Whiteboard: [needs patch and editor-transaction-use audit based on comment 4][rare])

Crash Data

Shredder 3.0b2pre Today I migrated my whole system to the new MBP. After moving the Thunderbird profiles and having Shredder running for a while it crashed in the background with the following stack. Now I'm not able to start Shredder anymore. Haven't restarted yet but within a session it doesn't come up again. Crash: bp-f133a2d1-bcaa-415f-86d8-1cdda209012 0 thunderbird-bin nsTransactionItem::Release editor/txmgr/src/nsTransactionItem.cpp:74 1 thunderbird-bin nsTransactionStack::Clear nsAutoPtr.h:944 2 thunderbird-bin nsTransactionStack::Clear editor/txmgr/src/nsTransactionStack.cpp:51 3 thunderbird-bin thunderbird-bin@0x44d63a 4 thunderbird-bin nsTransactionManager::Release editor/txmgr/src/nsTransactionManager.cpp:104 5 libxpcom_core.dylib libxpcom_core.dylib@0x32d3 6 thunderbird-bin thunderbird-bin@0xf7a01 7 thunderbird-bin nsMessenger::Release nsMessenger.cpp:326 8 thunderbird-bin XPCJSRuntime::GCCallback js/src/xpconnect/src/xpcjsruntime.cpp:765 9 thunderbird-bin DOMGCCallback dom/src/base/nsJSEnvironment.cpp:3592 10 libmozjs.dylib js_GC js/src/jsgc.cpp:3744 11 libmozjs.dylib JS_GC js/src/jsapi.cpp:2487 12 thunderbird-bin nsXREDirProvider::DoShutdown toolkit/xre/nsXREDirProvider.cpp:864 13 thunderbird-bin ScopedXPCOMStartup::RegisterProfileService toolkit/xre/nsAppRunner.cpp:947 14 thunderbird-bin XRE_main toolkit/xre/nsAppRunner.cpp:3320 15 thunderbird-bin main nsMailApp.cpp:103 16 thunderbird-bin thunderbird-bin@0x1aa5 17 thunderbird-bin thunderbird-bin@0x19cc
There are just two 3.0b2 crashes in the last 3 months, for all 3.0x builds. both are win XP. bp-7862d546-3a46-43e4-b1e2-73b192090420 bp-cbe5ae61-213f-4909-b4e8-1752b2090326 0 thunderbird.exe nsTransactionItem::Release editor/txmgr/src/nsTransactionItem.cpp:74 1 thunderbird.exe nsRefPtr<nsTransactionItem>::StartAssignment nsAutoPtr.h:1131 2 thunderbird.exe nsTransactionStack::Clear editor/txmgr/src/nsTransactionStack.cpp:142 3 thunderbird.exe nsTransactionStack::~nsTransactionStack editor/txmgr/src/nsTransactionStack.cpp:51 4 thunderbird.exe nsTransactionManager::~nsTransactionManager editor/txmgr/src/nsTransactionManager.cpp:81 5 thunderbird.exe nsTransactionManager::`scalar deleting destructor' 6 thunderbird.exe nsTransactionManager::Release editor/txmgr/src/nsTransactionManager.cpp:104 7 xpcom_core.dll nsCOMPtr_base::~nsCOMPtr_base nsCOMPtr.cpp:81 8 thunderbird.exe nsMessenger::~nsMessenger nsMessenger.cpp:320 9 thunderbird.exe nsMessenger::`scalar deleting destructor' 10 thunderbird.exe nsMessenger::Release nsMessenger.cpp:323 11 thunderbird.exe XPCJSRuntime::GCCallback js/src/xpconnect/src/xpcjsruntime.cpp:781 12 thunderbird.exe DOMGCCallback dom/src/base/nsJSEnvironment.cpp:3591 13 js3250.dll js_GC js/src/jsgc.cpp:3813 14 js3250.dll JS_GC js/src/jsapi.cpp:2487 15 thunderbird.exe nsXREDirProvider::DoShutdown toolkit/xre/nsXREDirProvider.cpp:864 16 thunderbird.exe ScopedXPCOMStartup::~ScopedXPCOMStartup toolkit/xre/nsAppRunner.cpp:947
Smaug, can you make anything out of these stack traces? If not, please mark the bug as incomplete.
Whiteboard: [needs editor hacker to evaluate stacks]
One more crash on Windows in July which happened during shutdown: bp-f631040c-2b81-4272-8229-f2f512090804
This might cause some problems http://mxr.mozilla.org/comm-central/source/mailnews/imap/src/nsImapMailFolder.cpp#2209 Nothing keeps the transaction alive when calling DoTransaction. Some random nsCOMPtr in the stack may actually delete the transaction too early. nsImapMoveCopyMsgTxn* undoMsgTxn should be changed to nsRefPtr<nsImapMoveCopyMsgTxn> undoMsgTxn and the explicit delete should be removed. Someone should verify that there are no other similar cases in mail/, though I couldn't find any. All the crashes are thunderbird related, right? I think this is not an editor bug, but mail core bug.
Thanks, Smaug :)
Component: Editor → Networking: IMAP
Product: Core → MailNews Core
QA Contact: editor → networking.imap
Whiteboard: [needs editor hacker to evaluate stacks] → [needs patch and editor-transaction-use audit based on comment 4]
still happens, only 1-3 per month bp-80762a56-5102-4051-a7a4-fbbd22100215 3.0.1 winxp 0 thunderbird.exe nsTransactionItem::Release editor/txmgr/src/nsTransactionItem.cpp:74 1 thunderbird.exe nsRefPtr<nsTransactionItem>::StartAssignment objdir-tb/mozilla/dist/include/xpcom/nsAutoPtr.h:1133 2 thunderbird.exe nsTransactionStack::Clear editor/txmgr/src/nsTransactionStack.cpp:143 3 thunderbird.exe nsTransactionStack::~nsTransactionStack editor/txmgr/src/nsTransactionStack.cpp:52 4 thunderbird.exe nsTransactionManager::~nsTransactionManager editor/txmgr/src/nsTransactionManager.cpp:66 5 thunderbird.exe nsTransactionManager::`vector deleting destructor' 6 thunderbird.exe nsTransactionManager::Release editor/txmgr/src/nsTransactionManager.cpp:93 7 xpcom_core.dll nsCOMPtr_base::~nsCOMPtr_base objdir-tb/mozilla/xpcom/build/nsCOMPtr.cpp:81 8 thunderbird.exe nsMessenger::~nsMessenger mailnews/base/src/nsMessenger.cpp:307 9 thunderbird.exe nsMessenger::`vector deleting destructor' 10 thunderbird.exe nsMessenger::Release mailnews/base/src/nsMessenger.cpp:310 11 thunderbird.exe XPCJSRuntime::GCCallback js/src/xpconnect/src/xpcjsruntime.cpp:775 12 thunderbird.exe DOMGCCallback dom/src/base/nsJSEnvironment.cpp:3714 13 thunderbird.exe XPCCycleCollectGCCallback js/src/xpconnect/src/nsXPConnect.cpp:411 14 js3250.dll js_GC js/src/jsgc.cpp:3792 15 js3250.dll JS_GC js/src/jsapi.cpp:2458 16 thunderbird.exe nsXPConnect::Collect js/src/xpconnect/src/nsXPConnect.cpp:477 17 xpcom_core.dll nsCycleCollector::Collect xpcom/base/nsCycleCollector.cpp:2386 18 xpcom_core.dll nsCycleCollector_collect xpcom/base/nsCycleCollector.cpp:3045 19 thunderbird.exe nsJSContext::CC dom/src/base/nsJSEnvironment.cpp:3534 20 thunderbird.exe nsJSContext::MaybeCC dom/src/base/nsJSEnvironment.cpp:3602 21 thunderbird.exe nsJSContext::CCIfUserInactive dom/src/base/nsJSEnvironment.cpp:3619 22 thunderbird.exe GCTimerFired dom/src/base/nsJSEnvironment.cpp:3642
OS: Mac OS X → All
Summary: Shredder crashed on shutdown [@ nsTransactionItem::Release() ] → Shredder crashed on shutdown [@ nsTransactionItem::Release()]
Crash Signature: [@ nsTransactionItem::Release()]
about 6 crashes per release per month all but one are representative of prior comments, like bp-4e89edf1-7c42-4424-b731-3bfba2111113 and have DoShutdown on the stack. bp-b1dce137-49bf-4a69-b73e-abe3f2111103 does not have DoShutdown on stack 0 xul.dll nsTransactionItem::Release editor/txmgr/src/nsTransactionItem.cpp:68 1 xul.dll nsTransactionManager::EndTransaction editor/txmgr/src/nsTransactionManager.cpp:1017 2 xul.dll nsTransactionManager::DoTransaction editor/txmgr/src/nsTransactionManager.cpp:124 3 xul.dll nsImapMailFolder::CopyMessagesOffline mailnews/imap/src/nsImapMailFolder.cpp:7272
Crash Signature: [@ nsTransactionItem::Release()] → [@ nsTransactionItem::Release()] [@ nsTransactionItem::Release ]
Summary: Shredder crashed on shutdown [@ nsTransactionItem::Release()] → crashed on shutdown [@ nsTransactionItem::Release()]
Whiteboard: [needs patch and editor-transaction-use audit based on comment 4] → [needs patch and editor-transaction-use audit based on comment 4][rare]
Removing myslef on all the bugs I'm cced on. Please NI me if you need something on MailNews Core bugs from me.
No crashes in past month newer than version 24 bp-6dd1d196-438a-4378-8822-5b34d2160309 (In reply to Olli Pettay [:smaug] from comment #4) > This might cause some problems > http://mxr.mozilla.org/comm-central/source/mailnews/imap/src/ > nsImapMailFolder.cpp#2209 > Nothing keeps the transaction alive when calling DoTransaction. > Some random nsCOMPtr in the stack may actually delete the transaction too > early. > > nsImapMoveCopyMsgTxn* undoMsgTxn should be changed to > nsRefPtr<nsImapMoveCopyMsgTxn> undoMsgTxn and the explicit delete should be > removed. > > Someone should verify that there are no other similar cases in mail/, though > I couldn't find any. I believe the current source line is at http://hg.mozilla.org/comm-central/annotate/fddfaaa9e41f/mailnews/imap/src/nsImapMailFolder.cpp#l2249 Do we still need to do anything here to address smaug's comments?
Flags: needinfo?(mkmelin+mozilla)
No looks like that was already fixed elsewhere.
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(mkmelin+mozilla)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.