481399 - Crash [@ _purecall - nsImapMockChannel::QueryInterface]

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[Ludovic Hirlimann [:Usul]]

TB 3.0b2 crashes in a Jmalloc call.

0  	ntdll.dll  	ntdll.dll@0xe4f4  	
1 	kernel32.dll 	kernel32.dll@0x2541 	
2 	thunderbird.exe 	google_breakpad::ExceptionHandler::WriteMinidumpOnHandlerThread 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:562
3 	thunderbird.exe 	google_breakpad::ExceptionHandler::HandlePureVirtualCall 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:506
4 	mozcrt19.dll 	_purecall 	objdir-tb/mozilla/memory/jemalloc/src/purevirt.c:47
5 	thunderbird.exe 	nsImapMockChannel::QueryInterface 	mailnews/imap/src/nsImapProtocol.cpp:8144

Comment 1

[Tobias Fischer]

Can you provide some steps to reproduce? I have not seen any crashes using current SeaMonkey 2.0pre-Builds, nor TB 3.0b3pre both with jemalloc enabled with my IMAP-Account in the last time.

Comment 2

[Ludovic Hirlimann [:Usul]]

(In reply to comment #1)
> Can you provide some steps to reproduce? I have not seen any crashes using
> current SeaMonkey 2.0pre-Builds, nor TB 3.0b3pre both with jemalloc enabled
> with my IMAP-Account in the last time.

Unfortunatly not - these crashers where extracted from crash-stats.

Comment 3

[timeless]

jemalloc isn't really jemalloc here, it's just the CRT and so you need to blame the caller.

Comment 4

[David :Bienvenu]

If this crash has gone away, I'd suspect it's an other manifestation of the problem in  bug 466318

Comment 5

[Ludovic Hirlimann [:Usul]]

David according to http://crash-stats.mozilla.com/report/list?product=Thunderbird&version=Thunderbird%3A3.0b3pre&query_search=signature&query_type=exact&query=&date=&range_value=3&range_unit=weeks&do_query=1&signature=ntdll.dll%400xe4f4 THe crash has not disapeared.

Comment 6

[Wayne Mery (:wsmwk)]

#1 crasher, by a long shot.
so needs to get into TB3, preferably beta 3

Comment 7

[Wayne Mery (:wsmwk)]

crash appears to start with 20090214031138 build.
crash count/rate for 3.0b2pre quadruples as of 2/17/09 build [1]
several patches landed on both.

[1] http://crash-stats.mozilla.com/report/list?product=Thunderbird&version=Thunderbird%3A3.0b2pre&query_search=stack&query_type=contains&query=purecall&date=03%2F05%2F2009&range_value=3&range_unit=weeks&do_query=1&signature=ntdll.dll%400xe4f4

Comment 8

[David :Bienvenu]

bug 476960 looks to be the only relevant imap protocol change - it changes the way we cleanup the protocol objects connections that are going away, basically by moving it to the imap thread.

Since the fix for bug 466318 landed on 3/18, I have not personally seen any channel-related crashes with RetryUrl. It looks to me like the crash stat crashes after 03/18 in RetryUrl are less numerous.

purecall catches a lot of other crashes, so you need to look up a bit higher on the stack to separate out the different crashes. In particular, this one is different, and has multiple instances. It looks to be a case of the user shutting down immediately after deleting an imap message, and we try to playback the delete during shutdown:

 	mozcrt19.dll  	_purecall  	 objdir-tb/mozilla/memory/jemalloc/src/purevirt.c:47
5 	xpcom_core.dll 	NS_TableDrivenQI 	objdir-tb/mozilla/xpcom/build/nsISupportsImpl.cpp:59
6 	thunderbird.exe 	nsMsgWindow::QueryInterface 	mailnews/base/src/nsMsgWindow.cpp:77
7 	xpcom_core.dll 	nsQueryInterfaceWithError::operator 	objdir-tb/mozilla/xpcom/build/nsCOMPtr.cpp:64
8 	xpcom_core.dll 	nsCOMPtr_base::assign_from_qi_with_error 	objdir-tb/mozilla/xpcom/build/nsCOMPtr.cpp:105
9 	xpcom_core.dll 	NS_GetWeakReference 	objdir-tb/mozilla/xpcom/build/nsWeakReference.cpp:108
10 	thunderbird.exe 	PlaceholderTxn::ForwardEndBatchTo 	editor/libeditor/base/PlaceholderTxn.cpp:261
11 	thunderbird.exe 	nsImapService::OnlineMessageCopy 	mailnews/imap/src/nsImapService.cpp:1964
12 	thunderbird.exe 	nsImapMailFolder::ReplayOfflineMoveCopy 	mailnews/imap/src/nsImapMailFolder.cpp:3509
13 	thunderbird.exe 	nsImapOfflineSync::ProcessMoveOperation 	mailnews/imap/src/nsImapOfflineSync.cpp:544
14 	thunderbird.exe 	nsImapOfflineSync::ProcessNextOperation 	mailnews/imap/src/nsImapOfflineSync.cpp:976
15 	thunderbird.exe 	nsImapOfflineSync::ProcessNextOperation 	mailnews/imap/src/nsImapOfflineSync.cpp:957
16 	thunderbird.exe 	nsImapOfflineSync::ProcessNextOperation 	mailnews/imap/src/nsImapOfflineSync.cpp:957
17 	thunderbird.exe 	nsImapOfflineSync::ProcessNextOperation 	mailnews/imap/src/nsImapOfflineSync.cpp:957
18 	thunderbird.exe 	nsImapOfflineSync::ProcessNextOperation 	mailnews/imap/src/nsImapOfflineSync.cpp:957
19 	thunderbird.exe 	nsImapMailFolder::PlaybackTimerCallback 	mailnews/imap/src/nsImapMailFolder.cpp:8502
20 	xpcom_core.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:420
21 	xpcom_core.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:512
22 	xpcom_core.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
23 	xpcom_core.dll 	NS_ProcessNextEvent_P 	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:227
24 	xpcom_core.dll 	nsThread::Shutdown 	xpcom/threads/nsThread.cpp:465
25 	thunderbird.exe 	nsUrlClassifierDBService::Shutdown 	toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:4301
26 	thunderbird.exe 	nsUrlClassifierDBService::Observe 	toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:4257
27 	xpcom_core.dll 	nsObserverList::NotifyObservers 	xpcom/ds/nsObserverList.cpp:128
28 	xpcom_core.dll 	nsObserverService::NotifyObservers 	xpcom/ds/nsObserverService.cpp:181
29 	thunderbird.exe 	nsXREDirProvider::DoShutdown 	toolkit/xre/nsXREDirProvider.cpp:8

Comment 9

[Mark Banner (:standard8)]

I don't see this in crash stats for 3.0b3pre - is it still occurring or has it moved to something different?

Comment 10

[Ludovic Hirlimann [:Usul]]

(In reply to comment #9)
> I don't see this in crash stats for 3.0b3pre - is it still occurring or has it
> moved to something different?

I didn't find it in the last two weeks either. I think it went away.

Comment 11

[Wayne Mery (:wsmwk)]

certainly is after 03/18 builds, per search on stack contains nsImapMockChannel::QueryInterface http://crash-stats.mozilla.com/query/query?do_query=1&product=Thunderbird&version=Thunderbird%3A3.0b3pre&version=Thunderbird%3A3.1a1pre&date=04%2F25%2F2009&range_value=25&range_unit=days&query_search=stack&query_type=contains&query=nsImapMockChannel%3A%3AQueryInterface#

so fixed by bug 466318 - makes a battleship sized dent in the number of ntdll.dll@* crashes

Comment 12

[Mark Banner (:standard8)]

Cancelling flags as this appears to be fixed.