500068 - thundersomething addon constantly crashes tb 2.0.0.22 final (win32, winxp) [@ nsCharTraits<unsigned short>::length - nsPref::SetUnicharPref][@ nsPref::SetUnicharPref]

Status: RESOLVED FIXED

(Core :: Preferences: Backend, defect)

Description

[abittner]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090616 Firefox/3.5 (.NET CLR 3.5.30729)
Build Identifier: version 2.0.0.22 (20090605)

i just tried to use "thundersomething" addon for thunderbird. it crashes each and every time after i installed it (downloaded from mozilla.org addons page, 
https://addons.mozilla.org/en-US/thunderbird/addon/8226
saved it to desktop, dragdrop into addon window of 2.0.0.22 on win32/winxp.

is this addon supposed to work with 2.0.0.22 too? i cant try earlier tb builds at the moment, maybe somebody else could help out.

here are the crash ids (talkback public):
TB55268789Z
TB55268802E
TB55268831Z
TB55268842W
TB55268876M
http://talkback-public.mozilla.org/search/start.jsp

thanks for looking into this.


Reproducible: Always

Steps to Reproduce:
1. use win32/winxp with thunderbird 2.0.0.22
2. use thundersomething addon
3. modify some settings inside thundersomething addon dialog. app/clicking ok gives me crashes all the time after first restart after addon installation of thsth.



longtime user of thunderbird. big profile, lots of mails (local folders, pop3), usenet folders, lots of data inside tb.

Comment 1

[Wayne Mery (:wsmwk)]

you'll need to consult the author or support forum of thundersomething.
this crash is almost certain to be the extension's fault

nsCharTraits<unsigned short>::length  [../../../../dist/include/string/nsCharTraits.h, line 341]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1387]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3966]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1406]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1481]
js_InternalGetOrSet  [mozilla/js/src/jsinterp.c, line 1552]
js_SetProperty  [mozilla/js/src/jsobj.c, line 3729]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3724]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1406]
nsXPCWrappedJSClass::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1453]

Comment 2

[abittner]

is an addon supposed to be able to crash the app itself actually? just wondering. i will try to contact the author of the addon then. thanks.

Comment 3

[Arie Paap [:wildmyron]]

Addons (including extensions with binary components) can certainly be the cause of crashes. This extension doesn't contain any binary components though. Doesn't that plus the stack in comment 1 point to a js or xpcom bug?

Comment 4

[abittner]

well there are some comments in the reviews
https://addons.mozilla.org/en-US/thunderbird/reviews/display/8226

that hint, that this addon already crashes 2.0.0.21 too when clicking apply in the config dialog.

Comment 5

[timeless]

typically this points to an issue in an xpt file, and usually that's from an addon.

I'm lazy, if someone gives me a url to the addon, I might look. Otherwise I can promise I won't :).

Comment 6

[Ludovic Hirlimann [:Usul]]

(In reply to comment #5)
> typically this points to an issue in an xpt file, and usually that's from an
> addon.
> 
> I'm lazy, if someone gives me a url to the addon, I might look. Otherwise I can
> promise I won't :).

https://addons.mozilla.org/en-US/thunderbird/downloads/latest/8226/addon-8226-latest.xpi

Here you go :-)

Comment 7

[abittner]

the url was already there all the time in my intial post.

Comment 8

[timeless]

tsk: thanks

reporter: no. that was the url to a web page. please understand the word 'lazy'.

*sigh*. the extension has nothing interesting.

https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

in case anyone wants to play along at home (change firefox to thunderbird iirc).

note: i've tried w/ 2.0.0.21 and 2.0.0.22 and the xpi from comment 6 on w7 x64 (virtualbox hosted in os x on my mbp). I haven't crashed.

would someone please visit support.mozilla.com or irc and have them help you use windbg? (eventually, they'll drag me in. that's expected.)

to whomever actually does the work. we need properties of various objects from the xpconnect frames.

the commands will mostly be:
dv
dt

also from a js frame, poking cx->fp(->down)*->script->[filename|lineno] and recording the values would be appreciated.

that's something like:

dt cx JSContext
dt cx JSContext fp
dt cx JSContext fp->script
dt cx JSContext fp->down
...

Comment 9

[Vitus LM]

Sorry,

I had totally missed that my extension had created some reviews as well as bugs.
It does not crash my TB .22 but interestingly it does not save my changes either.
I will look into it.
Thanks again, and sorry I did not notice this earlier.

Comment 10

[abittner]

maybe as a hint. i was first using your addon with 2.0.0.22. i dragdropped your addon to the addon gui window. it got installed and restarted my tb. i went back into addon window, into the preferences of your addon and was trying to figure out what i wanted to do ;)

i actually am looking for an addon to randomize the "User-Agent:" string for smtp emails and for nntp/usenet postings. maybe you can explain what settings to use.

so anyways i clicked some of those x-header and some other checkboxes and tried to close the preferences window with apply/ok or whatever it was, and ever since it gave me crashes whenever i revisit the preferences.

i had to uninstall the addon again as i never got it to calm down again nor did it ever actually work.
thanks and regards.

Comment 11

[Arie Paap [:wildmyron]]

Reopening.

I can reproduce with 2.0.0.22 on WinXP but there are no symbols for Thunderbird on the symbol server (presumably because it's not built with breakpad).

Is there a debug build available or symbols somewhere for Tb 2.0.0.22

Alternatively, has anyone tested with Tb3?

For reference, my str went something like:
1. install addon from link in comment 6
2. go to add-on options, check the boxes under "User-agent" and Apply.
3. toggle some of the settings and Apply.
4. Click OK and close Add-ons window.
5. repeat random combinations of 2-4.
6. Add a comment by clicking "Suggestions..." - choose the first option, OK
7. Apply.
8. Crash.

Since then steps 2, 6 and 7 are enough for me to crash.

Comment 12

[timeless]

sorry. the symbol server is /thunderbird and it does have symbols for 22, i got them.

Comment 13

[Vitus LM]

Confirmed #11. Same steps, chrashes when I change the Useragent comment and hit apply. Same goes for all other opts on that pane. Interestingly, they are still saved.
Whereas when I change something somewhere else, those are not saved, but it does not crash anymore either, and opts of the user-agent pane are still saved. Weird.
Hmm.. there are some errors when changing those, I'll have a look.

Comment 14

[Vitus LM]

Hmm... even more interesting: It does not crash my developer profile of TB, and even saves the opts! Makes it harder for me to debug it :(
Although that uncaught exception is still there, the code line that it complains about seems to work still (changing the ex. text for postprocess when the window is loaded). This does not work in my normal profile, although the underlying function (postprocessing the label) works - so it is still saved.

Comment 15

[Arie Paap [:wildmyron]]

(In reply to comment #12)
> sorry. the symbol server is /thunderbird and it does have symbols for 22, i got
> them.

My fault. That'll teach me to blindly copy and paste.

I wasn't able to reproduce at home, but I've managed to reproduce again at uni. Unfortunately I don't have access to irc and don't really know what's relevant here, but I can tell you that in the top js frame (js_Invoke): cx->fp is null, however in other frames it's not, but cx->fp->script is.

Top of stack is the same as in comment 2. I'm currently trying to reproduce again and should be able to provide required properties.

Comment 16

[timeless]

yeah, script will be null for native frames, just add ->down's after ->fp

for irc,
http://www.mibbit.com/
https://landfill.bugzilla.org/irc/

Comment 17

[Arie Paap [:wildmyron]]

Attachment: Windbg log

Log containing exception, top of stack and a selection of locals from the top frames. I hope there's something useful there, unfortunately I don't have any more time to pursue this today, but I'll keep thunderbird in the debugger.

My interpretation of the javascript stack is:

chrome://global/content/bindings/preferences.xml @ 274
chrome://global/content/bindings/preferences.xml @ 1031
chrome://thundersomething/content/preferences/prefwindow-Main.xul @ 27

Comment 18

[timeless]

thanks!

so this bug is trivially reproducible without the addon :)

Components.classes["@mozilla.org/preferences;1"].getService(Components.interfaces.nsIPref).SetUnicharPref("a", null);

bp-a31c0c86-8010-4bb6-9513-b19212090626

Comment 19

[timeless]

Attachment: handle null values

note that the extension author could work around this by not passing null to this api (pass "" instead). the js stack trace should help the author.

Comment 20

[Vitus LM]

Jo,

that wasn't even my code, I just reused most of the code from Firesomething.
I guess in one case it was possible to set null to setPref.
I changed it to pass "" instead and also found the other bug which caused the example text to not be changed according to the pref on window-load.
Now it does not crash my TB .22 anymore.
I just uploaded the fixed version as 0.9.7.

Comment 21

[abittner]

not goooood ;(

a little improvement though, i was able to install 0.9.7 from the experimental addon area on mozilla/addons.

i was able to check/set/unset some of the fields in the gui, but eventually it crashed again:

http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB55486339Z

for example the string-post-processing tab in the gui window, never changed the example text "Thunderbird" to anything else, as it still did with the older 0.9.6....

so randomcase or the other stuff was never applied in the example in the gui box. whenever i returned to the addons options gui window, it was re-set back to "none".

this still needs some additional fixing.

Comment 22

[abittner]

update: the settings (random x-header and whatever) seem to work though, at least for smtp mails outgoing i see the randomized headers and tags in the emails.

the crashes are still a problem when working too much on the settings in the thundersomething options gui.

and this "name post processing" stuff doesnt work. also when selecting ueberleet or camecase or whatever else with the mouse device, and i try to navigate the other options via cursor keyboard keys, nothing happens. is this somehow related?

also only the second tab "images" in the options gui has an icon (paintbrush like), all the other tabs, names useragent and extras dont have any icon at all displayed. bug? feature?

cheers.

Comment 23

[Vitus LM]

Hmm..
as it stands, it seems that there have been some changes in the Pref system, as this produces exceptions. Although, funnily they are still saved, as you can see in the window title. As I already mentioned, this is not my code, but taken from firesomething, I'll talk to its author, and also see if I can fix it myself.
-V

Comment 24

[abittner]

by the way, is there any chance of randomizing or customizing the version string also with the help of your app? so far it always adds the currently running version number of thunderbird

would be nice. thanks.

Comment 25

[Vitus LM]

@Andreas Bittner: Yeah, of course, I just copied that code from Firesomething, again, because I thought you would want to still keep the original version. Well, I can include that in the next major release.

Concerning the new version, when I tested it by just overwriting the files in my TB profile, it worked. But now that I packaged and installed the .xpi in my TB, it did not help at all, the old bug is still there, and it still crashes, WTF?
Is there a difference, does anyone know? Does TB even use the files in my profile/extensions/ folder when I change them and restart TB?

Comment 26

[Daniel Veditz [:dveditz]]

Comment on attachment 385347 [details] [diff] [review]
handle null values

I think nsAutoString val(value); will work, Assign--implicitly called by the constructor--handles the null case if I'm looking at the right string classes.

r=dveditz anyway because this will work, but holding off on the sr=

Comment 27

[timeless]

Attachment: updated

thanks dveditz, updated, (note: that between my original request and today, the sr requirement for this stuff was removed)

Comment 28

[Daniel Veditz [:dveditz]]

Comment on attachment 388578 [details] [diff] [review]
updated

r=dveditz

Comment 29

[timeless]

http://hg.mozilla.org/mozilla-central/rev/1654af0def9d