505960 - crash [@nsMsgDBView::RemoveRows(unsigned int, int) ]

Status: RESOLVED DUPLICATE of bug 524266

(MailNews Core :: Database, defect)

Description

[Ludovic Hirlimann [:Usul]]

Frame 0 and 1 are funky :

0  	 	@0xffff1259  	
1 		@0xffff086d 	
2 	thunderbird-bin 	nsMsgDBView::RemoveRows 	nsTArray.h:600
3 	thunderbird-bin 	nsMsgDBView::CollapseByIndex 	nsMsgDBView.cpp:4730
4 	thunderbird-bin 	nsMsgDBView::ToggleExpansion 	nsMsgDBView.cpp:4560
5 	thunderbird-bin 	nsMsgDBView::ToggleOpenState 	nsMsgDBView.cpp:1922
6 	libxpcom_core.dylib 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
7 	thunderbird-bin 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:2454
8 	thunderbird-bin 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1590
9 	libmozjs.dylib 	js_Invoke 	js/src/jsinterp.cpp:1386
10 	libmozjs.dylib 	js_Interpret 	js/src/jsinterp.cpp:5179
11 	libmozjs.dylib 	js_Invoke 	js/src/jsinterp.cpp:1394
12 	libmozjs.dylib 	js_InternalInvoke 	js/src/jsinterp.cpp:1447
13 	libmozjs.dylib 	JS_CallFunctionValue 	js/src/jsapi.cpp:5187
14 	thunderbird-bin 	nsJSContext::CallEventHandler 	dom/src/base/nsJSEnvironment.cpp:2035
15 	thunderbird-bin 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:247
16 	thunderbird-bin 	nsXBLPrototypeHandler::ExecuteHandler 	content/xbl/src/nsXBLPrototypeHandler.cpp:341
17 	thunderbird-bin 	nsXBLEventHandler::HandleEvent 	content/xbl/src/nsXBLEventHandler.cpp:88
18 	thunderbird-bin 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1098
19 	thunderbird-bin 	nsEventListenerManager::HandleEvent 	content/events/src/nsEventListenerManager.cpp:1206
20 	thunderbird-bin 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventDispatcher.cpp:236
21 	thunderbird-bin 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:300
22 	thunderbird-bin 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:514
23 	thunderbird-bin 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6317
24 	thunderbird-bin 	PresShell::HandleEventWithTarget 	layout/base/nsPresShell.cpp:6222
25 	thunderbird-bin 	nsEventStateManager::CheckForAndDispatchClick 	content/events/src/nsEventStateManager.cpp:4073
26 	thunderbird-bin 	nsEventStateManager::PostHandleEvent 	content/events/src/nsEventStateManager.cpp:3036
27 	thunderbird-bin 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6338
28 	thunderbird-bin 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6205
29 	thunderbird-bin 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6065
30 	thunderbird-bin 	nsViewManager::HandleEvent 	view/src/nsViewManager.cpp:1400
31 	thunderbird-bin 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1359
32 	thunderbird-bin 	HandleEvent 	view/src/nsView.cpp:168
33 	thunderbird-bin 	nsChildView::DispatchEvent 	widget/src/cocoa/nsChildView.mm:2030
34 	thunderbird-bin 	nsChildView::DispatchWindowEvent 	widget/src/cocoa/nsChildView.mm:2043
35 	thunderbird-bin 	-[ChildView mouseUp:] 	widget/src/cocoa/nsChildView.mm:3697
36 	AppKit 	-[NSWindow sendEvent:] 	
37 	thunderbird-bin 	-[NSWindow nsCocoaWindow_NSWindow_sendEvent:] 	widget/src/cocoa/nsCocoaWindow.mm:2215
38 	thunderbird-bin 	-[ToolbarWindow sendEvent:] 	widget/src/cocoa/nsCocoaWindow.mm:1974
39 	AppKit 	-[NSApplication sendEvent:] 	
40 	AppKit 	-[NSApplication run] 	
41 	thunderbird-bin 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:720
42 	thunderbird-bin 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:193
43 	thunderbird-bin 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3298
44 	thunderbird-bin 	main 	nsMailApp.cpp:103
45 	thunderbird-bin 	thunderbird-bin@0x1ee1 	
46 	thunderbird-bin 	thunderbird-bin@0x1e08 	
47 		@0x2

Comment 1

[Joshua Cranmer [:jcranmer]]

(In reply to comment #0)
> Frame 0 and 1 are funky :
> 
> 0           @0xffff1259      
> 1         @0xffff086d     
> 2     thunderbird-bin     nsMsgDBView::RemoveRows     nsTArray.h:600

The crashes in here would come out to be from an nsTArray::RemoveElementsAt. viewIndex should be valid via the guards, which implies that numRows would be the other option for being wrong, i.e., the thread count is not correct.

Comment 2

[Ludovic Hirlimann [:Usul]]

(In reply to comment #1)
> (In reply to comment #0)
> > Frame 0 and 1 are funky :
> > 
> > 0           @0xffff1259      
> > 1         @0xffff086d     
> > 2     thunderbird-bin     nsMsgDBView::RemoveRows     nsTArray.h:600
> 
> The crashes in here would come out to be from an nsTArray::RemoveElementsAt.
> viewIndex should be valid via the guards, which implies that numRows would be
> the other option for being wrong, i.e., the thread count is not correct.

Shallwe file a bug about this neing incorrect ? (and probably close this one then)

Comment 3

[David :Bienvenu]

minusing, as this doesn't seem to be appearing in top crashes

Comment 4

[Wayne Mery (:wsmwk)]

detailed steps from one crash ... Using GMail with IMAP Copy a thread to a new folder (add a tag to the whole thread in gmail terms) Went in the new folder and tried to access the thread It seems that as the copy was not finished, it crashed while accessing to an uncomplete thread ?? Did restart tb and everything was ok. 
bp-698b9281-8133-4c65-917e-104b72090928

still, no crashes on nightlies, and 3.0b4 crash rate very low.
xref bug 517662

Comment 5

[Wayne Mery (:wsmwk)]

I'm thinking this is Mac equivalent of bug 524266, rather than related to bug 517622. Do you agree?

bp-698b9281-8133-4c65-917e-104b72090928 is ...
0		@0xffff0f32	
1	thunderbird-bin	nsMsgDBView::RemoveRows	ray.h:600
2	thunderbird-bin	nsMsgDBView::CollapseByIndex	mailnews/base/src/nsMsgDBView.cpp:4757
3	thunderbird-bin	nsMsgDBView::ToggleExpansion	mailnews/base/src/nsMsgDBView.cpp:4587
4	thunderbird-bin	nsMsgDBView::ToggleOpenState	mailnews/base/src/nsMsgDBView.cpp:1934
5	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
6	thunderbird-bin	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2454
7	thunderbird-bin	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1590 


bug 517662 should probably be closed WFM.

Comment 6

[[:Aureliano Buendía]]

(In reply to comment #5)
> I'm thinking this is Mac equivalent of bug 524266, rather than related to bug
> 517622. Do you agree?
I agree too

Comment 7

[Ludovic Hirlimann [:Usul]]

(In reply to comment #5)
> I'm thinking this is Mac equivalent of bug 524266, rather than related to bug
> 517622. Do you agree?

Looks alike - as we don't have any repro steps we could dump and reopen a new one if they were different.

> bug 517662 should probably be closed WFM.

Why ?

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to comment #7)
> > bug 517662 should probably be closed WFM.
> 
> Why ?

because reporter writes "I currently don't see it any more" and the probability (IMO) that the problem is fixed by other bugs.