512678 - crash [@ nsPurpleBuffer::Put(nsISupports*)] during address autocomplete

Status: RESOLVED FIXED

(MailNews Core :: Composition, defect)

Description

[Wayne Mery (:wsmwk)]

topcrash for seamonkey 2.0b2pre[1] (but not for thunderbird)

SM crash bp-9d762af1-2328-4123-9770-f96302090807 Typing an address into the "to" field in an email
nsPurpleBuffer::Put	 xpcom/base/nsCycleCollector.cpp:767
NS_CycleCollectorSuspect2_P	xpcom/base/nsCycleCollector.cpp:2985
nsCycleCollectingAutoRefCnt::decr	objdir/mozilla/dist/include/xpcom/nsISupportsImpl.h:197
nsGenericDOMDataNode::Release	content/base/src/nsGenericElement.cpp:4124
nsRefPtr<nsThread>::assign_assuming_AddRef	objdir/mozilla/dist/include/xpcom/nsAutoPtr.h:944
nsCOMPtr_base::assign_with_AddRef	objdir/mozilla/xpcom/build/nsCOMPtr.cpp:89
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:197
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:524
nsXULPopupShownEvent::Run	layout/xul/base/src/nsMenuPopupFrame.cpp:300
nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:510
NS_ProcessNextEvent_P	objdir/mozilla/xpcom/build/nsThreadUtils.cpp:227
nsBaseAppShell::Run	widget/src/xpwidgets/nsBaseAppShell.cpp:170
nsAppStartup::Run	toolkit/components/startup/src/nsAppStartup.cpp:193
XRE_main	toolkit/xre/nsAppRunner.cpp:3321 

TB 3.0b3 crash bp-27c7f80b-6f7a-44b5-a50a-298f42090815
similar stack

[1] seamonkey, might be just one or two people inflating crash-stats
http://crash-stats.mozilla.com/report/list?product=SeaMonkey&version=SeaMonkey%3A2.0b2pre&query_search=signature&query_type=exact&query=&date=&range_value=4&range_unit=weeks&do_query=1&signature=nsPurpleBuffer%3A%3APut%28nsISupports*%29

Comment 1

[Tobias Fischer]

Confirming, using the current SM2.0b2pre-Windows-Nightly on WinXP SP3. 
But its not only one or two people who inflate the SM-crash-stats. I get this crash first time on 2009-07-02:
bp-abdb9f7f-1e6c-4db7-9971-65a222090702
and randomly until today. Somebody else in german newsgroup de.comm.software.mozilla.mailnews <1m19099bppjrg$[e-mail]> see the crash too, and take a closer look to the Systems (CPU) the bp-stacks come from more than only two systems. 

For me the crash occurs only randomly, so its not easy to give good Steps to reproduce, but I will try:

1. Running SeaMonkey on Windows, open MailNews.
2. Compose or reply to an E-Mail where the Recipient(s) is in your Addressbook.
3. Edit the Recipient-Data in To: Field into something different from ADB-Data.
4. SeaMonkey crashes randomly.

SeaMonkey will not crash every time, best method to reproduce is to add multiple Recipients, and/or edit an incomplete Address from your Addressbook like adding the Name to the E-Mail-Address. 

I have tried to reproduce this crash with TB 3.x, but I was not able to get TB crashing.

Comment 2

[[e-mail]]

Attachment: Possible patch

So, my best guess is that this is fallout from bug 413281, the "fix" for which involved making nsIArray participate in cycle collection, which is main-thread only, but nsAbOutlookDirectory tries to access it on another thread. There is in fact a thread-safe non-cycle-collecting version of nsArray but you can't create that on the main thread either. However I was able to work around the problem by passing the SRestriction to the new thread rather than the nsIAbDirectoryQueryArguments.

Comment 3

[David :Bienvenu]

this looks OK, but I need to install Outlook to try and test it...

Comment 4

[David :Bienvenu]

Running Thunderbird with this patch crashes when I open the address book, with Outlook 2007 on Windows 7. Running w/o it doesn't crash, though all the blank fields are filled with garbage characters.

I'll try a clean build, and put in a stacktrace, if it keeps crashing.

Comment 5

[David :Bienvenu]

OK, doing a clean build fixed the crash. However, with the patch,  I see assertions about nsIArray's being forgotten off the UI thread, when I do an autocomplete against the Outlook AB. nsAbOutlookDirectory::ExecuteQuery is executed off the UI thread, and creates an nsIMutableArray first thing. 

I don't see the assertion in a build without the patch, but perhaps one or more of my trees isn't up to date in mozilla-central.

Comment 6

[Wayne Mery (:wsmwk)]

413281(In reply to comment #2)
> Created an attachment (id=397555) [details]
> Possible patch
> 
> So, my best guess is that this is fallout from bug 413281, the "fix" for which
> involved making nsIArray participate in cycle collection, which is main-thread
> only, but nsAbOutlookDirectory tries to access it on another thread. 

sounds reasonable. However, first crashes does not appear on crash-stats until 20090614031346 for TB, and 20090522003217 (2.0b1pre) for SM. Whereas bug 413281 landed 2008-02-07, with further changes on 2009-08-25 via philor's changes via bug 471296.

Comment 7

[David :Bienvenu]

Comment on attachment 397555 [details] [diff] [review]
Possible patch

I've crashed w/o this patch, and I'm not seeing assertions now, and Outlook AB integration works as well as it did w/o the patch...

Comment 8

[[e-mail]]

(In reply to comment #5)
> OK, doing a clean build fixed the crash. However, with the patch,  I see
> assertions about nsIArray's being forgotten off the UI thread, when I do an
> autocomplete against the Outlook AB. nsAbOutlookDirectory::ExecuteQuery is
> executed off the UI thread, and creates an nsIMutableArray first thing. 
> 
> I don't see the assertion in a build without the patch, but perhaps one or more
> of my trees isn't up to date in mozilla-central.
Creating arrays off the main thread should have been fixed in bug 471296.

Comment 9

[[e-mail]]

(In reply to comment #3)
> this looks OK, but I need to install Outlook to try and test it...
Which OS? Did they drop Outlook Express/Windows Address Book after XP?

Comment 10

[David :Bienvenu]

I meant Outlook, not Outlook Express - I believe this code is used with Outlook which supports MAPI 1. Outlook Express does not...I'm using Outlook on Windows 7 now.

Comment 11

[[e-mail]]

(In reply to comment #10)
> I'm using Outlook on Windows 7 now.
Which may mean that you're out of luck but at least on Windows XP I can test this code against Outlook Express with Windows Address Book.

Comment 12

[David :Bienvenu]

Maybe Windows Address Book supports the address book parts of MAPI 1?

Comment 13

[David :Bienvenu]

I keep forgetting that the assertions trigger when I do autocomplete, not when I open the AB.

Comment 14

[[e-mail]]

Pushed changeset 2c185d4050c2 to comm-central.