Closed Bug 512678 Opened 11 years ago Closed 11 years ago

crash [@ nsPurpleBuffer::Put(nsISupports*)] during address autocomplete

Categories

(MailNews Core :: Composition, defect)

x86
Windows XP
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: wsmwk, Assigned: neil)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

topcrash for seamonkey 2.0b2pre[1] (but not for thunderbird)

SM crash bp-9d762af1-2328-4123-9770-f96302090807 Typing an address into the "to" field in an email
nsPurpleBuffer::Put	 xpcom/base/nsCycleCollector.cpp:767
NS_CycleCollectorSuspect2_P	xpcom/base/nsCycleCollector.cpp:2985
nsCycleCollectingAutoRefCnt::decr	objdir/mozilla/dist/include/xpcom/nsISupportsImpl.h:197
nsGenericDOMDataNode::Release	content/base/src/nsGenericElement.cpp:4124
nsRefPtr<nsThread>::assign_assuming_AddRef	objdir/mozilla/dist/include/xpcom/nsAutoPtr.h:944
nsCOMPtr_base::assign_with_AddRef	objdir/mozilla/xpcom/build/nsCOMPtr.cpp:89
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:197
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:193
nsEventTargetChainItem::Destroy	content/events/src/nsEventDispatcher.cpp:76
nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:524
nsXULPopupShownEvent::Run	layout/xul/base/src/nsMenuPopupFrame.cpp:300
nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:510
NS_ProcessNextEvent_P	objdir/mozilla/xpcom/build/nsThreadUtils.cpp:227
nsBaseAppShell::Run	widget/src/xpwidgets/nsBaseAppShell.cpp:170
nsAppStartup::Run	toolkit/components/startup/src/nsAppStartup.cpp:193
XRE_main	toolkit/xre/nsAppRunner.cpp:3321 

TB 3.0b3 crash bp-27c7f80b-6f7a-44b5-a50a-298f42090815
similar stack

[1] seamonkey, might be just one or two people inflating crash-stats
http://crash-stats.mozilla.com/report/list?product=SeaMonkey&version=SeaMonkey%3A2.0b2pre&query_search=signature&query_type=exact&query=&date=&range_value=4&range_unit=weeks&do_query=1&signature=nsPurpleBuffer%3A%3APut%28nsISupports*%29
Confirming, using the current SM2.0b2pre-Windows-Nightly on WinXP SP3. 
But its not only one or two people who inflate the SM-crash-stats. I get this crash first time on 2009-07-02:
bp-abdb9f7f-1e6c-4db7-9971-65a222090702
and randomly until today. Somebody else in german newsgroup de.comm.software.mozilla.mailnews <1m19099bppjrg$.o1ygeinzj9dt.dlg@40tude.net> see the crash too, and take a closer look to the Systems (CPU) the bp-stacks come from more than only two systems. 

For me the crash occurs only randomly, so its not easy to give good Steps to reproduce, but I will try:

1. Running SeaMonkey on Windows, open MailNews.
2. Compose or reply to an E-Mail where the Recipient(s) is in your Addressbook.
3. Edit the Recipient-Data in To: Field into something different from ADB-Data.
4. SeaMonkey crashes randomly.

SeaMonkey will not crash every time, best method to reproduce is to add multiple Recipients, and/or edit an incomplete Address from your Addressbook like adding the Name to the E-Mail-Address. 

I have tried to reproduce this crash with TB 3.x, but I was not able to get TB crashing.
Attached patch Possible patchSplinter Review
So, my best guess is that this is fallout from bug 413281, the "fix" for which involved making nsIArray participate in cycle collection, which is main-thread only, but nsAbOutlookDirectory tries to access it on another thread. There is in fact a thread-safe non-cycle-collecting version of nsArray but you can't create that on the main thread either. However I was able to work around the problem by passing the SRestriction to the new thread rather than the nsIAbDirectoryQueryArguments.
Assignee: nobody → neil
Status: NEW → ASSIGNED
Attachment #397555 - Flags: superreview?(bienvenu)
Attachment #397555 - Flags: review?(bienvenu)
this looks OK, but I need to install Outlook to try and test it...
Running Thunderbird with this patch crashes when I open the address book, with Outlook 2007 on Windows 7. Running w/o it doesn't crash, though all the blank fields are filled with garbage characters.

I'll try a clean build, and put in a stacktrace, if it keeps crashing.
OK, doing a clean build fixed the crash. However, with the patch,  I see assertions about nsIArray's being forgotten off the UI thread, when I do an autocomplete against the Outlook AB. nsAbOutlookDirectory::ExecuteQuery is executed off the UI thread, and creates an nsIMutableArray first thing. 

I don't see the assertion in a build without the patch, but perhaps one or more of my trees isn't up to date in mozilla-central.
413281(In reply to comment #2)
> Created an attachment (id=397555) [details]
> Possible patch
> 
> So, my best guess is that this is fallout from bug 413281, the "fix" for which
> involved making nsIArray participate in cycle collection, which is main-thread
> only, but nsAbOutlookDirectory tries to access it on another thread. 

sounds reasonable. However, first crashes does not appear on crash-stats until 20090614031346 for TB, and 20090522003217 (2.0b1pre) for SM. Whereas bug 413281 landed 2008-02-07, with further changes on 2009-08-25 via philor's changes via bug 471296.
Blocks: 413281
Attachment #397555 - Flags: superreview?(bienvenu)
Attachment #397555 - Flags: superreview+
Attachment #397555 - Flags: review?(bienvenu)
Attachment #397555 - Flags: review+
Comment on attachment 397555 [details] [diff] [review]
Possible patch

I've crashed w/o this patch, and I'm not seeing assertions now, and Outlook AB integration works as well as it did w/o the patch...
(In reply to comment #5)
> OK, doing a clean build fixed the crash. However, with the patch,  I see
> assertions about nsIArray's being forgotten off the UI thread, when I do an
> autocomplete against the Outlook AB. nsAbOutlookDirectory::ExecuteQuery is
> executed off the UI thread, and creates an nsIMutableArray first thing. 
> 
> I don't see the assertion in a build without the patch, but perhaps one or more
> of my trees isn't up to date in mozilla-central.
Creating arrays off the main thread should have been fixed in bug 471296.
(In reply to comment #3)
> this looks OK, but I need to install Outlook to try and test it...
Which OS? Did they drop Outlook Express/Windows Address Book after XP?
I meant Outlook, not Outlook Express - I believe this code is used with Outlook which supports MAPI 1. Outlook Express does not...I'm using Outlook on Windows 7 now.
(In reply to comment #10)
> I'm using Outlook on Windows 7 now.
Which may mean that you're out of luck but at least on Windows XP I can test this code against Outlook Express with Windows Address Book.
Maybe Windows Address Book supports the address book parts of MAPI 1?
I keep forgetting that the assertions trigger when I do autocomplete, not when I open the AB.
Pushed changeset 2c185d4050c2 to comm-central.
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsPurpleBuffer::Put(nsISupports*)]
You need to log in before you can comment on or make changes to this bug.