517690 - Thunderbird shutdown crash [@ nsScriptSecurityManager::IsCapabilityEnabled(char const*, int*) ]

Status: RESOLVED WORKSFORME

(MailNews Core :: Backend, defect)

Description

[Ludovic Hirlimann [:Usul]]

0  	thunderbird-bin  	nsScriptSecurityManager::IsCapabilityEnabled  	 caps/src/nsScriptSecurityManager.cpp:327
1 	thunderbird-bin 	nsScriptSecurityManager::CheckXPCPermissions 	caps/src/nsScriptSecurityManager.cpp:3091
2 	thunderbird-bin 	nsScriptSecurityManager::CanCreateWrapper 	caps/src/nsScriptSecurityManager.cpp:2898
3 	thunderbird-bin 	XPCWrappedNative::InitTearOff 	js/src/xpconnect/src/xpcwrappednative.cpp:1801
4 	thunderbird-bin 	XPCWrappedNative::FindTearOff 	js/src/xpconnect/src/xpcwrappednative.cpp:1629
5 	thunderbird-bin 	XPCCallContext::CanCallNow 	js/src/xpconnect/src/xpccallcontext.cpp:270
6 	thunderbird-bin 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:1960
7 	thunderbird-bin 	XPC_WN_GetterSetter 	js/src/xpconnect/src/xpcprivate.h:2323
8 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1386
9 	libmozjs.so 	js_InternalInvoke 	js/src/jsinterp.cpp:1447
10 	libmozjs.so 	js_InternalGetOrSet 	js/src/jsinterp.cpp:1510
11 	libmozjs.so 	js_NativeGet 	js/src/jsscope.h:367
12 	libmozjs.so 	js_GetPropertyHelper 	js/src/jsobj.cpp:4333
13 	libmozjs.so 	js_Interpret 	js/src/jsinterp.cpp:4449
14 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1394
15 	thunderbird-bin 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1697
16 	thunderbird-bin 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:569
17 	libxpcom_core.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:95
18 	thunderbird-bin 	nsMsgDBView::OnAnnouncerGoingAway 	mailnews/base/src/nsMsgDBView.cpp:5691
19 	thunderbird-bin 	nsMsgDatabase::NotifyAnnouncerGoingAway 	mailnews/db/msgdb/src/nsMsgDatabase.cpp:747
20 	thunderbird-bin 	nsMsgDatabase::ForceClosed 	mailnews/db/msgdb/src/nsMsgDatabase.cpp:1245
21 	thunderbird-bin 	nsMsgDatabase::CleanupCache 	mailnews/db/msgdb/src/nsMsgDatabase.cpp:781
22 	libxpcom_core.so 	nsGenericModule::Shutdown 	nsGenericFactory.cpp:340
23 	libxpcom_core.so 	nsGenericModule::Release 	nsGenericFactory.cpp:237
24 	libxpcom_core.so 	nsCOMPtr_base::assign_with_AddRef 	xpcom/glue/nsCOMPtr.h:456
25 	libxpcom_core.so 	info_ClearEntry 	
26 	libxpcom_core.so 	PL_DHashTableFinish 	pldhash.c:383
27 	libxpcom_core.so 	nsComponentManagerImpl::Shutdown 	xpcom/components/nsStaticComponentLoader.h:70
28 	libxpcom_core.so 	NS_ShutdownXPCOM_P 	xpcom/build/nsXPComInit.cpp:855
29 	thunderbird-bin 	ScopedXPCOMStartup::~ScopedXPCOMStartup 	toolkit/xre/nsAppRunner.cpp:956
30 	thunderbird-bin 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3364
31 	thunderbird-bin 	main 	mail/app/nsMailApp.cpp:103
32 	libc-2.9.so 	libc-2.9.so@0x16704

Comment 1

[Daniel Veditz [:dveditz]]

This is a Thunderbird bug -- CAPS is being called after it has been shut down. nsMsgDBView is trying to run JavaScript in during ComponentManager shut down, and that's going to be an order-dependent hell. Your components need to listen to shutdown events and shut down cleanly before it gets that far.

Comment 2

[David :Bienvenu]

yes, what Dan said. I suspect that stack is missing some details - the only thing I can see that would call into js is mTree->RowCountChanged(), so I wonder if the view hasn't cleaned up after itself somehow.

Comment 3

[Wayne Mery (:wsmwk)]

arguably, this is also a regression, because there are no crashes prior to 3.0b4. But that's just an educated guess ... ~4 crashes  per month, and linux only isn't much to shoot at. *ALL* crashes are 3.0b4

these appear to be different users
bp-7c6f68e1-715b-401d-a911-1b2b22091104
bp-75978faf-17c6-4334-8054-8625a2091104
bp-5f558fa5-b74b-4579-bce3-48eca2090919
bp-a51c750a-0c3d-4c29-a7d2-c2ca32091201
and the only one with comments
bp-16199c06-108b-42ab-98fa-166e82091104
"I just installed lightning 03-Nov-2009 nightly. Created WCAP network account and successfully connected to server."

Comment 4

[Wayne Mery (:wsmwk)]

still occurs - still rare ~4/month
bp-976a09aa-1671-4435-b907-bf26b2110107

Comment 5

[Wayne Mery (:wsmwk)]

all crashes are v3.1.x.  none for v5 or newer.
whoot!