519761 - crash [@ nsImapOfflineSync::AdvanceToNextFolder()]

Status: VERIFIED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[David Ascher (:davida)]

http://crash-stats.mozilla.com/report/index/58a1c5f3-3016-47ed-bdf4-610ce2090930?p=1

Comment 1

[Wayne Mery (:wsmwk)]

david, is this actually blocking development?

davida's crash
0	thunderbird-bin	nsImapOfflineSync::AdvanceToNextFolder	 mailnews/imap/src/nsImapOfflineSync.cpp:208
1	thunderbird-bin	nsImapOfflineSync::ProcessNextOperation	mailnews/imap/src/nsImapOfflineSync.cpp:875
2	thunderbird-bin	nsImapMailFolder::PlaybackTimerCallback	mailnews/imap/src/nsImapMailFolder.cpp:8990
3	libxpcom_core.dylib	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:420
4	libxpcom_core.dylib	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:512
5	libxpcom_core.dylib	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:521
6	libxpcom_core.dylib	NS_ProcessPendingEvents_P	nsThreadUtils.cpp:180
7	thunderbird-bin	nsBaseAppShell::NativeEventCallback	widget/src/xpwidgets/nsBaseAppShell.cpp:121
8	thunderbird-bin	nsAppShell::ProcessGeckoEvents	widget/src/cocoa/nsAppShell.mm:406 


extremely rare crash. 12 in 9 months. but half of those are from this month.
first found build is 20090223175111

only one has comments bp-b5849a64-b0be-40be-9ca3-8a8052090721
make a virtualfolder (saved search) click on download icon in lower left a few times. server complains that mailbox doens't exist! of course not, it's virtual! why are you asking for it? then it crashes. 
0	thunderbird-bin	nsImapOfflineSync::AdvanceToNextFolder	 mailnews/imap/src/nsImapOfflineSync.cpp:208
1	thunderbird-bin	nsImapOfflineDownloader::ProcessNextOperation	mailnews/imap/src/nsImapOfflineSync.cpp:1202
2	thunderbird-bin	nsImapOfflineSync::OnStopRunningUrl	mailnews/imap/src/nsImapOfflineSync.cpp:126
3	thunderbird-bin	nsImapMailFolder::OnStopRunningUrl	mailnews/imap/src/nsImapMailFolder.cpp:5043
4	thunderbird-bin	nsMsgMailNewsUrl::SetUrlState	mailnews/base/util/nsMsgMailNewsUrl.cpp:135
5	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
6	libxpcom_core.dylib	nsProxyObjectCallInfo::Run	xpcom/proxy/src/nsProxyEvent.cpp:181
7	libxpcom_core.dylib	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:510

Comment 2

[David Ascher (:davida)]

Bienvenu just tweaked the autosync code, and it's my first crash in 6 months, so I was worried that it's something that we'll see a lot more of, and I wanted bienvenu to look at it with his latest changes still in cache.

Comment 3

[David :Bienvenu]

The autosync code doesn't use the code in this stack trace.

I did also tweak the offline sync code (this code is getting called when we do imap delete operations "offline" and then play them back). But that doesn't involve the nsImapOfflineDownloader either. Did you go offline, and have it start doing an offline download?

Comment 4

[David Ascher (:davida)]

I didn't do anything actively. I think I was switching folders, but AFAIK I was online.

Comment 5

[David :Bienvenu]

either the stack is horked, or there was an offline transition due to network issues, and somehow that triggered a download (which it shouldn't/doesn't, afaik)

Comment 6

[Dan Mosedale (:dmosedale, :dmose)]

Not blocking because of infrequency and because we have no understanding of what's going on here.

Comment 7

[Wayne Mery (:wsmwk)]

#35 crash for 3.0pre, but not in 3.0b4 top 100. no crashes have comments.
except for 3.0pre quite rare. and earliest build I find crash is 20090223175111.

Comment 8

[Wayne Mery (:wsmwk)]

#65 crash for v3.0.4

stacks haven't changed from the two cited in comment 1

several bugs mention deleting messages or undoing deleted or archived messages:
bp-7bbb5a58-aad0-41db-abff-d10082100304
bp-802cb52e-f31e-404c-bcfc-331502100302
bp-7e9bf985-dc26-461a-ad70-0bc212100301
bp-50cbb8f3-0fa6-455b-aea0-bfd312100301
bp-5f7d0c26-8d49-484b-b871-3ec2c2091218 (bsmedberg)

bp-97cf0c18-879e-48da-bcf2-d0e792100428 moved an email to a folder and TB crashed. Just before the crash, the Inbox folder on the screen was blank, i.e. no mails were showing. This happens often but after refreshing with the check emails button they all come back.

Comment 9

[Wayne Mery (:wsmwk)]

given crash comment #1, #5, #6 below, STR looks simple. 

From the last month of crashes:
1. (me, wsmwk) 2 or 3 iterations of message move and undo of two messages at a time. testing bug 537162. I had many tabs loaded bp-5774b766-c24a-47ce-b4a2-f83ec2100731
2. Deleted a top-level mail in treeview mode Undeleted Moved current mail (ie up arrow) before treeview refreshed bp-af236657-f815-4c0b-b833-b05e62100713
3. I believe I pressed shift-space, or alt-space (typo). bp-f7995c11-3602-4917-81cb-b555b2100714
4. 1.5yr old son started button-mashing bp-5d0bfd4f-27e3-4399-a507-d57c72100714
5. Was deleting 1 email. bp-c8ebae6f-6e73-492e-8b60-f5a792100721
6. (halbert) I believe this is related to bug 569588. Got this crash while testing for bug 571800 bp-66d39a5c-728e-489d-bfb1-9e1c02100614

xref: bug 569588, bug 571800, bug 537162, bug 536878 (#74 + #114)
this crash is #121
the combined total makes this a top 20 crasher for v3.1.1

Comment 10

[Wayne Mery (:wsmwk)]

p.s. there seems to be a significant uptick in crashes with 3.1.1 - perhaps due to Bug 571800?

Comment 11

[David :Bienvenu]

Attachment: possible fix - checked in

I saw this happen once - basically, the offline playback object got deleted out from under itself because no one was holding a reference to it during the initial call to ProcessNextOperation.  I can't recreate the issue, but this change would prevent that from happening. I'll try wsmwk's STR's as well.

Comment 12

[Dan Halbert]

Note that I bisected bug 569588 down to changes between two daily builds. Quoting from
https://bugzilla.mozilla.org/show_bug.cgi?id=569588#c5:

Using the Windows nightly builds, I have bisected this down to two consecutive
builds:

 (OK, can't reproduce in this or earlier builds)
http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/2009/09/2009-09-25-03-comm-1.9.1/thunderbird-3.0pre.en-US.win32.installer.exe

(crashes in this and later builds)
http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/2009/09/2009-09-26-03-comm-1.9.1/thunderbird-3.0pre.en-US.win32.installer.exe

Comment 13

[David :Bienvenu]

I've checked in this patch. If anyone who can reproduce this wants to try a trunk build from tomorrow or later, that would be helpful...

Comment 14

[Dan Halbert]

(In reply to comment #13; also see comment #9)
> I've checked in this patch. If anyone who can reproduce this wants to try a
> trunk build from tomorrow or later, that would be helpful...

I tested build http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/2010-08-14-00-comm-1.9.2/thunderbird-3.1.3pre.en-US.win32.installer.exe and reproduced the crash scenario in bug 569588. So either this bug and that bug are not the same, or the patch does not fix the problem.

Comment 15

[Ludovic Hirlimann [:Usul]]

(In reply to comment #14)
> (In reply to comment #13; also see comment #9)
> > I've checked in this patch. If anyone who can reproduce this wants to try a
> > trunk build from tomorrow or later, that would be helpful...
> 
> I tested build
> http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/2010-08-14-00-comm-1.9.2/thunderbird-3.1.3pre.en-US.win32.installer.exe
> and reproduced the crash scenario in bug 569588. So either this bug and that
> bug are not the same, or the patch does not fix the problem.

you'll need to use http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-comm-central-trunk/ until this lands on branch.

Comment 16

[Dan Halbert]

(In reply to comment #15)
> you'll need to use
> http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-comm-central-trunk/
> until this lands on branch.

Oops, apologies. I mistook "bienvenu: approval‑thunderbird3.1.3" for it being on the 3.1.3 branch.

I tried again and CANNOT the reproduce bug 569588 scenario on the latest trunk build. Hurray!

Comment 17

[David :Bienvenu]

(In reply to comment #16)

> Oops, apologies. I mistook "bienvenu: approval‑thunderbird3.1.3" for it being
> on the 3.1.3 branch.

I requested approval, I didn't grant it.
> 
> I tried again and CANNOT the reproduce bug 569588 scenario on the latest trunk
> build. Hurray!

Ah, great, thx for trying that.

Comment 18

[David :Bienvenu]

which means I can resolve this fixed - thx again.

Comment 19

[David :Bienvenu]

changeset:   5768:567f5ec9020d pushed to 1.9.2 - marking 3.1.3 fixed, though I'm not sure if there's a relbranch I need to push to as well...

Comment 20

[Mark Banner (:standard8)]

(In reply to comment #19)
> changeset:   5768:567f5ec9020d pushed to 1.9.2 - marking 3.1.3 fixed, though
> I'm not sure if there's a relbranch I need to push to as well...

No relbranches this time around ;-)

Comment 21

[Wayne Mery (:wsmwk)]

crash rate in v3.1.3 and 3.1.4 significantly lower than 3.1.2. so v.fixed

but there are still crashes for nsImapOfflineSync::AdvanceToNextServer() which, not surprisingly, are different crashes. so follow up bugs are 

Bug 617950 nsImapOfflineSync::AdvanceToNextServer() | [@ nsImapOfflineDownloader::ProcessNextOperation]
Bug 617951 nsCOMPtr<nsINntpIncomingServer>::nsCOMPtr<nsINntpIncomingServer>(nsQueryInterface) | nsImapOfflineSync::AdvanceToNextServer() | [@ nsImapOfflineSync::AdvanceToNextFolder]