Closed Bug 522575 Opened 15 years ago Closed 14 years ago

crash opening attachment [@ nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)] MODULE: psicon.dll [adobe photoshop?]

Categories

(Core :: General, defect)

Product:
Core
Component:
General
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla2.0b6
Tracking Flags:
Tracking Status
blocking1.9.2 --- needed
status1.9.2 --- .11-fixed
status1.9.1 --- wanted

People

(Reporter: wsmwk, Assigned: standard8)

References

(
URL
)

Details

(4 keywords, Whiteboard: [tb31needed][#4 thunderbird crasher][gs][fixed tb3.1.3])

Crash Data

Attachments

(3 files, 1 obsolete file)

Email with attachment that crashes when saved
206.97 KB, message/rfc822
Details
[checked-in] Add psicon to the dll blocklist - for checkin
929 bytes, patch
standard8
: review+
Details | Diff | Splinter Review
1.9.2 version
1.03 KB, patch
dveditz
: approval1.9.2.11+
Details | Diff | Splinter Review 
crash [@ nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)]
3.0b4 #24
not a new crash

two crashes mention opening an attachment
http://crash-stats.mozilla.com/report/index/93cffb1c-fa4d-4409-817f-54f672090729
0	thunderbird.exe	nsCounterManager::AddCounterResetsAndIncrements	 layout/base/nsCounterManager.cpp:220
1	thunderbird.exe	nsCSSFrameConstructor::InitAndRestoreFrame	layout/base/nsCSSFrameConstructor.cpp:6807
2	thunderbird.exe	nsCSSFrameConstructor::ConstructXULFrame	layout/base/nsCSSFrameConstructor.cpp:6175
3	thunderbird.exe	nsCSSFrameConstructor::ConstructFrameInternal	layout/base/nsCSSFrameConstructor.cpp:7574
4	thunderbird.exe	nsCSSFrameConstructor::ConstructFrame	layout/base/nsCSSFrameConstructor.cpp:7444
5	thunderbird.exe	nsCSSFrameConstructor::ProcessChildren	layout/base/nsCSSFrameConstructor.cpp:11448
6	thunderbird.exe	nsCSSFrameConstructor::ConstructXULFrame	layout/base/nsCSSFrameConstructor.cpp:6240
7	thunderbird.exe	nsCSSFrameConstructor::ConstructFrameInternal	layout/base/nsCSSFrameConstructor.cpp:7574
8	thunderbird.exe	nsCSSFrameConstructor::ConstructFrame	layout/base/nsCSSFrameConstructor.cpp:7444
9	thunderbird.exe	nsCSSFrameConstructor::ProcessChildren	layout/base/nsCSSFrameConstructor.cpp:11448
10	thunderbird.exe	nsCSSFrameConstructor::ConstructXULFrame	layout/base/nsCSSFrameConstructor.cpp:6240
11	thunderbird.exe	nsCSSFrameConstructor::ConstructFrameInternal	layout/base/nsCSSFrameConstructor.cpp:7574
12	thunderbird.exe	nsCSSFrameConstructor::ConstructFrame	layout/base/nsCSSFrameConstructor.cpp:7444
13	thunderbird.exe	nsCSSFrameConstructor::ProcessChildren	layout/base/nsCSSFrameConstructor.cpp:11448
14	thunderbird.exe	nsCSSFrameConstructor::ConstructXULFrame	layout/base/nsCSSFrameConstructor.cpp:6240
15	thunderbird.exe	nsCSSFrameConstructor::ConstructFrameInternal	layout/base/nsCSSFrameConstructor.cpp:7574
16	thunderbird.exe	nsCSSFrameConstructor::ConstructFrame	layout/base/nsCSSFrameConstructor.cpp:7444
17	thunderbird.exe	nsCSSFrameConstructor::ContentInserted	layout/base/nsCSSFrameConstructor.cpp:9056
18	thunderbird.exe	nsCSSFrameConstructor::ContentAppended	layout/base/nsCSSFrameConstructor.cpp:8556
19	thunderbird.exe	PresShell::ContentAppended	layout/base/nsPresShell.cpp:4993
20	thunderbird.exe	nsNodeUtils::ContentAppended	content/base/src/nsNodeUtils.cpp:120
21	thunderbird.exe	nsGenericElement::doInsertChildAt	content/base/src/nsGenericElement.cpp:3277 

http://crash-stats.mozilla.com/report/index/f2215189-c433-416b-871f-182392090925
Should this go to Core - Layout or do you want to track here until STR are clearer?
(In reply to Arie comment #1)
> Should this go to Core - Layout or do you want to track here until STR are
> clearer?

Arie, fine to move somewhere more appropriate. I usually file them in Thunderbird first, so that interested parties can cc before it moves on to *getting fixed* :) in core.
Component: General → Layout
Product: Thunderbird → Core
QA Contact: general → layout
Version: 3.0 → unspecified
developers, 
a) is a testcase wanted? **
b) #7 crash for Thunderbird 3.0.3, so topcrash and tb30xwants, and flagging blocking 1.9.1 to put this on the radar

close to being a Firefox 3.6.2 topcrash - 316 crashes per 2 weeks. bp-393b1c6f-c1c7-41dc-b1ed-13dc32100325 (which has an email address) for Firefox 3.5 has same stack as thunderbird v3.0.  Some firefox comments:
right click>save image>crash
I have never had firefox crash so much lately 
When I'm trying to download anything
When downloading system freezes up. also script stops also on page
What in the world is going on? This thing crashes every day! 2-3 times a day. You NEVER email me as to why. 


** thunderbird crashes with email addresses
bp-56fe8776-e1a7-4d1e-aa43-631502100325
bp-6bb4a040-f10a-49ae-a10a-a2d082100323
bp-c7d117f9-ba5e-49c1-879b-c88272100324
bp-3651a3b4-c23b-4bf8-b075-1aadd2100325
bp-9cdd74d6-37e3-46fd-add7-d5b8a2100323 always crashes when saving an attachment
bp-f063b2f6-fe9a-4270-9556-df98e2100323
bp-39ab41be-22f0-46c4-a1c9-08c3d2100327
bp-f752813e-370e-4cf4-b3db-a3d532100325 extracting an attachment (.pps) kills thunderbird as soon as it's saved .. I can see the download window briefly and then it dies. The attachment is saved correctly to disk
blocking1.9.1: --- → ?
Keywords: topcrash
OS: Windows XP → All
Whiteboard: [tb30xwants][#7 thunderbird crasher]
Don't see how we could block a 1.9.1 release on a bug we have almost no information about :-(

Any module or extension correlations on the crash?
blocking1.9.1: ? → ---
status1.9.1: --- → wanted
Keywords: testcase-wanted
Thunderbird has crashes with no extensions like bp-c7d117f9-ba5e-49c1-879b-c88272100324, and no extensions correlate. I don't know how to pick anything out of Modules.

For FF 3.6.2 
* >50% cite downloading.
* crashes in 1.9.3 are almost non-existent, I find ~1/month, the last build being 20100118045856
* Correlations
    *
      Modules Next
      Loaded Correlation Data, but non available for this signature nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)
    *
      Modules by versions Next Previous
      Load
    *
      Addons Next Previous

      26% (19/74) vs.   7% (14112/198596) {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      50% (37/74) vs.  32% (64095/198596) jqs@sun.com (Java Quick Starter, http://java.sun.com/javase/downloads/)
      28% (21/74) vs.  13% (25141/198596) {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      22% (16/74) vs.  11% (20912/198596) {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      14% (10/74) vs.   4% (7076/198596) linkfilter@kaspersky.ru
      12% (9/74) vs.   3% (6277/198596) {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      34% (25/74) vs.  26% (50834/198596) {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
      9% (7/74) vs.   3% (6676/198596) {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      8% (6/74) vs.   2% (4152/198596) {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      12% (9/74) vs.   7% (13217/198596) {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
Melvin does this happen for all emails ? could you share an email with us ?
The attached file is an email that crashes Thunderbird when I save the attachment. Almost all emails with attachments crash when I try to open or save the attachment. I have had a couple small attachments that didn't crash. One of them was a 5 or 6 line MS Word document.
I tried this message with my debug trunk 1.9.3 build, and didn't see a crash.
(In reply to comment #9)
> I tried this message with my debug trunk 1.9.3 build, and didn't see a crash.

me too
Same here - so the issue is probably not related to the attachments themselves.
Usually Thunderbird crash when opening a connecterd files as jpg or doc (may be orther too). I have version 3.0.4. This is very frustrated. In the earier versions (3.0 - ???) I had no problem.
(In reply to comment #13)
> Usually Thunderbird crash when opening a connecterd files as jpg or doc (may be
> orther too). I have version 3.0.4. This is very frustrated. In the earier
> versions (3.0 - ???) I had no problem.

your 3.0.4 crash is bp-5cd371d2-bb47-4a20-b157-f92df2100409

can you install https://addons.mozilla.org/en-US/thunderbird/addon/9695 for thunderbird and then lookup your crashes View|ViewAbout|about:crashes  menu item to find when your crashes started.  It would be strange if your crashes didn't happen with all v3.0.x releases.
Thanks for the opportunity to comment. I have had this problem with all attachments of any kind with all versions of 3.0. I went back to 2.0 and the problem went away.

The crashes happened if I saved or forwarded an attachment. Since I no longer have version 3 on my machine, I can't reproduce the error, and I'm sorry that I don't have more specific information to send you. 

Thanks!
I checked my crash log and the first crash when saving an attachment was with version 3.0.3 on 3/15/10, 2 crashes on 3/25/10 and then I upgraded to 3.0.4 on 4/5/10 and have been crashing since then. Very small jpeg files will sometimes save without crashing, everything else does. I checked to see if I have installed any new software and the only thing I have found is WinZip Pro on 3/17/10--after my first crash. I downloaded the nightly build and tried it in safe and standard mode and the crashes are still happening. 56 crashes to date.
I just booted XP in safe mode and then opened Thunderbird (Lanikai 3.1b2pre) in safe mode. No change in the crash status.
** this crash highly correlates to Adobe Photoshop
 95% (194/204) vs.   3% (251/7601) psicon.dll

FIrefox crash comments include ...
I was attempting to download an e-book from Phoenix Public Library using Overdrive media
I don't know what happend but when i clicked INTERNET , the computer crashed me. I don't know why. Can you fix it?
Download an attached file from www.mail.yahoo.com
Closing Firefox
Closed download window after completing a download.
Does mozilla have an Adobe contact?

Melvin, and all who can reproduce... Do you have Photoshop installed or not? 
And if you do, is there any info from Adobe on this?
Summary: crash opening attachment [@ nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)] → crash opening attachment [@ nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)] MODULE: psicon.dll [adobe photoshop?]
we have quite a few people from adobe involved in our bugzilla. I don't know anyone from their photoshop team....

I don't see any reason for us to ask for help from Adobe before we consider our side.

218     const nsStyleContent *styleContent = aFrame->GetStyleContent();
219     if (!styleContent->CounterIncrementCount() &&
220         !styleContent->CounterResetCount())
221         return PR_FALSE;

Is the code, and it's basically saying "styleContent is 0".

Now, gecko style says that functions named GetFoo() can return 0. Functions named Foo() can't.... The problem is that this stuff is part of the style system's macro land, so i don't really know if that gecko convention applies here.

I'd rather melvin confirm he has photoshop, and then have him try disabling psicon.

fwiw psicon is a shell icon handler. as a class, shell icon handlers aren't known for being bug-free, but they also to my knowledge aren't among the top 3 buggy components we encounter :).
http://www.sitepoint.com/blogs/2005/12/13/adobe-cs2-and-the-case-of-the-disappearing-thumbnails/

As it happens, psicon has been implicated in crashes:
http://www.annoyances.org/exec/forum/winxp/t1061425126

It's fairly easy to disable psicon. And if someone confirms that's the problem, then we can blocklist it and contact adobe. But first I'd want someone to confirm they have photoshop/elements and then try disabling psicon's icon handling.

http://support.mozilla.com/chat people should be able to help disable the icon handler if the above links aren't sufficient for people here.
(In reply to comment #20)
> 218     const nsStyleContent *styleContent = aFrame->GetStyleContent();
> 219     if (!styleContent->CounterIncrementCount() &&
> 220         !styleContent->CounterResetCount())
> 221         return PR_FALSE;
> 
> Is the code, and it's basically saying "styleContent is 0".
> 
> Now, gecko style says that functions named GetFoo() can return 0. Functions
> named Foo() can't.... The problem is that this stuff is part of the style
> system's macro land, so i don't really know if that gecko convention applies
> here.

nsIFrame::GetStyleContext hasn't been renamed since we established that convention, but it should be (along with quite a few others, such as nsRuleNode::GetPresContext and nsStyleContext::GetStyle* and nsIFrame::GetStyle*).  It's not possible to create a frame without a style context.
Also, is the only way to get the relevant DLL to buy a copy of Photoshop?
legally? probably.

practically? absolutely not. google shows a number of sites willing to offer some flavor of it. however if you go that way, you'd want to ensure that the debug id matches the one implicated in the crashes, and you'd of course not want to use a system w/ any credentials you care about....
I have been very busy however I got the information from you folks this morning and went in and located the PSICON.dll and renamed it to psicon.disable.dll. I restarted the computer and started Thunderbird 3.0.4, rv 1.9.1.9. I saved 25 attached files without a crash. I then started Photoshop 7.0.1, it didn't seem to miss the dll file. I don't know what it was supposed to do, anyway, I downloaded several more files. I then closed TB and opened Lanikai 3.1pre rv 1.9.2.4 and sucessfully saved 25 attachments with it.

The psicon.dll file is dated April 06, 2002.
File version: 6.6.64.53

I will gladly send the file if it is needed.

For now I am leaving it disabled unless I find I have to have it.

Appreciate all your work. Beats IE even with the crashes.

Melvin
dbaron, what's next step? request blocklist?  

Melvin, v2 didn't crash for you with these steps, correct?
Wayne, I am not sure what you are referring to as v2 however I have not had any crashes since 5/26/10, using Lanikai 3.1.1pre and Thunderbird 3.0 and 3.1. I still have psicon.dll disabled.
v2 = thunderbird version 2
I did not have a problem with v2 and I still had the psicon.dll loading at that time.
we should probably blocklist the library. the only thing it should be doing is giving files prettier icons in file pickers and perhaps the downloads window.

i've cc'd one person from adobe, hopefully someone can investigate this on adobe's side.

as for why we crash now whereas we didn't in the past, it's possible that their code damaged something which was not sensitive in the past and our code changed so that the area they're damaging is now more sensitive. it's hard to know without doing a lot of debugging. It's easier for Adobe to do this since they have the sources for both their code and ours (ours being open).
I can track down some help on the Photoshop team.
Here is the feedback I received from the Photoshop team:
Yes, psicon.dll was a shell extension to provide explorer thumbnails on Windows. We got rid of psicon.dll several years ago  (CS3 I think) — it relied on Windows APIs that caused files to remain open for reading (and prevent apps from saving over them).  In other cases, the OS APIs would cause crashes while rendering the thumbnails. As far as we know, Microsoft never fixed those APIs.
(the bug is still open, still marked as pending fix)

To resolve this, you should be able to delete or rename the file.
Sounds like we should blocklist, then.

Should we still be going through the AMO blocklisting component for additions to the DLL blocklist, or should it be moved directly to somewhere else?
Component: Layout → Blocklisting
Product: Core → addons.mozilla.org
QA Contact: layout → blocklisting
thanks paul
URL: http://gsfn.us/t/16skr
Whiteboard: [tb30xwants][#7 thunderbird crasher] → [tb30xwants][#7 thunderbird crasher][gs]
Whiteboard: [tb30xwants][#7 thunderbird crasher][gs] → [tb30xwants][tb31needs][#7 thunderbird crasher][gs]
we will want this ASAP ... given comment 28, we will get a strong uptick in these crashes when major update from version 2 is triggered in the next 24 hours.
Keywords: testcase-wanted → testcase
Whiteboard: [tb30xwants][tb31needs][#7 thunderbird crasher][gs] → [tb30xwants][tb31needs][#4 thunderbird crasher][gs]
Attached patch Add psicon to the dll blocklist (obsolete) — — Splinter Review 
Assignee: nobody → bugzilla
Status: NEW → ASSIGNED

    
    

    
  
Comment on attachment 467373 [details] [diff] [review]
Add psicon to the dll blocklist

This blocks psicon.dll as suggested/agreed earlier in this bugs comments. Will help crashes on both Firefox and Thunderbird.

        Attachment #467373 -
        Flags: review?(vladimir)

    
  
Whiteboard: [tb30xwants][tb31needs][#4 thunderbird crasher][gs] → [tb31needs][#4 thunderbird crasher][gs]

    
    

    
  
I'm not sure which product/component this should go in, but addons doesn't have the approval attachment flag. So I'm going to stick it in core for now.
Component: Blocklisting → General
Product: addons.mozilla.org → Core
QA Contact: blocklisting → general

    
    

    
  
Comment on attachment 467373 [details] [diff] [review]
Add psicon to the dll blocklist

Requesting approval 2.0 for this - addition of an old dll to the blocker list to prevent crashes.

        Attachment #467373 -
        Flags: approval2.0?

    
    

    
  
Note: We've taken this for Thunderbird 3.1.3 as this is a low-risk crash fix for a big top crasher. Checked in on release branch only:

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/f61e1541695e
Whiteboard: [tb31needs][#4 thunderbird crasher][gs] → [tb31needs][#4 thunderbird crasher][gs][fixed tb3.1.3]

    
    

    
  


  
Patch with hg information for checkin.

        Attachment #467373 -
        Attachment is obsolete: true

        Attachment #470805 -
        Flags: review+

    
  
Keywords: checkin-needed

    
    

    
  
Comment on attachment 470805 [details] [diff] [review]
[checked-in] Add psicon to the dll blocklist - for checkin

http://hg.mozilla.org/mozilla-central/rev/ddbc06ca870f

        Attachment #470805 -
        Attachment description: Add psicon to the dll blocklist - for checkin → [checked-in] Add psicon to the dll blocklist - for checkin
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Keywords: checkin-needed
Resolution: --- → FIXED

    
    

    
  

      
      
      
      

        Attached patch
          
          
        1.9.2 version
        — 
          — Splinter Review
      

    


  
This is the 1.9.2 version. Requesting approval for branch checkin - low risk patch that adds a problematic dll to the dll blocklist. This should fix a what is currently the number 3 topcrash for Thunderbird users.

        Attachment #472352 -
        Flags: approval1.9.2.10?
Blocks: 595097

    
  
blocking1.9.2: --- → ?
blocking1.9.2: ? → needed

          status1.9.2:
          --- → wanted

    
    

    
  
Comment on attachment 472352 [details] [diff] [review]
1.9.2 version

Approved for 1.9.2.11, a=dveditz for release-drivers

        Attachment #472352 -
        Flags: approval1.9.2.11? → approval1.9.2.11+

    
    

    
  
Checked into 1.9.2: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/8d0605c50d2a

          status1.9.2:
          wanted → .11-fixed
Whiteboard: [tb31needs][#4 thunderbird crasher][gs][fixed tb3.1.3] → [tb31needed][#4 thunderbird crasher][gs][fixed tb3.1.3]
Target Milestone: --- → mozilla2.0b6

    
    

    
  
Verified for 1.9.2 via code inspection. Yay.
Keywords: verified1.9.2
Crash Signature: [@ nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: