522575 - crash opening attachment [@ nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)] MODULE: psicon.dll [adobe photoshop?]

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)]
3.0b4 #24
not a new crash

two crashes mention opening an attachment
http://crash-stats.mozilla.com/report/index/93cffb1c-fa4d-4409-817f-54f672090729
0	thunderbird.exe	nsCounterManager::AddCounterResetsAndIncrements	 layout/base/nsCounterManager.cpp:220
1	thunderbird.exe	nsCSSFrameConstructor::InitAndRestoreFrame	layout/base/nsCSSFrameConstructor.cpp:6807
2	thunderbird.exe	nsCSSFrameConstructor::ConstructXULFrame	layout/base/nsCSSFrameConstructor.cpp:6175
3	thunderbird.exe	nsCSSFrameConstructor::ConstructFrameInternal	layout/base/nsCSSFrameConstructor.cpp:7574
4	thunderbird.exe	nsCSSFrameConstructor::ConstructFrame	layout/base/nsCSSFrameConstructor.cpp:7444
5	thunderbird.exe	nsCSSFrameConstructor::ProcessChildren	layout/base/nsCSSFrameConstructor.cpp:11448
6	thunderbird.exe	nsCSSFrameConstructor::ConstructXULFrame	layout/base/nsCSSFrameConstructor.cpp:6240
7	thunderbird.exe	nsCSSFrameConstructor::ConstructFrameInternal	layout/base/nsCSSFrameConstructor.cpp:7574
8	thunderbird.exe	nsCSSFrameConstructor::ConstructFrame	layout/base/nsCSSFrameConstructor.cpp:7444
9	thunderbird.exe	nsCSSFrameConstructor::ProcessChildren	layout/base/nsCSSFrameConstructor.cpp:11448
10	thunderbird.exe	nsCSSFrameConstructor::ConstructXULFrame	layout/base/nsCSSFrameConstructor.cpp:6240
11	thunderbird.exe	nsCSSFrameConstructor::ConstructFrameInternal	layout/base/nsCSSFrameConstructor.cpp:7574
12	thunderbird.exe	nsCSSFrameConstructor::ConstructFrame	layout/base/nsCSSFrameConstructor.cpp:7444
13	thunderbird.exe	nsCSSFrameConstructor::ProcessChildren	layout/base/nsCSSFrameConstructor.cpp:11448
14	thunderbird.exe	nsCSSFrameConstructor::ConstructXULFrame	layout/base/nsCSSFrameConstructor.cpp:6240
15	thunderbird.exe	nsCSSFrameConstructor::ConstructFrameInternal	layout/base/nsCSSFrameConstructor.cpp:7574
16	thunderbird.exe	nsCSSFrameConstructor::ConstructFrame	layout/base/nsCSSFrameConstructor.cpp:7444
17	thunderbird.exe	nsCSSFrameConstructor::ContentInserted	layout/base/nsCSSFrameConstructor.cpp:9056
18	thunderbird.exe	nsCSSFrameConstructor::ContentAppended	layout/base/nsCSSFrameConstructor.cpp:8556
19	thunderbird.exe	PresShell::ContentAppended	layout/base/nsPresShell.cpp:4993
20	thunderbird.exe	nsNodeUtils::ContentAppended	content/base/src/nsNodeUtils.cpp:120
21	thunderbird.exe	nsGenericElement::doInsertChildAt	content/base/src/nsGenericElement.cpp:3277 

http://crash-stats.mozilla.com/report/index/f2215189-c433-416b-871f-182392090925

Comment 1

[Arie Paap [:wildmyron]]

Should this go to Core - Layout or do you want to track here until STR are clearer?

Comment 2

[Wayne Mery (:wsmwk)]

(In reply to Arie comment #1)
> Should this go to Core - Layout or do you want to track here until STR are
> clearer?

Arie, fine to move somewhere more appropriate. I usually file them in Thunderbird first, so that interested parties can cc before it moves on to *getting fixed* :) in core.

Comment 3

[Wayne Mery (:wsmwk)]

developers, 
a) is a testcase wanted? **
b) #7 crash for Thunderbird 3.0.3, so topcrash and tb30xwants, and flagging blocking 1.9.1 to put this on the radar

close to being a Firefox 3.6.2 topcrash - 316 crashes per 2 weeks. bp-393b1c6f-c1c7-41dc-b1ed-13dc32100325 (which has an email address) for Firefox 3.5 has same stack as thunderbird v3.0.  Some firefox comments:
right click>save image>crash
I have never had firefox crash so much lately 
When I'm trying to download anything
When downloading system freezes up. also script stops also on page
What in the world is going on? This thing crashes every day! 2-3 times a day. You NEVER email me as to why. 


** thunderbird crashes with email addresses
bp-56fe8776-e1a7-4d1e-aa43-631502100325
bp-6bb4a040-f10a-49ae-a10a-a2d082100323
bp-c7d117f9-ba5e-49c1-879b-c88272100324
bp-3651a3b4-c23b-4bf8-b075-1aadd2100325
bp-9cdd74d6-37e3-46fd-add7-d5b8a2100323 always crashes when saving an attachment
bp-f063b2f6-fe9a-4270-9556-df98e2100323
bp-39ab41be-22f0-46c4-a1c9-08c3d2100327
bp-f752813e-370e-4cf4-b3db-a3d532100325 extracting an attachment (.pps) kills thunderbird as soon as it's saved .. I can see the download window briefly and then it dies. The attachment is saved correctly to disk

Comment 4

[Daniel Veditz [:dveditz]]

Don't see how we could block a 1.9.1 release on a bug we have almost no information about :-(

Any module or extension correlations on the crash?

Comment 5

[Wayne Mery (:wsmwk)]

Thunderbird has crashes with no extensions like bp-c7d117f9-ba5e-49c1-879b-c88272100324, and no extensions correlate. I don't know how to pick anything out of Modules.

For FF 3.6.2 
* >50% cite downloading.
* crashes in 1.9.3 are almost non-existent, I find ~1/month, the last build being 20100118045856
* Correlations
    *
      Modules Next
      Loaded Correlation Data, but non available for this signature nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*)
    *
      Modules by versions Next Previous
      Load
    *
      Addons Next Previous

      26% (19/74) vs.   7% (14112/198596) {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      50% (37/74) vs.  32% (64095/198596) [e-mail] (Java Quick Starter, http://java.sun.com/javase/downloads/)
      28% (21/74) vs.  13% (25141/198596) {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      22% (16/74) vs.  11% (20912/198596) {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      14% (10/74) vs.   4% (7076/198596) [e-mail]
      12% (9/74) vs.   3% (6277/198596) {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      34% (25/74) vs.  26% (50834/198596) {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
      9% (7/74) vs.   3% (6676/198596) {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      8% (6/74) vs.   2% (4152/198596) {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)
      12% (9/74) vs.   7% (13217/198596) {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Console, http://java.sun.com/javase/downloads/)

Comment 7

[Ludovic Hirlimann [:Usul]]

Melvin does this happen for all emails ? could you share an email with us ?

Comment 8

[Melvin]

Attachment: Email with attachment that crashes when saved

The attached file is an email that crashes Thunderbird when I save the attachment. Almost all emails with attachments crash when I try to open or save the attachment. I have had a couple small attachments that didn't crash. One of them was a 5 or 6 line MS Word document.

Comment 9

[David :Bienvenu]

I tried this message with my debug trunk 1.9.3 build, and didn't see a crash.

Comment 10

[[:Aureliano Buendía]]

(In reply to comment #9)
> I tried this message with my debug trunk 1.9.3 build, and didn't see a crash.

me too

Comment 11

[Ludovic Hirlimann [:Usul]]

Same here - so the issue is probably not related to the attachments themselves.

Comment 12

[Wayne Mery (:wsmwk)]

melvin, can you try v3.1? ftp://ftp.mozilla.org/pub/thunderbird/nightly/latest-comm-1.9.2/  backup your profile before using


more anecdotal stuff..

last crash found for thunderbird v3.1 is 20100302141414 build

stacks for FF nsCounterManager::AddCounterResetsAndIncrements(nsIFrame*) are not the same as thunderbird
http://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&branch=1.9.2&branch=1.9.3&date=&range_value=4&range_unit=weeks&query_search=signature&query_type=exact&query=nsCounterManager%3A%3AAddCounterResetsAndIncrements%28nsIFrame*%29&build_id=&process_type=all&do_query=1

pmed these thunderbird crash reporters
https://crash-stats.mozilla.com/report/index/576965b9-3bda-4ae2-99ef-657bd2100408
https://crash-stats.mozilla.com/report/index/e57ccc26-9d56-4ac4-b153-d46012100408
https://crash-stats.mozilla.com/report/index/5cd371d2-bb47-4a20-b157-f92df2100409
https://crash-stats.mozilla.com/report/index/21f647b6-6ee4-490b-b1b7-980ea2100409
https://crash-stats.mozilla.com/report/index/3bfeeaaf-a12d-415a-b4b6-72f132100409
https://crash-stats.mozilla.com/report/index/d55b18f5-4f71-4e97-bdb0-af7fb2100413
https://crash-stats.mozilla.com/report/index/5001680b-94ff-4c82-9ae3-9f0682100413
https://crash-stats.mozilla.com/report/index/fd1c3af7-f5bd-4aa3-acb2-f12852100409
https://crash-stats.mozilla.com/report/index/3b95e7c2-77a9-4cad-8fde-ac9ec2100411

Comment 13

[Bengt Kålax]

Usually Thunderbird crash when opening a connecterd files as jpg or doc (may be orther too). I have version 3.0.4. This is very frustrated. In the earier versions (3.0 - ???) I had no problem.

Comment 14

[Wayne Mery (:wsmwk)]

(In reply to comment #13)
> Usually Thunderbird crash when opening a connecterd files as jpg or doc (may be
> orther too). I have version 3.0.4. This is very frustrated. In the earier
> versions (3.0 - ???) I had no problem.

your 3.0.4 crash is bp-5cd371d2-bb47-4a20-b157-f92df2100409

can you install https://addons.mozilla.org/en-US/thunderbird/addon/9695 for thunderbird and then lookup your crashes View|ViewAbout|about:crashes  menu item to find when your crashes started.  It would be strange if your crashes didn't happen with all v3.0.x releases.

Comment 15

[Karen Story]

Thanks for the opportunity to comment. I have had this problem with all attachments of any kind with all versions of 3.0. I went back to 2.0 and the problem went away.

The crashes happened if I saved or forwarded an attachment. Since I no longer have version 3 on my machine, I can't reproduce the error, and I'm sorry that I don't have more specific information to send you. 

Thanks!

Comment 16

[Melvin]

I checked my crash log and the first crash when saving an attachment was with version 3.0.3 on 3/15/10, 2 crashes on 3/25/10 and then I upgraded to 3.0.4 on 4/5/10 and have been crashing since then. Very small jpeg files will sometimes save without crashing, everything else does. I checked to see if I have installed any new software and the only thing I have found is WinZip Pro on 3/17/10--after my first crash. I downloaded the nightly build and tried it in safe and standard mode and the crashes are still happening. 56 crashes to date.

Comment 17

[Melvin]

I just booted XP in safe mode and then opened Thunderbird (Lanikai 3.1b2pre) in safe mode. No change in the crash status.

Comment 18

[Wayne Mery (:wsmwk)]

** this crash highly correlates to Adobe Photoshop
 95% (194/204) vs.   3% (251/7601) psicon.dll

FIrefox crash comments include ...
I was attempting to download an e-book from Phoenix Public Library using Overdrive media
I don't know what happend but when i clicked INTERNET , the computer crashed me. I don't know why. Can you fix it?
Download an attached file from www.mail.yahoo.com
Closing Firefox
Closed download window after completing a download.

Comment 19

[Wayne Mery (:wsmwk)]

Does mozilla have an Adobe contact?

Melvin, and all who can reproduce... Do you have Photoshop installed or not? 
And if you do, is there any info from Adobe on this?

Comment 20

[timeless]

we have quite a few people from adobe involved in our bugzilla. I don't know anyone from their photoshop team....

I don't see any reason for us to ask for help from Adobe before we consider our side.

218     const nsStyleContent *styleContent = aFrame->GetStyleContent();
219     if (!styleContent->CounterIncrementCount() &&
220         !styleContent->CounterResetCount())
221         return PR_FALSE;

Is the code, and it's basically saying "styleContent is 0".

Now, gecko style says that functions named GetFoo() can return 0. Functions named Foo() can't.... The problem is that this stuff is part of the style system's macro land, so i don't really know if that gecko convention applies here.

I'd rather melvin confirm he has photoshop, and then have him try disabling psicon.

fwiw psicon is a shell icon handler. as a class, shell icon handlers aren't known for being bug-free, but they also to my knowledge aren't among the top 3 buggy components we encounter :).
http://www.sitepoint.com/blogs/2005/12/13/adobe-cs2-and-the-case-of-the-disappearing-thumbnails/

As it happens, psicon has been implicated in crashes:
http://www.annoyances.org/exec/forum/winxp/t1061425126

It's fairly easy to disable psicon. And if someone confirms that's the problem, then we can blocklist it and contact adobe. But first I'd want someone to confirm they have photoshop/elements and then try disabling psicon's icon handling.

http://support.mozilla.com/chat people should be able to help disable the icon handler if the above links aren't sufficient for people here.

Comment 21

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to comment #20)
> 218     const nsStyleContent *styleContent = aFrame->GetStyleContent();
> 219     if (!styleContent->CounterIncrementCount() &&
> 220         !styleContent->CounterResetCount())
> 221         return PR_FALSE;
> 
> Is the code, and it's basically saying "styleContent is 0".
> 
> Now, gecko style says that functions named GetFoo() can return 0. Functions
> named Foo() can't.... The problem is that this stuff is part of the style
> system's macro land, so i don't really know if that gecko convention applies
> here.

nsIFrame::GetStyleContext hasn't been renamed since we established that convention, but it should be (along with quite a few others, such as nsRuleNode::GetPresContext and nsStyleContext::GetStyle* and nsIFrame::GetStyle*).  It's not possible to create a frame without a style context.

Comment 22

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Also, is the only way to get the relevant DLL to buy a copy of Photoshop?

Comment 23

[timeless]

legally? probably.

practically? absolutely not. google shows a number of sites willing to offer some flavor of it. however if you go that way, you'd want to ensure that the debug id matches the one implicated in the crashes, and you'd of course not want to use a system w/ any credentials you care about....

Comment 24

[Melvin]

I have been very busy however I got the information from you folks this morning and went in and located the PSICON.dll and renamed it to psicon.disable.dll. I restarted the computer and started Thunderbird 3.0.4, rv 1.9.1.9. I saved 25 attached files without a crash. I then started Photoshop 7.0.1, it didn't seem to miss the dll file. I don't know what it was supposed to do, anyway, I downloaded several more files. I then closed TB and opened Lanikai 3.1pre rv 1.9.2.4 and sucessfully saved 25 attachments with it.

The psicon.dll file is dated April 06, 2002.
File version: 6.6.64.53

I will gladly send the file if it is needed.

For now I am leaving it disabled unless I find I have to have it.

Appreciate all your work. Beats IE even with the crashes.

Melvin

Comment 25

[Wayne Mery (:wsmwk)]

dbaron, what's next step? request blocklist?  

Melvin, v2 didn't crash for you with these steps, correct?

Comment 26

[Melvin]

Wayne, I am not sure what you are referring to as v2 however I have not had any crashes since 5/26/10, using Lanikai 3.1.1pre and Thunderbird 3.0 and 3.1. I still have psicon.dll disabled.

Comment 27

[Wayne Mery (:wsmwk)]

v2 = thunderbird version 2

Comment 28

[Melvin]

I did not have a problem with v2 and I still had the psicon.dll loading at that time.

Comment 29

[timeless]

we should probably blocklist the library. the only thing it should be doing is giving files prettier icons in file pickers and perhaps the downloads window.

i've cc'd one person from adobe, hopefully someone can investigate this on adobe's side.

as for why we crash now whereas we didn't in the past, it's possible that their code damaged something which was not sensitive in the past and our code changed so that the area they're damaging is now more sensitive. it's hard to know without doing a lot of debugging. It's easier for Adobe to do this since they have the sources for both their code and ours (ours being open).

Comment 30

[Paul Betlem]

I can track down some help on the Photoshop team.

Comment 31

[Paul Betlem]

Here is the feedback I received from the Photoshop team:
Yes, psicon.dll was a shell extension to provide explorer thumbnails on Windows. We got rid of psicon.dll several years ago  (CS3 I think) — it relied on Windows APIs that caused files to remain open for reading (and prevent apps from saving over them).  In other cases, the OS APIs would cause crashes while rendering the thumbnails. As far as we know, Microsoft never fixed those APIs.
(the bug is still open, still marked as pending fix)

To resolve this, you should be able to delete or rename the file.

Comment 32

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Sounds like we should blocklist, then.

Should we still be going through the AMO blocklisting component for additions to the DLL blocklist, or should it be moved directly to somewhere else?

Comment 33

[timeless]

thanks paul

Comment 34

[Wayne Mery (:wsmwk)]

we will want this ASAP ... given comment 28, we will get a strong uptick in these crashes when major update from version 2 is triggered in the next 24 hours.

Comment 35

[Mark Banner (:standard8)]

Attachment: Add psicon to the dll blocklist

Comment 36

[Mark Banner (:standard8)]

Comment on attachment 467373 [details] [diff] [review]
Add psicon to the dll blocklist

This blocks psicon.dll as suggested/agreed earlier in this bugs comments. Will help crashes on both Firefox and Thunderbird.

Comment 37

[Mark Banner (:standard8)]

I'm not sure which product/component this should go in, but addons doesn't have the approval attachment flag. So I'm going to stick it in core for now.

Comment 38

[Mark Banner (:standard8)]

Comment on attachment 467373 [details] [diff] [review]
Add psicon to the dll blocklist

Requesting approval 2.0 for this - addition of an old dll to the blocker list to prevent crashes.

Comment 39

[Mark Banner (:standard8)]

Note: We've taken this for Thunderbird 3.1.3 as this is a low-risk crash fix for a big top crasher. Checked in on release branch only:

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/f61e1541695e

Comment 40

[Mark Banner (:standard8)]

Attachment: [checked-in] Add psicon to the dll blocklist - for checkin

Patch with hg information for checkin.

Comment 41

[Rob Campbell [:rc] (:robcee)]

Comment on attachment 470805 [details] [diff] [review]
[checked-in] Add psicon to the dll blocklist - for checkin

http://hg.mozilla.org/mozilla-central/rev/ddbc06ca870f

Comment 42

[Mark Banner (:standard8)]

Attachment: 1.9.2 version

This is the 1.9.2 version. Requesting approval for branch checkin - low risk patch that adds a problematic dll to the dll blocklist. This should fix a what is currently the number 3 topcrash for Thunderbird users.

Comment 43

[Daniel Veditz [:dveditz]]

Comment on attachment 472352 [details] [diff] [review]
1.9.2 version

Approved for 1.9.2.11, a=dveditz for release-drivers

Comment 44

[Mark Banner (:standard8)]

Checked into 1.9.2: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/8d0605c50d2a

Comment 45

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.9.2 via code inspection. Yay.