528843 - crash [@ nsRefPtr<nsSpeculativeScriptThread>::assign_assuming_AddRef(nsSpeculativeScriptThread*)]

Status: RESOLVED DUPLICATE of bug 527422

(Thunderbird :: Message Compose Window, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsRefPtr<nsSpeculativeScriptThread>::assign_assuming_AddRef(nsSpeculativeScriptThread*)]
only seen with 3.0rc1 builds. currently #1 crash, but that's not saying much.

another enigmail variation?

Comment 1

[Wayne Mery (:wsmwk)]

bp-9166db8e-4807-4b9f-8708-d854d2091114
0	thunderbird.exe	nsRefPtr<nsSpeculativeScriptThread>::assign_assuming_AddRef	 objdir-tb/mozilla/dist/include/xpcom/nsAutoPtr.h:943
1	thunderbird.exe	nsRefPtr<nsDOMWorkerXHRProxy>::assign_with_AddRef	objdir-tb/mozilla/dist/include/xpcom/nsAutoPtr.h:928
2	thunderbird.exe	nsMsgComposeAndSend::InitCompositionFields	mailnews/compose/src/nsMsgSend.cpp:2813
3	thunderbird.exe	nsMsgComposeAndSend::Init	mailnews/compose/src/nsMsgSend.cpp:3415
4	thunderbird.exe	nsMsgComposeAndSend::CreateAndSendMessage	mailnews/compose/src/nsMsgSend.cpp:4290
5	thunderbird.exe	nsMsgCompose::_SendMsg	mailnews/compose/src/nsMsgCompose.cpp:1050
6	thunderbird.exe	nsMsgCompose::SendMsg	mailnews/compose/src/nsMsgCompose.cpp:1247
7	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101

Comment 2

[Mark Banner (:standard8)]

(In reply to comment #0)
> another enigmail variation?

Yes, the nsMsgnsMsgComposeAndSend::InitCompositionFields is in the exact same place.

Comment 3

[Patrick Brunschwig]

I recently used by accident an older nightly build of Enigmail latest TB3 under Windows, and it crashed (on Linux I'll simply get an exception). I'll retry this and submit the crash report to see if it's really the same source.

Comment 4

[Patrick Brunschwig]

Hmm, my crash reports from Thunderbird were not submitted. Is there anything I could do to force submission, or is there a way to inspect the crash locally?

Comment 5

[timeless]

https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

Comment 6

[Ludovic Hirlimann [:Usul]]

(In reply to comment #4)
> Hmm, my crash reports from Thunderbird were not submitted. Is there anything I
> could do to force submission, or is there a way to inspect the crash locally?

Crash reporter didn't show up ? or the crash doesn't appear on crash-stats ?

Are the minidumps generated ?

Comment 7

[Patrick Brunschwig]

The crash reporter shows up, but it cannot submit the report. Looking at the submit.log file, I get this error:

[11/16/09 09:52:33] Crash report submission failed: A connection with the server could not be established

Internet connectivity is apparently not an issue, otherwise I could not have downloaded the RC build ...

Comment 8

[Ludovic Hirlimann [:Usul]]

If you are behind a firewall it could be.

Ted is there an easy way for a user to submit a crash report via http ?

Comment 9

[(not currently active) Ted Mielczarek]

Not particularly, but if this is on Windows the .dmp file is readable in a debugger (with the help of the symbol server). If you look in the pending/ directory next to the log file you'll find the .dmp. You can attach it here or email it to a developer if you'd like.

Comment 10

[Patrick Brunschwig]

Attachment: Crash dump with wrong version of Enigmail

Alright, attaching my dump file: Thunderbird 3.0 RC 1 build 1 on Windows XP (SP3) with an old version of Enigmail that does not have the API changes.

Comment 11

[(not currently active) Ted Mielczarek]

I got the following stack from Patrick's minidump. It looks very similar to the stack from comment 1:
thunderbird!nsRefPtr<nsOfflineCacheUpdate>::assign_assuming_AddRef(class nsOfflineCacheUpdate * newPtr = 0x00a20b37)+0x8 [e:\buildbot\win32_build\build\objdir-tb\mozilla\dist\include\xpcom\nsautoptr.h @ 943]
thunderbird!nsRefPtr<nsXPCFastLoadIO>::assign_with_AddRef(class nsXPCFastLoadIO * rawPtr = 0x00a20b37)+0x1a [e:\buildbot\win32_build\build\objdir-tb\mozilla\dist\include\xpcom\nsautoptr.h @ 928]
thunderbird!nsMsgComposeAndSend::InitCompositionFields(class nsMsgCompFields * fields = 0x033e3ed0, class nsACString_internal * aOriginalMsgURI = 0x0520359c, int aType = 0)+0x33 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgsend.cpp @ 2814]
thunderbird!nsMsgComposeAndSend::Init(class nsIMsgIdentity * aUserIdentity = 0x02f30ac0, char * aAccountKey = 0x045becc0 "", class nsMsgCompFields * fields = 0x033e3ed0, class nsIFile * sendFile = 0x00000000, int digest_p = 0, int dont_deliver_p = 0, int mode = 1, class nsIMsgDBHdr * msgToReplace = 0x00000001, char * attachment1 [details] [diff] [review]_type = 0x00c69d5c "text/html", char * attachment1 [details] [diff] [review]_body = 0x00000000 "", unsigned int attachment1 [details] [diff] [review]_body_length = 0, struct nsMsgAttachmentData * attachments = 0x00000000, struct nsMsgAttachedFile * preloaded_attachments = 0x00000000, char * password = 0x04919478 "", class nsACString_internal * aOriginalMsgURI = 0x0520359c, int aType = 0)+0x220 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgsend.cpp @ 3416]
thunderbird!nsMsgComposeAndSend::CreateAndSendMessage(class nsIEditor * aEditor = 0x0509e400, class nsIMsgIdentity * aUserIdentity = 0x02f30ac0, char * aAccountKey = 0x045becc0 "", class nsIMsgCompFields * fields = 0x033e3ed0, int digest_p = 0, int dont_deliver_p = 0, int mode = 1, class nsIMsgDBHdr * msgToReplace = 0x00000000, char * attachment1 [details] [diff] [review]_type = 0x00c69d5c "text/html", char * attachment1 [details] [diff] [review]_body = 0x002fa450 "", unsigned int attachment1 [details] [diff] [review]_body_length = 0, struct nsMsgAttachmentData * attachments = 0x00000000, struct nsMsgAttachedFile * preloaded_attachments = 0x00000000, void * relatedPart = 0x00000000, class nsIDOMWindowInternal * parentWindow = 0x019825e0, class nsIMsgProgress * progress = 0x05279fc0, class nsIMsgSendListener * aListener = 0x057edc84, char * password = 0x04919478 "", class nsACString_internal * aOriginalMsgURI = 0x0520359c, int aType = 0)+0x94 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgsend.cpp @ 4290]
thunderbird!nsMsgCompose::_SendMsg(int deliverMode = 1, class nsIMsgIdentity * identity = 0x02f30ac0, char * accountKey = 0x045becc0 "", int entityConversionDone = 0)+0x305 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgcompose.cpp @ 1053]
thunderbird!nsMsgCompose::SendMsg(int deliverMode = 1, class nsIMsgIdentity * identity = 0x02f30ac0, char * accountKey = 0x045becc0 "", class nsIMsgWindow * aMsgWindow = 0x052a7060, class nsIMsgProgress * progress = 0x05279fc0)+0x6a8 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgcompose.cpp @ 1248]
xpcom_core!NS_InvokeByIndex_P(class nsISupports * that = 0x05203580, unsigned int methodIndex = 0xd, unsigned int paramCount = 5, struct nsXPTCVariant * params = 0x0012dfa4)+0x27 [e:\buildbot\win32_build\build\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp @ 102]
thunderbird!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x04fca196, XPCWrappedNative::CallMode mode = 37905216 (No matching enumerant))+0x826 [e:\buildbot\win32_build\build\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2456]

(These stacks are truncated due to bug 524256 not having landed on the 1.9.1 branch.)

I don't know what's going on at the top of the stack there, but I think the types are bogus and those should both be nsRefPtr<nsMsgCompFields>, since the crash goes through here:
http://mxr.mozilla.org/comm-1.9.1/source/mailnews/compose/src/nsMsgSend.cpp#2813
and that's clearly assigning to a nsRefPtr<nsMsgCompFields>. I guess somehow the compiler is producing confusing debug info with templates. :-/

Anwyay, the real crash appears to be inside nsRefPtr, right here:
http://mxr.mozilla.org/mozilla1.9.1/source/xpcom/base/nsAutoPtr.h#944

You have a non-NULL value in that nsRefPtr, but it points at invalid memory. I have no idea what causes that.

Comment 12

[(not currently active) Ted Mielczarek]

(Note that the confusing template types can't be a Breakpad bug, since I got that stack with WinDBG, and the types are still confused.)