crash [@ nsRefPtr<nsSpeculativeScriptThread>::assign_assuming_AddRef(nsSpeculativeScriptThread*)]

RESOLVED DUPLICATE of bug 527422

Status

--
critical
RESOLVED DUPLICATE of bug 527422
9 years ago
8 years ago

People

(Reporter: wsmwk, Unassigned)

Tracking

({crash})

x86
Windows XP
crash

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
crash [@ nsRefPtr<nsSpeculativeScriptThread>::assign_assuming_AddRef(nsSpeculativeScriptThread*)]
only seen with 3.0rc1 builds. currently #1 crash, but that's not saying much.

another enigmail variation?
(Reporter)

Comment 1

9 years ago
bp-9166db8e-4807-4b9f-8708-d854d2091114
0	thunderbird.exe	nsRefPtr<nsSpeculativeScriptThread>::assign_assuming_AddRef	 objdir-tb/mozilla/dist/include/xpcom/nsAutoPtr.h:943
1	thunderbird.exe	nsRefPtr<nsDOMWorkerXHRProxy>::assign_with_AddRef	objdir-tb/mozilla/dist/include/xpcom/nsAutoPtr.h:928
2	thunderbird.exe	nsMsgComposeAndSend::InitCompositionFields	mailnews/compose/src/nsMsgSend.cpp:2813
3	thunderbird.exe	nsMsgComposeAndSend::Init	mailnews/compose/src/nsMsgSend.cpp:3415
4	thunderbird.exe	nsMsgComposeAndSend::CreateAndSendMessage	mailnews/compose/src/nsMsgSend.cpp:4290
5	thunderbird.exe	nsMsgCompose::_SendMsg	mailnews/compose/src/nsMsgCompose.cpp:1050
6	thunderbird.exe	nsMsgCompose::SendMsg	mailnews/compose/src/nsMsgCompose.cpp:1247
7	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
(In reply to comment #0)
> another enigmail variation?

Yes, the nsMsgnsMsgComposeAndSend::InitCompositionFields is in the exact same place.

Comment 3

9 years ago
I recently used by accident an older nightly build of Enigmail latest TB3 under Windows, and it crashed (on Linux I'll simply get an exception). I'll retry this and submit the crash report to see if it's really the same source.

Comment 4

9 years ago
Hmm, my crash reports from Thunderbird were not submitted. Is there anything I could do to force submission, or is there a way to inspect the crash locally?
(In reply to comment #4)
> Hmm, my crash reports from Thunderbird were not submitted. Is there anything I
> could do to force submission, or is there a way to inspect the crash locally?

Crash reporter didn't show up ? or the crash doesn't appear on crash-stats ?

Are the minidumps generated ?

Comment 7

9 years ago
The crash reporter shows up, but it cannot submit the report. Looking at the submit.log file, I get this error:

[11/16/09 09:52:33] Crash report submission failed: A connection with the server could not be established

Internet connectivity is apparently not an issue, otherwise I could not have downloaded the RC build ...
If you are behind a firewall it could be.

Ted is there an easy way for a user to submit a crash report via http ?
Not particularly, but if this is on Windows the .dmp file is readable in a debugger (with the help of the symbol server). If you look in the pending/ directory next to the log file you'll find the .dmp. You can attach it here or email it to a developer if you'd like.

Comment 10

9 years ago
Created attachment 412790 [details]
Crash dump with wrong version of Enigmail

Alright, attaching my dump file: Thunderbird 3.0 RC 1 build 1 on Windows XP (SP3) with an old version of Enigmail that does not have the API changes.
I got the following stack from Patrick's minidump. It looks very similar to the stack from comment 1:
thunderbird!nsRefPtr<nsOfflineCacheUpdate>::assign_assuming_AddRef(class nsOfflineCacheUpdate * newPtr = 0x00a20b37)+0x8 [e:\buildbot\win32_build\build\objdir-tb\mozilla\dist\include\xpcom\nsautoptr.h @ 943]
thunderbird!nsRefPtr<nsXPCFastLoadIO>::assign_with_AddRef(class nsXPCFastLoadIO * rawPtr = 0x00a20b37)+0x1a [e:\buildbot\win32_build\build\objdir-tb\mozilla\dist\include\xpcom\nsautoptr.h @ 928]
thunderbird!nsMsgComposeAndSend::InitCompositionFields(class nsMsgCompFields * fields = 0x033e3ed0, class nsACString_internal * aOriginalMsgURI = 0x0520359c, int aType = 0)+0x33 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgsend.cpp @ 2814]
thunderbird!nsMsgComposeAndSend::Init(class nsIMsgIdentity * aUserIdentity = 0x02f30ac0, char * aAccountKey = 0x045becc0 "", class nsMsgCompFields * fields = 0x033e3ed0, class nsIFile * sendFile = 0x00000000, int digest_p = 0, int dont_deliver_p = 0, int mode = 1, class nsIMsgDBHdr * msgToReplace = 0x00000001, char * attachment1 [details] [diff] [review]_type = 0x00c69d5c "text/html", char * attachment1 [details] [diff] [review]_body = 0x00000000 "", unsigned int attachment1 [details] [diff] [review]_body_length = 0, struct nsMsgAttachmentData * attachments = 0x00000000, struct nsMsgAttachedFile * preloaded_attachments = 0x00000000, char * password = 0x04919478 "", class nsACString_internal * aOriginalMsgURI = 0x0520359c, int aType = 0)+0x220 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgsend.cpp @ 3416]
thunderbird!nsMsgComposeAndSend::CreateAndSendMessage(class nsIEditor * aEditor = 0x0509e400, class nsIMsgIdentity * aUserIdentity = 0x02f30ac0, char * aAccountKey = 0x045becc0 "", class nsIMsgCompFields * fields = 0x033e3ed0, int digest_p = 0, int dont_deliver_p = 0, int mode = 1, class nsIMsgDBHdr * msgToReplace = 0x00000000, char * attachment1 [details] [diff] [review]_type = 0x00c69d5c "text/html", char * attachment1 [details] [diff] [review]_body = 0x002fa450 "", unsigned int attachment1 [details] [diff] [review]_body_length = 0, struct nsMsgAttachmentData * attachments = 0x00000000, struct nsMsgAttachedFile * preloaded_attachments = 0x00000000, void * relatedPart = 0x00000000, class nsIDOMWindowInternal * parentWindow = 0x019825e0, class nsIMsgProgress * progress = 0x05279fc0, class nsIMsgSendListener * aListener = 0x057edc84, char * password = 0x04919478 "", class nsACString_internal * aOriginalMsgURI = 0x0520359c, int aType = 0)+0x94 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgsend.cpp @ 4290]
thunderbird!nsMsgCompose::_SendMsg(int deliverMode = 1, class nsIMsgIdentity * identity = 0x02f30ac0, char * accountKey = 0x045becc0 "", int entityConversionDone = 0)+0x305 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgcompose.cpp @ 1053]
thunderbird!nsMsgCompose::SendMsg(int deliverMode = 1, class nsIMsgIdentity * identity = 0x02f30ac0, char * accountKey = 0x045becc0 "", class nsIMsgWindow * aMsgWindow = 0x052a7060, class nsIMsgProgress * progress = 0x05279fc0)+0x6a8 [e:\buildbot\win32_build\build\mailnews\compose\src\nsmsgcompose.cpp @ 1248]
xpcom_core!NS_InvokeByIndex_P(class nsISupports * that = 0x05203580, unsigned int methodIndex = 0xd, unsigned int paramCount = 5, struct nsXPTCVariant * params = 0x0012dfa4)+0x27 [e:\buildbot\win32_build\build\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp @ 102]
thunderbird!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x04fca196, XPCWrappedNative::CallMode mode = 37905216 (No matching enumerant))+0x826 [e:\buildbot\win32_build\build\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2456]

(These stacks are truncated due to bug 524256 not having landed on the 1.9.1 branch.)

I don't know what's going on at the top of the stack there, but I think the types are bogus and those should both be nsRefPtr<nsMsgCompFields>, since the crash goes through here:
http://mxr.mozilla.org/comm-1.9.1/source/mailnews/compose/src/nsMsgSend.cpp#2813
and that's clearly assigning to a nsRefPtr<nsMsgCompFields>. I guess somehow the compiler is producing confusing debug info with templates. :-/

Anwyay, the real crash appears to be inside nsRefPtr, right here:
http://mxr.mozilla.org/mozilla1.9.1/source/xpcom/base/nsAutoPtr.h#944

You have a non-NULL value in that nsRefPtr, but it points at invalid memory. I have no idea what causes that.
(Note that the confusing template types can't be a Breakpad bug, since I got that stack with WinDBG, and the types are still confused.)
(Reporter)

Updated

9 years ago
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 527422
(Assignee)

Updated

8 years ago
Crash Signature: [@ nsRefPtr<nsSpeculativeScriptThread>::assign_assuming_AddRef(nsSpeculativeScriptThread*)]
You need to log in before you can comment on or make changes to this bug.