547647 - crash [@ nsTObserverArray_base::AdjustIterators(unsigned int, int)] - [@ nsMsgDatabase::RemoveListener]

Status: RESOLVED WORKSFORME

(MailNews Core :: Backend, defect)

Description

[Michael A. Pasek]

crash [@ nsTObserverArray_base::AdjustIterators(unsigned int, int) ]

#7 crash for Macs, didn't make the top 100 overall 
  (total 246, 229 Mac, 17 Win, 0 Linux, 0 Solaris, Jan25-Feb21)

3 user comments: 
  1) Crash occurred while reading mail from sub-folder
  2) Lamentation that recovered data (from failed HD) was inaccessible via TB3
  3) hsajhs

Uptime varies from seconds to days.

3.0b3 - 1 occurrence, Mac (Eudora 8.0b7, bp-67b4eb6a-0b49-4468-9c61-9fa112100204)
3.0 - 15 occurrences, 4 Win, 11 Mac
3.0.1 - 218 occurrences, 13 Win, 205 Mac
3.0.2pre - 2 occurrences, Mac
3.1b1pre - 10 occurrences, Mac

Extensions installed varied from none to many.

Windows crashes are varied; could be caused by extensions, etc., so left OS as "Mac" until a determination can be made as to whether Windows crashes were due to base TB functionality.

Mac crashes seemed to show two basic patterns with two common "AppNotes" contents:
  1) Obj-C Exception data:NSInternalInconsistencyException: 
       Error (1000) creating CGSWindow
  2) Obj-C Exception data: NSImageCacheException: Cannot lock focus on image 
       <NSImage 0x20593370 Size={0, 0} Reps=()>, because it is size zero.

bp-ddc83ec6-744d-499e-8f48-673b62100218  v3.0.1  Build20100111130305  (AppNote #1)
0	libxpcom_core.dylib	nsTObserverArray_base::AdjustIterators	 nsTObserverArray.cpp:50
1	thunderbird-bin	nsMsgDatabase::RemoveListener	 nsTObserverArray.h:234
2	thunderbird-bin	nsMsgDBFolder::SetMsgDatabase	mailnews/base/util/nsMsgDBFolder.cpp:959
3	thunderbird-bin	nsAutoSyncState::ProcessExistingHeaders	mailnews/imap/src/nsAutoSyncState.cpp:412
4	thunderbird-bin	nsAutoSyncManager::TimerCallback	mailnews/imap/src/nsAutoSyncManager.cpp:315
5	libxpcom_core.dylib	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:420
6	libxpcom_core.dylib	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:512
7	libxpcom_core.dylib	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:521
8	libxpcom_core.dylib	NS_ProcessNextEvent_P	 nsThreadUtils.cpp:247
9	thunderbird-bin	nsXULWindow::ShowModal	Substring.h:415
10	thunderbird-bin	nsWindowWatcher::OpenWindowJSInternal	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:992
11	thunderbird-bin	nsWindowWatcher::OpenWindowJS	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:487
12	thunderbird-bin	nsGlobalWindow::OpenInternal	dom/src/base/nsGlobalWindow.cpp:7373
13	thunderbird-bin	nsGlobalWindow::OpenDialog	dom/src/base/nsGlobalWindow.cpp:5166
14	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
15	thunderbird-bin	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2456
16	thunderbird-bin	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1590
17	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1386
18	libmozjs.dylib	js_Interpret	js/src/jsinterp.cpp:5179
19	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1394
20	libmozjs.dylib	js_InternalInvoke	js/src/jsinterp.cpp:1447

bp-f29193f9-6367-4b0b-8f3d-29db42100211  v3.1b1pre  Build20100129083508  (AppNote #1)
0	libxpcom_core.dylib	nsTObserverArray_base::AdjustIterators	 nsTObserverArray.cpp:49
1	thunderbird-bin	nsMsgDatabase::RemoveListener	 nsTObserverArray.h:234
2	thunderbird-bin	nsMsgDBView::Close	mailnews/base/src/nsMsgDBView.cpp:2145
3	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
4	thunderbird-bin	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2721
5	thunderbird-bin	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1740
6	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1360
7	libmozjs.dylib	js_Interpret	js/src/jsops.cpp:2240
8	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1368
9	libmozjs.dylib	js_fun_call	js/src/jsfun.cpp:1955
10	libmozjs.dylib	js_Interpret	js/src/jsops.cpp:2208
11	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1368
12	libmozjs.dylib	js_InternalInvoke	js/src/jsinterp.cpp:1423
13	libmozjs.dylib	JS_CallFunctionValue	js/src/jsapi.cpp:5112
14	thunderbird-bin	nsJSContext::CallEventHandler	dom/base/nsJSEnvironment.cpp:2134
15	thunderbird-bin	nsJSEventListener::HandleEvent	dom/src/events/nsJSEventListener.cpp:266
16	thunderbird-bin	nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1041
17	thunderbird-bin	nsEventListenerManager::HandleEvent	content/events/src/nsEventListenerManager.cpp:1147
18	thunderbird-bin	nsEventTargetChainItem::HandleEvent	content/events/src/nsEventDispatcher.cpp:246
19	thunderbird-bin	nsEventTargetChainItem::HandleEventTargetChain	content/events/src/nsEventDispatcher.cpp:310
20	thunderbird-bin	nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:573

bp-127dd383-38db-4cae-8056-54d412100221  v3.0.1  Build20100111130305  (AppNote #2)
0	libxpcom_core.dylib	nsTObserverArray_base::AdjustIterators	 nsTObserverArray.cpp:49
1	thunderbird-bin	nsMsgDatabase::RemoveListener	 nsTObserverArray.h:234
2	thunderbird-bin	nsMsgDBView::Close	mailnews/base/src/nsMsgDBView.cpp:2136
3	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
4	thunderbird-bin	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2456
5	thunderbird-bin	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1590
6	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1386
7	libmozjs.dylib	js_Interpret	js/src/jsinterp.cpp:5179
8	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1394
9	libmozjs.dylib	js_fun_call	js/src/jsfun.cpp:1985
10	libmozjs.dylib	js_Interpret	js/src/jsinterp.cpp:5147
11	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1394
12	libmozjs.dylib	js_InternalInvoke	js/src/jsinterp.cpp:1447
13	libmozjs.dylib	JS_CallFunctionValue	js/src/jsapi.cpp:5187
14	thunderbird-bin	nsJSContext::CallEventHandler	dom/src/base/nsJSEnvironment.cpp:2107
15	thunderbird-bin	nsJSEventListener::HandleEvent	dom/src/events/nsJSEventListener.cpp:247
16	thunderbird-bin	nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1098
17	thunderbird-bin	nsEventListenerManager::HandleEvent	content/events/src/nsEventListenerManager.cpp:1206
18	thunderbird-bin	nsEventTargetChainItem::HandleEvent	content/events/src/nsEventDispatcher.cpp:236
19	thunderbird-bin	nsEventTargetChainItem::HandleEventTargetChain	content/events/src/nsEventDispatcher.cpp:300
20	thunderbird-bin	nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:514

Comment 1

[Wayne Mery (:wsmwk)]

#90 crash for 3.0.1
nsMsgDatabase::RemoveListener is second item on stack

one other example may be top of stack nsAutoTObserverArray<nsCOMPtr<nsIMsgSendListener>, 0>::RemoveElement<nsIMsgSendListener*>(nsIMsgSendListener* const&)
bp-91c3ecbd-6319-4048-b7ac-673f02100221 3.0.1 - just one crash in 4 weeks

Comment 2

[Wayne Mery (:wsmwk)]

the earliest crash I find is for 3.0b4, build 20090915181920 bp-0662d53a-ca0e-4cdc-9020-cfb712091120 - no others going back 5 more months
so I speculate this crasher might be a regression

there are a few for 3.0pre. and then of course 3.0

I've emailed 3 of the crash reporters. with any luck one will show up.

Comment 3

[Wayne Mery (:wsmwk)]

#3 for Mac, #105 overall for 3.0.4. only 10% of crashes are non-Mac

Comment 4

[Wayne Mery (:wsmwk)]

None of the crash comments are enlightening IMO. For some people the crashes happen always, and for some rarely - but in clusters.

NSImageCacheException mentioned in http://getsatisfaction.com/mozilla_messaging/topics/thunderbird_crashes_nsimagecacheexception_on_launch_on_osx#reply_4462781

80-90% of Mac crashes are OS X 10.5.8 9L31a  and 10.5.8 9L30. All Mac crashes I examined correlate to NSImageCacheException, for example bp-73ff6bbc-98b0-46e7-96a8-a9c8a2110112

App Notes	
Obj-C Exception data:
NSImageCacheException: Cannot lock focus on image <NSImage 0x1e066640 Size={0, 0} Reps=(
)>, because it is size zero.

Comment 5

[Wayne Mery (:wsmwk)]

windows:
bp-1dca3924-24f8-48ff-981c-655832110112
EXCEPTION_ACCESS_VIOLATION_READ
0x4
0	xpcom_core.dll	nsTObserverArray_base::AdjustIterators	objdir-tb/mozilla/xpcom/build/nsTObserverArray.cpp:49
1	thunderbird.exe	nsAutoTObserverArray<nsCOMPtr<nsIMsgComposeStateListener>,0>::RemoveElement<nsIMsgComposeStateListener*>	objdir-tb/mozilla/dist/include/nsTObserverArray.h:234
2	thunderbird.exe	nsMsgDatabase::RemoveListener	mailnews/db/msgdb/src/nsMsgDatabase.cpp:669
3	thunderbird.exe	nsMsgDBFolder::SetMsgDatabase	mailnews/base/util/nsMsgDBFolder.cpp:956 

Mac:
bp-73ff6bbc-98b0-46e7-96a8-a9c8a2110112 (brasseur)
bp-a27c782c-9430-4be3-89e6-87b272101229 (phudson)
bp-6d2b859e-f839-499d-8279-c028c2110107 (ranpel)
bp-63b0f37a-a841-4c91-a34c-7d5fb2101129 (ian)


Found rare crash of nsMsgDatabase::RemoveListener(nsIDBChangeListener*) but stack looks unrelated, eg bp-7d25b4a3-994b-405d-ae0b-bce362101228
EXC_BAD_INSTRUCTION / EXC_PPC_UNIPL_INST
0xc8d8dc
Frame	Module	Signature [Expand]	Source
0	thunderbird-bin	nsMsgDatabase::RemoveListener	nsTArray.h:861
1	thunderbird-bin	nsMsgDBFolder::StartFolderLoading	mailnews/base/util/nsMsgDBFolder.cpp:413
2	libxpcom_core.dylib	libxpcom_core.dylib@0x6e120	
3	thunderbird-bin	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2722
4	thunderbird-bin	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1740

Comment 6

[Wayne Mery (:wsmwk)]

almost doesn't exist in versions newer than 3.1.x

Comment 7

[Wayne Mery (:wsmwk)]

hiro, bienvenu,
any idea why this would be #3 crash for Mac, but rare for windows?

bp-04971f44-2c83-428e-80b4-2e8622120723 is a rare example from windows

Comment 8

[Hiroyuki Ikezoe (:hiro)]

I have no idea.

I have read the code around RemoveListener and AdjustIterators and so on. I could not find any suspicions related to the crash.

Comment 9

[Wayne Mery (:wsmwk)]

nsMsgDatabase::RemoveListener is rare for current versions. only a few crashes in the past several months.

bp-b33ceac6-e14b-4927-90ac-494a42130207 TB16

bp-ec7c094b-466e-43b3-8ff2-c38cc2130123 TB16
0	XUL	nsMsgDatabase::RemoveListener	nsCOMPtr.h:762
1	XUL	nsMsgDBFolder::SetMsgDatabase	mailnews/base/util/nsMsgDBFolder.cpp:935
2	XUL	nsImapMailFolder::OnStopRunningUrl	mailnews/imap/src/nsImapMailFolder.cpp:5308
3	XUL	nsMsgMailNewsUrl::SetUrlState	mailnews/base/util/nsMsgMailNewsUrl.cpp:104
4	XUL	nsImapMailFolder::SetUrlState	mailnews/imap/src/nsImapMailFolder.cpp:6817
5	XUL	SyncRunnable5<nsIImapMailFolderSink,nsIImapProtocol*,nsIMsgMailNewsUrl*,bool,boo	mailnews/imap/src/nsSyncRunnableHelpers.cpp:250 


And no nsTObserverArray_base::AdjustIterators(unsigned int, int) crashes for current versions have  nsMsgDatabase::RemoveListener   on stack.
I'm not bothering to file followup bug at this time for nsTObserverArray_base::AdjustIterators(unsigned int, int)

Comment 10

[Wayne Mery (:wsmwk)]

For Mac, in version 24 this is essentially gone - one crash in one month.

And only few windows crashes for 24, and none have nsMsgDatabase::RemoveListener on stack