554636 - mail/news viewing crash [@ nsMsgDBView::ToggleExpansion(unsigned int, unsigned int*)]

Status: RESOLVED WORKSFORME

(MailNews Core :: Backend, defect)

Description

[Robert Kaiser]

We had a few reports of this in the last two weeks, on Mac and Linux:
http://crash-stats.mozilla.com/report/list?product=SeaMonkey&product=Thunderbird&query_search=signature&query_type=startswith&query=nsMsgDBView%3A%3AToggleExpansion&date=&range_value=2&range_unit=weeks&process_type=all&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&signature=nsMsgDBView%3A%3AToggleExpansion(unsigned%20int%2C%20unsigned%20int*)

Two of those reports have comments, one from Thunderbird, one from SeaMonkey:
bp-3dec8bb1-b816-4d06-a55e-9dbe62100323
bp-2c8ba7e9-d499-4e1a-9917-b61892100315

The following line is reported as being where the crash happens:
http://hg.mozilla.org/releases/comm-1.9.1/annotate/c5c64590370a/mailnews/base/src/nsMsgDBView.cpp#l4608

Comment 1

[Wayne Mery (:wsmwk)]

I took a closer look ... very few crashes, *all* 1.9.1 branch. The most interesting aspect is no ms-windows crashers. They are all linux and Mac.

Thanks Robert. FYI, "DBViews" are generally placed in component=backend

Your query comes up blank. not your fault. socorro queries are lame if it came via socorro menus/UI and you selected more than one product, then gave the query to someone else or you attempt to view the bugs. The solution is to choose only one product.

seamonkey only (1 crash - SM 2.0.3)
http://crash-stats.mozilla.com/report/list?product=SeaMonkey&query_search=signature&query_type=exact&query=nsMsgDBView%3A%3AToggleExpansion%28unsigned%20int%2C%20unsigned%20int*%29&date=&range_value=4&range_unit=weeks&process_type=all&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&signature=nsMsgDBView%3A%3AToggleExpansion%28unsigned%20int%2C%20unsigned%20int*%29

thunderbird only (15 crashes)
http://crash-stats.mozilla.com/query/query?product=Thunderbird&version=ALL%3AALL&date=&range_value=4&range_unit=weeks&query_search=signature&query_type=exact&query=nsMsgDBView%3A%3AToggleExpansion%28unsigned+int%2C+unsigned+int*%29&build_id=&process_type=all&do_query=1

bp-bp-3dec8bb1-b816-4d06-a55e-9dbe62100323 SM, no extensions
0	seamonkey-bin	nsMsgDBView::ToggleExpansion	 mailnews/base/src/nsMsgDBView.cpp:4608
1	seamonkey-bin	nsMsgDBView::ToggleOpenState	mailnews/base/src/nsMsgDBView.cpp:1943
2	seamonkey-bin	nsTreeBodyFrame::CloseCallback	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:4463
3	libxpcom_core.dylib	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:420
4	libxpcom_core.dylib	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:512 

bp-18cfea5e-6dfb-4378-b486-c747b2100323 TB 3.0.4, Mac
bp-2c8ba7e9-d499-4e1a-9917-b61892100315 v3.0.1 with comment ... Using From Filter multiple times, with 4 drafts open, then it crashed.

two crashes have email addresses if we need to contact a reporter:
bp-97dac59e-bc8b-4c39-b930-6ba122100305 TB 3.0.2
bp-d482503d-49b9-4992-87cd-3f54f2100316 TB 3.0.3 (TMZ! -- ccing him)

Comment 2

[Wayne Mery (:wsmwk)]

(In reply to comment #1)
> I took a closer look ... very few crashes, *all* 1.9.1 branch. The most
> interesting aspect is no ms-windows crashers. They are all linux and Mac.

... and I found no windows crashes using the string nsMsgDBView::ToggleExpansion instead of nsMsgDBView::ToggleExpansion(unsigned int, unsigned int*)

> Your query [in comment 0] comes up blank. not your fault. 

my bad, bugzilla failed to linkify the "*)" on the end.

Comment 3

[Phillip M. Jones, C.E.T.]

In the case of my SeaMonkey 2.0.2 Crash I was simply in the middle of reading news post on the News Server *Eternal-September* in the incident  above  quoted in this bug report.

I have had crashes which appeared to have the same (though may not have the same root) cause, (but reported). These were in various news groups and in Mail as well. In some cases I was just reading in some cases, in others I was in the middle of posting when the crashes occured. On my end I accidently cleared a windo of my Crashes. But I have been using Since 2.0.0 rc1

Four information I am using: 
OSX.4.11
PowerPC Powerbook17" Computer with 1.67gb Processor and 2 Gb Memory. 
Originally came 80 GB hard drive but due to crash of it, new has a 120gb Hard drive.

Comment 4

[Wayne Mery (:wsmwk)]

fallout from nsTimerImpl::Fire ?

crash comments:
* Was using drag n drop to move 3 messages from one folder (spam) to a subfolder of inbox
* I use IMAP and was in the process of moving a message to a folder. I'd just replied to this message, and my replies are added to the thread. I noticed while moving the original message that another message came in. So I released the mouse, colsed the triangle threader arrow, and dragged the messages to the folder. It crashed.
* Deleted a couple of mails and switched folder 


Mac-only. 
well, except for one linux crash bp-23e21ab9-f851-4c36-bcb7-8cef62101208

Mac (mitra) bp-5df17a28-e42b-4bcd-ad5f-24e452101109
EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
0x2bfc9e88
0	thunderbird-bin	nsMsgDBView::ToggleExpansion	mailnews/base/src/nsMsgDBView.cpp:4622
1	thunderbird-bin	nsMsgDBView::ToggleOpenState	mailnews/base/src/nsMsgDBView.cpp:1956
2	thunderbird-bin	nsTreeBodyFrame::CloseCallback	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:4479
3	libxpcom_core.dylib	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:427
4	libxpcom_core.dylib	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:519
5	libxpcom_core.dylib	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:527
6	libxpcom_core.dylib	NS_ProcessPendingEvents_P	nsThreadUtils.cpp:200

Comment 5

[Wayne Mery (:wsmwk)]

All crashes are version 3.x