557129 - crash [@ nsMsgXFVirtualFolderDBView::CopyDBView(nsMsgDBView*, nsIMessenger*, nsIMsgWindow*, nsIMsgDBViewCommandUpdater*)]

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsMsgXFVirtualFolderDBView::CopyDBView(nsMsgDBView*, nsIMessenger*, nsIMsgWindow*, nsIMsgDBViewCommandUpdater*)]

0x0 address (95% anyway)
3 stacks listed below, I think each is about 1/3 of crashes
not seen before 3.0.1, so regression - I didn't do a thorough check for what caused it and the crash doesn't show up on nightlies - perhaps bug 534382 or bug 530063?

bp-28f585b1-3a56-4b15-b52c-21f772100124
opened msg in tab, ther went to menu >open message ... crash
0  	thunderbird.exe  	nsMsgXFVirtualFolderDBView::CopyDBView  	 mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:126
1 	thunderbird.exe 	nsMsgXFVirtualFolderDBView::CloneDBView 	mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:101
2 	xpcom_core.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
3 	thunderbird.exe 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:2297

bp-40c594f2-1de3-43c4-ab4b-a833c2100131
0	thunderbird.exe	nsMsgXFVirtualFolderDBView::CopyDBView	 mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:126
1	thunderbird.exe	nsMsgXFVirtualFolderDBView::CloneDBView	mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:101
2	thunderbird.exe	nsMsgDBView::nsMsgViewHdrEnumerator::nsMsgViewHdrEnumerator	mailnews/base/src/nsMsgDBView.cpp:7309
3	thunderbird.exe	nsMsgDBView::GetViewEnumerator	mailnews/base/src/nsMsgDBView.cpp:7350
4	thunderbird.exe	nsMsgGroupView::RebuildView	mailnews/base/src/nsMsgGroupView.cpp:534
5	thunderbird.exe	nsMsgGroupView::OnHdrFlagsChanged	mailnews/base/src/nsMsgGroupView.cpp:680
6	thunderbird.exe	nsMsgSearchDBView::OnHdrFlagsChanged	mailnews/base/src/nsMsgSearchDBView.cpp:324
7	thunderbird.exe	nsMsgDatabase::NotifyHdrChangeAll	mailnews/db/msgdb/src/nsMsgDatabase.cpp:697 

bp-bb712584-07c8-4ca0-bde5-f75fd2100316 win (ammongov) - same stack as below

bp-447b40c6-f3a2-4daa-902c-c8e8b2100402 Mac
0	thunderbird-bin	nsMsgXFVirtualFolderDBView::CopyDBView	 mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:126
1	thunderbird-bin	nsMsgXFVirtualFolderDBView::CloneDBView	mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:101
2	thunderbird-bin	thunderbird-bin@0x9bd1b3	
3	thunderbird-bin	nsMsgDBView::GetViewEnumerator	mailnews/base/src/nsMsgDBView.cpp:7367
4	thunderbird-bin	nsMsgGroupView::RebuildView	mailnews/base/src/nsMsgGroupView.cpp:534
5	thunderbird-bin	nsMsgGroupView::OnHdrFlagsChanged	mailnews/base/src/nsMsgGroupView.cpp:680
6	thunderbird-bin	nsMsgSearchDBView::OnHdrFlagsChanged	mailnews/base/src/nsMsgSearchDBView.cpp:324
7	thunderbird-bin	nsMsgDatabase::NotifyHdrChangeAll	mailnews/db/msgdb/src/nsMsgDatabase.cpp:702
8	thunderbird-bin	nsMsgDatabase::ClearNewList	mailnews/db/msgdb/src/nsMsgDatabase.cpp:2580
9	thunderbird-bin	nsMsgDBFolder::ClearNewMessages	mailnews/base/util/nsMsgDBFolder.cpp:596
10	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
11	thunderbird-bin	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2456
12	thunderbird-bin	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1590
13	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1386
14	libmozjs.dylib	js_Interpret	js/src/jsinterp.cpp:5179
15	libmozjs.dylib	js_Invoke	js/src/jsinterp.cpp:1394
16	libmozjs.dylib	js_InternalInvoke	js/src/jsinterp.cpp:1447
17	libmozjs.dylib	JS_CallFunctionValue	js/src/jsapi.cpp:5188
18	thunderbird-bin	nsJSContext::CallEventHandler	dom/src/base/nsJSEnvironment.cpp:2107
19	thunderbird-bin	nsJSEventListener::HandleEvent	dom/src/events/nsJSEventListener.cpp:247
20	thunderbird-bin	nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1098

Comment 1

[Wayne Mery (:wsmwk)]

most frequent reporter of this is Mac user "chair" bp-091ed7e0-9ead-4f96-859d-9f25a2110307 
EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
0x0
0	thunderbird-bin	nsMsgXFVirtualFolderDBView::CopyDBView	mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:126
1	thunderbird-bin	nsMsgXFVirtualFolderDBView::CloneDBView	mailnews/base/src/nsMsgXFVirtualFolderDBView.cpp:101
2	thunderbird-bin	thunderbird-bin@0xa72b23	
3	thunderbird-bin	nsMsgDBView::GetViewEnumerator	mailnews/base/src/nsMsgDBView.cpp:7348
4	thunderbird-bin	nsMsgGroupView::RebuildView	mailnews/base/src/nsMsgGroupView.cpp:534
5	thunderbird-bin	nsMsgGroupView::OnHdrFlagsChanged	mailnews/base/src/nsMsgGroupView.cpp:680
6	thunderbird-bin	nsMsgSearchDBView::OnHdrFlagsChanged	mailnews/base/src/nsMsgSearchDBView.cpp:324
7	thunderbird-bin	nsMsgDatabase::NotifyHdrChangeAll	mailnews/db/msgdb/src/nsMsgDatabase.cpp:702
8	thunderbird-bin	nsMsgDatabase::SetKeyFlag	mailnews/db/msgdb/src/nsMsgDatabase.cpp:2355
9	thunderbird-bin	nsMsgDatabase::MarkOffline	mailnews/db/msgdb/src/nsMsgDatabase.cpp:2140
10	thunderbird-bin	nsMsgDBFolder::EndNewOfflineMessage	mailnews/base/util/nsMsgDBFolder.cpp:1654
11	thunderbird-bin	nsImapMailFolder::NormalEndMsgWriteStream	mailnews/imap/src/nsImapMailFolder.cpp:4575

Comment 2

[Wayne Mery (:wsmwk)]

bienvenu, any thoughts on this?  

seems to be a wide variety of users 
http://getsatisfaction.com/mozilla_messaging/topics/thunderbird_5_crashing_in_windows_7_like_the_old_t3
https://crash-stats.mozilla.com/report/list?product=Thunderbird&query_search=signature&query_type=contains&query=nsMsgXFVirtualFolderDBView&reason_type=contains&date=07%2F24%2F2011%2008%3A07%3A00&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsMsgXFVirtualFolderDBView%3A%3ACopyDBView%28nsMsgDBView%2A%2C%20nsIMessenger%2A%2C%20nsIMsgWindow%2A%2C%20nsIMsgDBViewCommandUpdater%2A%29

Comment 3

[David :Bienvenu]

Attachment: proposed fix

I'm not sure how to recreate the crash, but the fix seems straightforward enough.

Comment 4

[[e-mail]]

Comment on attachment 548320 [details] [diff] [review]
proposed fix

Is it OK to spew to the console that we don't have a search session? ;-)

Comment 5

[David :Bienvenu]

(In reply to comment #4)
> Comment on attachment 548320 [details] [diff] [review] [review]
> proposed fix
> 
> Is it OK to spew to the console that we don't have a search session? ;-)

I think so - it must be pretty rare because we'd crash otherwise.

Comment 6

[David :Bienvenu]

http://hg.mozilla.org/comm-central/rev/8ef37ea1e1ee

Comment 7

[David :Bienvenu]

I don't think this shows up in top crashes. If I'm wrong, let me know and I'll nominate it for TB 7.

Comment 8

[Wayne Mery (:wsmwk)]

another sig, is nsMsgXFVirtualFolderDBView::CopyDBView for Macs

with the Mac crashes added in it's ~#155, perhaps will be in top 140 for v6.  

based on the gsfn reporter it affects moves and deletes, apparently predictably.  And I'd guess this happens mostly to users of unified view. People affected probably find a workaround or avoid folder maintenance, so the crash rate may be artificially low. it's not a runaway crash, but if it's low risk I suggest taking it.  I defer to you :)