593847 - crash [@ nsRegion::SimpleSubtract(nsRegion const&)] with attachments - browseui.dll XP-only, v3.1.x-only

Status: RESOLVED WORKSFORME

(MailNews Core :: Attachments, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsRegion::SimpleSubtract(nsRegion const&)]
#37 crash for thunderbird 3.1.2
all crashes are v3.1, and looks like all crashes are XP SP3, so marking as regression
(there are some 3.0.4 crashes going way back in time, but not same stack)

crash-stats says it correlates to browseui.dll
most of the comments point to working with attachments

bp-8d76b542-46a7-4cbd-9ae0-be9552100830 (benjamin) v3.1.2
0	thunderbird.exe	nsRegion::SimpleSubtract	 gfx/src/nsRegion.cpp:1323
1	browseui.dll	browseui.dll@0x7a9e	
2	browseui.dll	browseui.dll@0x7940	
3	browseui.dll	browseui.dll@0x775c	
4	browseui.dll	browseui.dll@0x31b9	
5	ole32.dll	[thunk]:`vcall'{36,{flat}}' }'	
6	ole32.dll	ActivationPropertiesIn::DelegateCreateInstance	
7	ole32.dll	CApartmentActivator::CreateInstance	
8	ole32.dll	CProcessActivator::CCICallback	
9	ole32.dll	CProcessActivator::AttemptActivation	
10	ole32.dll	CProcessActivator::ActivateByContext	


bp-6f66af33-cb7a-429d-ad18-a78d82100701 (antonin)
0	thunderbird.exe	nsRegion::SimpleSubtract	 gfx/src/nsRegion.cpp:1323
1	browseui.dll	GetUEMSettings	
2	browseui.dll	CUserAssist::Initialize	
3	browseui.dll	CUserAssist_CI2	
4	browseui.dll	CUserAssist_CreateInstance	
5	browseui.dll	CClassFactory::CreateInstance	
6	ole32.dll	[thunk]:`vcall'{36,{flat}}' }'	
7	ole32.dll	ActivationPropertiesIn::DelegateCreateInstance	
8	ole32.dll	CApartmentActivator::CreateInstance	
9	ole32.dll	CProcessActivator::CCICallback	
10	ole32.dll	CProcessActivator::AttemptActivation	
11	ole32.dll	CProcessActivator::ActivateByContext	
12	ole32.dll	CProcessActivator::CreateInstance	
13	ole32.dll	ActivationPropertiesIn::DelegateCreateInstance	
14	ole32.dll	CClientContextActivator::CreateInstance	
15	ole32.dll	ActivationPropertiesIn::DelegateCreateInstance	
16	ole32.dll	ActivationPropertiesOut::Initialize	
17	ole32.dll	CComActivator::DoCreateInstance	
18	ole32.dll	CoCreateInstanceEx	
19	ole32.dll	CoCreateInstance	
20	shell32.dll	ATL::CComObject<CStartMenuPin>::CComObject<CStartMenuPin>	

bp-8ab9a18f-ba7e-484c-a831-aafbb2100628 (mateus)

Comment 1

[Wayne Mery (:wsmwk)]

timeless, crashes are all 
EXCEPTION_ACCESS_VIOLATION_READ
0x1a

still topcrash

all crashes are NT 5.1 and 5.2. No vista, no win7

bp-e8e19544-1b3d-4740-b08a-ede862101201 v3.1.6  (lstark)
Crashes every time 

bp-da2b930a-201d-4be0-a16c-76d122101201 (paul)

Comment 2

[timeless]

the stacks are bogus.

> 0    thunderbird.exe    nsRegion::SimpleSubtract     gfx/src/nsRegion.cpp:1323
> 1    browseui.dll    GetUEMSettings    

there's on way browseui.dll would call nsRegion.cpp. I wonder what's going on...

Someone should grab a .dmp.

Since lstark/paul can trigger this,

https://developer.mozilla.org/En/How_to_get_a_stacktrace_with_WinDbg

Comment 3

[Wayne Mery (:wsmwk)]

For paul's case, he speculates it might be caused Launchy 4.4.0.  Awaiting more results from Paul.  lstark's crash doesn't list Launchy

Comment 4

[Wayne Mery (:wsmwk)]

lstark, reporter of http://getsatisfaction.com/mozilla_messaging/topics/why_does_thunderbird_crash_when_i_click_a_link_or_attached_document "I have cleaned my in box, discarded some old email, indexed all of the mail, and keep Thunderbird and Windows XP pro updated. I have scanned my computer for viruses and malware. I've exported/imported my email into other email programs, and run those programs without any issues."

again all reports are XP, 3.1.x only.

perhaps ludo can recruit someone to get the .dmp

Comment 6

[lstark]

Problem solved...

I have cleaned up disk space, optimized and defragged my disk (multiple times, as one sweep wasn't enough to complete the defrag). The problem appears to be solved.

A key issue was that the disk was somewhat fragmented already, when I installed a one-month free trial of Adobe Premier. Apparently, Premier likes to create enormous cache files of media that it finds while scouring your computer -- 20 Gigabytes in my case -- all of which were split into thousands of fragments. Even when I uninstalled Premier, the cache files and all the fragmentation remained, leading to further fragmenting of everything else on the disk, including Thunderbird's working files.

Thanks for your help

Comment 7

[rsx11m]

Wayne, why would disk fragmentation cause or contribute to a crash?
I'd assume that's completely transparent to the application, except for
reduced performance when accessing data on the disk...

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to comment #7)
> Wayne, why would disk fragmentation cause or contribute to a crash?
> I'd assume that's completely transparent to the application, except for
> reduced performance when accessing data on the disk...

I've seen people report crashes for situation that most people report as "unresponsive script".  So I believe there are cases where long response times result in crashes.

I didn't find good descriptions of for browseui.dll except http://msdn.microsoft.com/en-us/library/aa741312%28v=vs.85%29.aspx and it doesn't make sense to me that thunderbird would be accessing IE settings

Comment 9

[Wayne Mery (:wsmwk)]

oh, and note timeless' comment 2.

In short, 
a) it would have been interesting of lstark or someone had done windbg
b) IMO lstark merely worked around the issue.

I'm going to marry this to bug 482811.

Comment 10

[lstark]

Well, guess defragmenting wasn't the answer. It crashed three times today while clicking links within emails. The situation apparently has improved after defragging, but not entirely.

Comment 11

[rsx11m]

If it's a timing issue as suggested by Wayne, the slight changes introduced by defragmenting the drive may just have shifted things enough so that crashes occur less frequently (also implying that the problem is hard to reproduce).

Comment 12

[Wayne Mery (:wsmwk)]

still exists in v3.1.14 but #168.
and no crashes for v5, 6 or 7.

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #12)
> and no crashes for v5, 6 or 7.

still true. so let's call this WFM