Last Comment Bug 629487 - crash [@ nsMsgDBView::RemoveRows]
: crash [@ nsMsgDBView::RemoveRows]
Status: RESOLVED FIXED
[STR comment 2][ccbr][rare]
: crash, reproducible
Product: MailNews Core
Classification: Components
Component: Backend (show other bugs)
: Trunk
: All All
: -- critical with 1 vote (vote)
: Thunderbird 12.0
Assigned To: David :Bienvenu
:
Mentors:
: 568883 707618 714610 (view as bug list)
Depends on:
Blocks: 568883
  Show dependency treegraph
 
Reported: 2011-01-27 12:45 PST by Ludovic Hirlimann [:Usul]
Modified: 2012-04-12 05:59 PDT (History)
6 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
fixed


Attachments
bullet proof removing of rows (1.00 KB, patch)
2012-01-03 10:46 PST, David :Bienvenu
standard8: review+
standard8: approval‑comm‑aurora+
Details | Diff | Review

Description Ludovic Hirlimann [:Usul] 2011-01-27 12:45:46 PST
This bug was filed from the Socorro interface and is 
report bp-3d0c18b7-7dac-4c37-b06f-c278e2110127 .
============================================================= 
0 		@0xffff0f38 	
1 	XUL 	nsMsgDBView::RemoveRows 	
2 	XUL 	nsMsgDBView::CollapseByIndex 	nsMsgDBView.cpp:4800
3 	XUL 	nsMsgThreadedDBView::OnNewHeader 	nsMsgThreadedDBView.cpp:668
4 	XUL 	nsMsgQuickSearchDBView::AddHdr 	nsMsgQuickSearchDBView.cpp:174
5 	XUL 	nsMsgThreadedDBView::MoveThreadAt 	nsMsgThreadedDBView.cpp:814
6 	XUL 	nsMsgThreadedDBView::OnNewHeader 	nsMsgThreadedDBView.cpp:690
7 	XUL 	nsMsgQuickSearchDBView::AddHdr 	nsMsgQuickSearchDBView.cpp:174
8 	XUL 	nsMsgQuickSearchDBView::OnSearchHit 	nsMsgQuickSearchDBView.cpp:328
9 	XUL 	nsMsgSearchSession::AddSearchHit 	nsMsgSearchSession.cpp:601
10 	XUL 	nsMsgSearchOfflineMail::AddResultElement 	nsMsgLocalSearch.cpp:818
11 	XUL 	nsMsgSearchOfflineMail::Search 	nsMsgLocalSearch.cpp:770
12 	XUL 	nsMsgSearchSession::TimeSliceSerial 	nsMsgSearchSession.cpp:691
13 	XUL 	nsMsgSearchSession::TimerCallback 	nsMsgSearchSession.cpp:655
14 	XUL 	nsTimerImpl::Fire 	nsTimerImpl.cpp:425
15 	XUL 	nsTimerEvent::Run 	nsTimerImpl.cpp:517
16 	XUL 	nsThread::ProcessNextEvent 	nsThread.cpp:633
17 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:200
18 	XUL 	nsBaseAppShell::NativeEventCallback 	nsBaseAppShell.cpp:135
19 	XUL 	nsAppShell::ProcessGeckoEvents 	nsAppShell.mm:405
20 	CoreFoundation 	CFRunLoopRunSpecific 	
21 	CoreFoundation 	CFRunLoopRunInMode 	
22 	HIToolbox 	RunCurrentEventLoopInMode 	
23 	HIToolbox 	ReceiveNextEventCommon 	
24 	HIToolbox 	BlockUntilNextEventMatchingListInMode 	
25 	AppKit 	_DPSNextEvent 	
26 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
27 	AppKit 	-[NSApplication run] 	
28 	XUL 	nsAppShell::Run 	nsAppShell.mm:752
29 	XUL 	nsAppStartup::Run 	nsAppStartup.cpp:218
30 	XUL 	XRE_main 	nsAppRunner.cpp:3775
31 	thunderbird-bin 	main 	nsMailApp.cpp:101
32 	thunderbird-bin 	thunderbird-bin@0xc75

I was switching to the unread filtered view.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:2.0b11pre) Gecko/20110126 Thunderbird/3.3a3pre
Comment 1 Wayne Mery (:wsmwk, NI for questions) 2011-01-27 13:11:42 PST
likely dup of bug 572883.

and there is another signature of memmove | nsTArray_base::ShiftData(unsigned int, unsigned int, unsigned int, unsigned int) | nsMsgDBView::RemoveRows(unsigned int, int)
Comment 2 Ludovic Hirlimann [:Usul] 2011-09-06 03:50:48 PDT
I was able to reproduce this crash twice in row with the following strs :

1) have a folder with the following settings :
 i)  View -> sort by date, ascending , Threaded
 ii) View -> Messages -> all
 iii)View -> Threads -> Unread
2) hit bug 558303 and select that as he last visible thread in your view
3) click the unread button from the quick filter toolbar
4) crash
Comment 3 Wayne Mery (:wsmwk, NI for questions) 2012-01-01 13:40:36 PST
ludo, does this still reproduce for you?
Comment 4 Ludovic Hirlimann [:Usul] 2012-01-02 06:19:49 PST
*** Bug 707618 has been marked as a duplicate of this bug. ***
Comment 5 Ludovic Hirlimann [:Usul] 2012-01-02 06:21:04 PST
*** Bug 714610 has been marked as a duplicate of this bug. ***
Comment 6 Robert Kaiser (not working on stability any more) 2012-01-02 07:53:15 PST
Adding signatures from recent bp-a2fcade0-d26b-4b39-a211-6c1b72111205 and bp-61e2adb7-4ca7-4e66-91be-14be82120102 which the dupes were filed for.
Comment 7 Wayne Mery (:wsmwk, NI for questions) 2012-01-02 08:52:34 PST
> Duplicate of this bug: 707618
steps:
Not reproducible - what I did was the following :
1) filter my bugmail folder for 'crash'
2) choose unread emails only.

> Duplicate of this bug: 714610
I was able to crash TB twice in a row using these STRs.
1) Open bugmail folder
2) Settings are :
   i) View -> Sort by -> Date, Ascending, Threaded
   ii) View -> Message -> All
   iii)View -> Threads -> Unread
3) Enter a term in the filter bar
4) Select unread
5) Select all
6) press M
7) switch to firefox
8) come back to TB
9) press the x to clear the keyword by which you filter
Comment 8 Wayne Mery (:wsmwk, NI for questions) 2012-01-02 08:54:02 PST
is bp-328ad05e-760f-47da-8fee-cf2a02120102 the same crasher?  Seems to be version 8 only, so perhaps not, but too early in morning for me to compare the stacks
memmove | nsTArray_base<nsTArrayDefaultAllocator>::ShiftData(unsigned int, unsigned int, unsigned int, unsigned int) | nsMsgDBView::RemoveRows(unsigned int, int)
Comment 9 Ludovic Hirlimann [:Usul] 2012-01-02 09:37:10 PST
David I have a copy of the mbox and .msf for you to play with ? do you want them ?
Comment 10 David :Bienvenu 2012-01-03 10:46:49 PST
Created attachment 585459 [details] [diff] [review]
bullet proof removing of rows

this should fix the crash, but there's something unhealthy going on with those STR's that indicates an underlying issue that I haven't had time to diagnose. I can try to generate a try server build with this patch for you, Ludo.
Comment 11 David :Bienvenu 2012-01-03 10:57:36 PST
try server builds, if successful, here - http://ftp.mozilla.org/pub/mozilla.org/thunderbird/try-builds/bienvenu@nventure.com-79dc3d931ae6
Comment 12 Ludovic Hirlimann [:Usul] 2012-01-04 00:21:40 PST
(In reply to David :Bienvenu from comment #11)
> try server builds, if successful, here -
> http://ftp.mozilla.org/pub/mozilla.org/thunderbird/try-builds/
> bienvenu@nventure.com-79dc3d931ae6

This fixed my crashes !!! Thanks David.
Comment 13 :aceman 2012-01-04 00:33:00 PST
Is this Mac OS X only?
Comment 14 David :Bienvenu 2012-01-04 07:46:34 PST
no, there's no reason for it to be platform dependent.
Comment 15 Wayne Mery (:wsmwk, NI for questions) 2012-01-05 04:34:48 PST
so, signature to check for after this lands in a release build

v8 memmove | nsTArray_base<nsTArrayDefaultAllocator>::ShiftData(unsigned int, unsigned int, unsigned int, unsigned int) | nsMsgDBView::RemoveRows(unsigned int, int)
v7 memmove | nsTArray_base<nsTArrayInfallibleAllocator>::ShiftData(unsigned int, unsigned int, unsigned int, unsigned int) | nsMsgDBView::RemoveRows(unsigned int, int)

in contrast to this bug, last bugs to be fixed in this area, almost 2 years ago) were topcrash
Bug 534858 - Crash on repeated collapse/expand of threads with subthreads killed by filter
Bug 524064 - crash [@memmove | nsTArray_base::ShiftData ...
Comment 16 Ludovic Hirlimann [:Usul] 2012-01-05 05:44:48 PST
Comment on attachment 585459 [details] [diff] [review]
bullet proof removing of rows

I would very love to have this on aurora so I could switch back to using Aurora
Comment 17 David :Bienvenu 2012-01-05 08:05:13 PST
http://hg.mozilla.org/comm-central/rev/b63861438954
Comment 18 Mark Banner (:standard8) 2012-01-09 01:05:10 PST
Checked in: http://hg.mozilla.org/releases/comm-aurora/rev/40db7b14d2b0
Comment 19 Wayne Mery (:wsmwk, NI for questions) 2012-04-12 05:59:07 PDT
*** Bug 568883 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.