632504 - crash on shutdown [@ nsCharTraits<unsigned short>::length(unsigned short const*)] - [@ nsMsgShutdownService::Observe]

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

crash on shutdown [@ nsCharTraits<unsigned short>::length(unsigned short const*)] - [@ nsMsgShutdownService::Observe]

I crashed while testing bug Bug 524315 - shutdown via File>Exit shortly after sending a message. I'm not flat out calling this a regression from bug 343332 checkin. But I've not crashed on a shutdown in recent years iirc.

bp-18043454-c87e-4885-9209-5a7522110208
EXCEPTION_ACCESS_VIOLATION_READ
0x0
0	xul.dll	nsCharTraits<unsigned short>::length	objdir-tb/mozilla/dist/include/nsCharTraits.h:384
1	xul.dll	nsDependentString::nsDependentString	objdir-tb/mozilla/dist/include/nsTDependentString.h:90
2	xul.dll	nsMsgShutdownService::Observe	mailnews/base/src/nsMsgMailSession.cpp:732
3	xul.dll	nsObserverList::NotifyObservers	xpcom/ds/nsObserverList.cpp:130
4	xul.dll	nsObserverService::NotifyObservers	xpcom/ds/nsObserverService.cpp:182
5	xul.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
6	xul.dll	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2327
7	xul.dll	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1593
8	mozjs.dll	js::Interpret	js/src/jsinterp.cpp:4758
9	mozcrt19.dll	arena_run_split	objdir-tb/mozilla/memory/jemalloc/crtsrc/jemalloc.c:3102
10	mozjs.dll	js::ExternalInvoke	js/src/jsinterp.cpp:841
11	xul.dll	nsJSContext::CallEventHandler	dom/base/nsJSEnvironment.cpp:2008
12	xul.dll	nsJSEventListener::HandleEvent	dom/src/events/nsJSEventListener.cpp:228
13	xul.dll	nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1127
14	xul.dll	nsEventListenerManager::HandleEventInternal	content/events/src/nsEventListenerManager.cpp:1224
15	xul.dll	nsEventListenerManager::HandleEvent	content/events/src/nsEventListenerManager.h:146
16	xul.dll	nsEventTargetChainItem::HandleEvent	content/events/src/nsEventDispatcher.cpp:212
17	xul.dll	nsEventTargetChainItem::HandleEventTargetChain	content/events/src/nsEventDispatcher.cpp:341
18	xul.dll	nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:628
19	xul.dll	nsEventDispatcher::DispatchDOMEvent	content/events/src/nsEventDispatcher.cpp:691
20	xul.dll	PresShell::HandleDOMEventWithTarget	layout/base/nsPresShell.cpp:7094
21	xul.dll	nsContentUtils::DispatchXULCommand	content/base/src/nsContentUtils.cpp:5482
22	xul.dll	nsXULMenuCommandEvent::Run	layout/xul/base/src/nsXULPopupManager.cpp:2281 


(bug 537063 exists for nsCharTraits<unsigned short>::length(unsigned short const*) and most or all stacks for the signature are not related to shutdown)

Comment 1

[Wayne Mery (:wsmwk)]

There are other stacks with nsMsgShutdownService::Observe in signature, but the source line number for nsMsgShutdownService::Observe is different.

nsMsgShutdownService::Observe(nsISupports*, char const*, unsigned short const*)
all Mac crashes
bp-fa58330d-a774-44b5-972b-3f9d52110207 v3.1.7
Frame	Module	Signature [Expand]	Source
0	thunderbird-bin	nsMsgShutdownService::Observe	h:384
1	libxpcom_core.dylib	nsObserverList::NotifyObservers	xpcom/ds/nsObserverList.cpp:130
2	libxpcom_core.dylib	nsObserverService::NotifyObservers	xpcom/ds/nsObserverService.cpp:182
3	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
4	thunderbird-bin	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2722
5	thunderbird-bin	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1740 

=nsMsgShutdownService::Observe=

bp-dbe07014-5a2e-48f2-b499-f201c2110204 v3.1.7 linux
0	thunderbird-bin	nsMsgShutdownService::Observe	nsCharTraits.h:384
1	libxpcom_core.so	nsObserverList::NotifyObservers	nsObserverList.cpp:130
2	libxpcom_core.so	nsObserverService::NotifyObservers	nsObserverService.cpp:182
3	libxpcom_core.so	NS_InvokeByIndex_P	xptcinvoke_x86_64_unix.cpp:208 

bp-d903d4ef-27b6-4d93-85c3-d095b2110123 Mac trunk
0	XUL	nsMsgShutdownService::Observe	
1	XUL	nsObserverList::NotifyObservers	nsObserverList.cpp:130
2	XUL	nsObserverService::NotifyObservers	nsObserverService.cpp:182
3	XUL	NS_InvokeByIndex_P	xptcinvoke_unixish_x86.cpp:179

Comment 2

[Mark Banner (:standard8)]

Attachment: The fix

This probably is just related to people using send-in-background, afaik nothing else uses the shutdown service.

We crash if quit-application-requested (or maybe one of the other notifications) is sent around with a null data. This is quite reproducible, I guess something probably changed between when I first hooked it up and now, or maybe I just missed it somehow.

The cause of the crash is passing the null pointer to the dependent string - never a good idea.

Comment 3

[Mark Banner (:standard8)]

Checked in: http://hg.mozilla.org/comm-central/rev/e592a1db7652

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

I have hit this crash already multiple times today. It's very annoying because nothing shows that mails cannot be sent. All of of those were sitting in my outbox the whole day. :(

Can we get this backported and fixed for Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.18pre) Gecko/20110511 Lanikai/3.1.11pre ?

Comment 5

[Mark Banner (:standard8)]

Henrik: Do you have mailnews.sendInBackground set to true? That is incomplete code, which does have known dataloss issues and is incomplete...

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Yes, I have set this pref. Has the code been completed in 3.3a3? I don't want to use an alpha version, so I'm not hesitated to upgrade. Which are the limitations on 3.1?

Comment 7

[Mark Banner (:standard8)]

(In reply to comment #6)
> Yes, I have set this pref. Has the code been completed in 3.3a3? I don't
> want to use an alpha version, so I'm not hesitated to upgrade. Which are the
> limitations on 3.1?

https://bugzilla.mozilla.org/showdependencytree.cgi?id=511079&hide_resolved=1

(generally its fine, as long as you remember that it doesn't prompt you on shutdown, and if it fails saving to the sent folder then you may loose the sent copy completely).

I guess we can take the patch for 3.1.x anyway, as it is a simple null-crash fix.

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+2]]

(In reply to comment #7)
> (generally its fine, as long as you remember that it doesn't prompt you on
> shutdown, and if it fails saving to the sent folder then you may loose the
> sent copy completely).

I don't use the sent folder. All emails I send to myself via BCC for better filtering. So it's fine for me.

> I guess we can take the patch for 3.1.x anyway, as it is a simple null-crash
> fix.

Thanks!

Comment 9

[Mark Banner (:standard8)]

Checked into 1.9.2 branch: http://hg.mozilla.org/releases/comm-1.9.2/rev/6b62e9c94d9e