Closed Bug 632504 Opened 10 years ago Closed 10 years ago

crash on shutdown [@ nsCharTraits<unsigned short>::length(unsigned short const*)] - [@ nsMsgShutdownService::Observe]

Categories

(MailNews Core :: Backend, defect)

x86
Windows Vista
defect
Not set
critical

Tracking

(thunderbird3.1 .11-fixed)

RESOLVED FIXED
Thunderbird 3.3a3
Tracking Status
thunderbird3.1 --- .11-fixed

People

(Reporter: wsmwk, Assigned: standard8)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

crash on shutdown [@ nsCharTraits<unsigned short>::length(unsigned short const*)] - [@ nsMsgShutdownService::Observe]

I crashed while testing bug Bug 524315 - shutdown via File>Exit shortly after sending a message. I'm not flat out calling this a regression from bug 343332 checkin. But I've not crashed on a shutdown in recent years iirc.

bp-18043454-c87e-4885-9209-5a7522110208
EXCEPTION_ACCESS_VIOLATION_READ
0x0
0	xul.dll	nsCharTraits<unsigned short>::length	objdir-tb/mozilla/dist/include/nsCharTraits.h:384
1	xul.dll	nsDependentString::nsDependentString	objdir-tb/mozilla/dist/include/nsTDependentString.h:90
2	xul.dll	nsMsgShutdownService::Observe	mailnews/base/src/nsMsgMailSession.cpp:732
3	xul.dll	nsObserverList::NotifyObservers	xpcom/ds/nsObserverList.cpp:130
4	xul.dll	nsObserverService::NotifyObservers	xpcom/ds/nsObserverService.cpp:182
5	xul.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
6	xul.dll	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2327
7	xul.dll	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1593
8	mozjs.dll	js::Interpret	js/src/jsinterp.cpp:4758
9	mozcrt19.dll	arena_run_split	objdir-tb/mozilla/memory/jemalloc/crtsrc/jemalloc.c:3102
10	mozjs.dll	js::ExternalInvoke	js/src/jsinterp.cpp:841
11	xul.dll	nsJSContext::CallEventHandler	dom/base/nsJSEnvironment.cpp:2008
12	xul.dll	nsJSEventListener::HandleEvent	dom/src/events/nsJSEventListener.cpp:228
13	xul.dll	nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1127
14	xul.dll	nsEventListenerManager::HandleEventInternal	content/events/src/nsEventListenerManager.cpp:1224
15	xul.dll	nsEventListenerManager::HandleEvent	content/events/src/nsEventListenerManager.h:146
16	xul.dll	nsEventTargetChainItem::HandleEvent	content/events/src/nsEventDispatcher.cpp:212
17	xul.dll	nsEventTargetChainItem::HandleEventTargetChain	content/events/src/nsEventDispatcher.cpp:341
18	xul.dll	nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:628
19	xul.dll	nsEventDispatcher::DispatchDOMEvent	content/events/src/nsEventDispatcher.cpp:691
20	xul.dll	PresShell::HandleDOMEventWithTarget	layout/base/nsPresShell.cpp:7094
21	xul.dll	nsContentUtils::DispatchXULCommand	content/base/src/nsContentUtils.cpp:5482
22	xul.dll	nsXULMenuCommandEvent::Run	layout/xul/base/src/nsXULPopupManager.cpp:2281 


(bug 537063 exists for nsCharTraits<unsigned short>::length(unsigned short const*) and most or all stacks for the signature are not related to shutdown)
There are other stacks with nsMsgShutdownService::Observe in signature, but the source line number for nsMsgShutdownService::Observe is different.

nsMsgShutdownService::Observe(nsISupports*, char const*, unsigned short const*)
all Mac crashes
bp-fa58330d-a774-44b5-972b-3f9d52110207 v3.1.7
Frame	Module	Signature [Expand]	Source
0	thunderbird-bin	nsMsgShutdownService::Observe	h:384
1	libxpcom_core.dylib	nsObserverList::NotifyObservers	xpcom/ds/nsObserverList.cpp:130
2	libxpcom_core.dylib	nsObserverService::NotifyObservers	xpcom/ds/nsObserverService.cpp:182
3	libxpcom_core.dylib	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
4	thunderbird-bin	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2722
5	thunderbird-bin	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1740 

=nsMsgShutdownService::Observe=

bp-dbe07014-5a2e-48f2-b499-f201c2110204 v3.1.7 linux
0	thunderbird-bin	nsMsgShutdownService::Observe	nsCharTraits.h:384
1	libxpcom_core.so	nsObserverList::NotifyObservers	nsObserverList.cpp:130
2	libxpcom_core.so	nsObserverService::NotifyObservers	nsObserverService.cpp:182
3	libxpcom_core.so	NS_InvokeByIndex_P	xptcinvoke_x86_64_unix.cpp:208 

bp-d903d4ef-27b6-4d93-85c3-d095b2110123 Mac trunk
0	XUL	nsMsgShutdownService::Observe	
1	XUL	nsObserverList::NotifyObservers	nsObserverList.cpp:130
2	XUL	nsObserverService::NotifyObservers	nsObserverService.cpp:182
3	XUL	NS_InvokeByIndex_P	xptcinvoke_unixish_x86.cpp:179
Attached patch The fixSplinter Review
This probably is just related to people using send-in-background, afaik nothing else uses the shutdown service.

We crash if quit-application-requested (or maybe one of the other notifications) is sent around with a null data. This is quite reproducible, I guess something probably changed between when I first hooked it up and now, or maybe I just missed it somehow.

The cause of the crash is passing the null pointer to the dependent string - never a good idea.
Assignee: nobody → bugzilla
Status: NEW → ASSIGNED
Attachment #510738 - Flags: review?(bienvenu)
Attachment #510738 - Flags: review?(bienvenu) → review+
Checked in: http://hg.mozilla.org/comm-central/rev/e592a1db7652
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → Thunderbird 3.3a3
I have hit this crash already multiple times today. It's very annoying because nothing shows that mails cannot be sent. All of of those were sitting in my outbox the whole day. :(

Can we get this backported and fixed for Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.18pre) Gecko/20110511 Lanikai/3.1.11pre ?
Henrik: Do you have mailnews.sendInBackground set to true? That is incomplete code, which does have known dataloss issues and is incomplete...
Yes, I have set this pref. Has the code been completed in 3.3a3? I don't want to use an alpha version, so I'm not hesitated to upgrade. Which are the limitations on 3.1?
(In reply to comment #6)
> Yes, I have set this pref. Has the code been completed in 3.3a3? I don't
> want to use an alpha version, so I'm not hesitated to upgrade. Which are the
> limitations on 3.1?

https://bugzilla.mozilla.org/showdependencytree.cgi?id=511079&hide_resolved=1

(generally its fine, as long as you remember that it doesn't prompt you on shutdown, and if it fails saving to the sent folder then you may loose the sent copy completely).

I guess we can take the patch for 3.1.x anyway, as it is a simple null-crash fix.
Attachment #510738 - Flags: approval-thunderbird3.1.11+
(In reply to comment #7)
> (generally its fine, as long as you remember that it doesn't prompt you on
> shutdown, and if it fails saving to the sent folder then you may loose the
> sent copy completely).

I don't use the sent folder. All emails I send to myself via BCC for better filtering. So it's fine for me.

> I guess we can take the patch for 3.1.x anyway, as it is a simple null-crash
> fix.

Thanks!
Crash Signature: [@ nsCharTraits<unsigned short>::length(unsigned short const*)] [@ nsMsgShutdownService::Observe]
You need to log in before you can comment on or make changes to this bug.