Closed Bug 803460 Opened 10 years ago Closed 9 years ago

crash in nsNodeInfoManager::RemoveNodeInfo and numerous other crash signatures with McAfee Anti-spam extension

Categories

(Thunderbird :: General, defect)

17 Branch
x86
Windows 7
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED WORKSFORME

People

(Reporter: Usul, Unassigned)

References

()

Details

(4 keywords, Whiteboard: [tbird topcrash][antivirus:McAfee][gs][support][INVALID])

Crash Data

This bug was filed from the Socorro interface and is 
report bp-40b40cde-5f63-4f24-ad0f-6c7a82121013 .
============================================================= 
0 	plds4.dll 	PL_HashTableRawRemove 	nsprpub/lib/ds/plhash.c:297
1 	plds4.dll 	PL_HashTableRemove 	nsprpub/lib/ds/plhash.c:322
2 	xul.dll 	nsNodeInfoManager::RemoveNodeInfo 	content/base/src/nsNodeInfoManager.cpp:407
3 	xul.dll 	nsNodeInfo::~nsNodeInfo 	content/base/src/nsNodeInfo.cpp:72
4 	xul.dll 	nsNodeInfo::`vector deleting destructor' 	
5 	xul.dll 	nsNodeInfo::LastRelease 	content/base/src/nsNodeInfo.cpp:230
6 	xul.dll 	nsNodeInfo::Release 	content/base/src/nsNodeInfo.cpp:184
7 	xul.dll 	nsXPCOMCycleCollectionParticipant::UnrootImpl 	objdir-tb/mozilla/xpcom/build/nsCycleCollectionParticipant.cpp:37
8 	xul.dll 	nsCycleCollector::CollectWhite 	xpcom/base/nsCycleCollector.cpp:2305
9 	xul.dll 	nsCycleCollector::FinishCollection 	xpcom/base/nsCycleCollector.cpp:2845
10 	xul.dll 	nsCycleCollector::Collect 	xpcom/base/nsCycleCollector.cpp:2730
11 	xul.dll 	nsCycleCollector::Shutdown 	xpcom/base/nsCycleCollector.cpp:2895
12 	xul.dll 	nsCycleCollector_shutdown 	xpcom/base/nsCycleCollector.cpp:3267
13 	xul.dll 	mozilla::ShutdownXPCOM 	xpcom/build/nsXPComInit.cpp:647
14 	xul.dll 	ScopedXPCOMStartup::~ScopedXPCOMStartup 	toolkit/xre/nsAppRunner.cpp:1105
15 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3893
16 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3947
17 	thunderbird.exe 	do_main 	mail/app/nsMailApp.cpp:111
18 	thunderbird.exe 	NS_internal_main 	mail/app/nsMailApp.cpp:200
19 	thunderbird.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:100
20 	thunderbird.exe 	__tmainCRTStartup 	crtexe.c:552
21 	kernel32.dll 	BaseThreadInitThunk 	
22 	ntdll.dll 	__RtlUserThreadStart 	
23 	ntdll.dll 	_RtlUserThreadStart
Component: General → NSPR
Product: Core → NSPR
Version: 16 Branch → 4.9.3
This is almost certainly not an NSPR issue.
Component: NSPR → General
Product: NSPR → Core
Version: 4.9.3 → Trunk
Component: General → DOM
Is this cycle collector crash?
Is PL_HashTableRawLookup | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)  related?  https://crash-stats.mozilla.com/report/index/c66363fc-3b32-4633-9638-b41e22121019

odd that 95% of crashes are windows 7.


essentially crashes all thunderbird - only one firefox crash in one month. bp-92cdcf29-9b9c-4185-9c87-bcccb2121015
Component: DOM → General
Whiteboard: [tbird crash]
It's #3 top browser crasher in TB 17.0.

It's correlated with the McAfee Anti-spam extension:
  PL_HashTableRawLookup | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)|EXCEPTION_ACCESS_VIOLATION_READ (267 crashes)
    100% (267/267) vs.  13% (1836/14500) msktbird@mcafee.com
Keywords: topcrash
OS: Windows NT → Windows 7
Summary: crash in PL_HashTableRawRemove → crash in nsNodeInfoManager::RemoveNodeInfo with McAfee Anti-spam extension
Crash Signature: [@ PL_HashTableRawRemove | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)] → [@ PL_HashTableRawRemove | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)] [@ PL_HashTableRawLookup | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)]
Whiteboard: [tbird crash] → [tbird topcrash]
(In reply to Scoobidiver from comment #3)
> It's #3 top browser crasher in TB 17.0.
> 
> It's correlated with the McAfee Anti-spam extension:

Indeed every crash I've checked (20+) have McAfee addon.
It's a train wreck for McAfee users. 

Many are also reporting performance issues.


FWIW, historically bug 548571 has been a small pit of McAfee users
Status: NEW → RESOLVED
Closed: 10 years ago
Keywords: topcrashtopcrash+
Product: Core → Thunderbird
Resolution: --- → INVALID
See Also: → 548571
Whiteboard: [tbird topcrash] → [tbird topcrash][antivirus:McAfee]
Version: Trunk → 17
Roland reports McAfee says this will be fixed in 2013Q1.

FWIW, per https://crash-analysis.mozilla.com/crash_analysis/20130116/20130116_Thunderbird_17.0.2-interesting-addons.txt additional crash signatures correlate to McAfee - making this crash easily our #1 crash for TB17
js::types::TypeScript::destroy() bug 811219
nsCycleCollectingAutoRefCnt::incr(void*)
nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*)
mozilla::css::RestyleTracker::GetRestyleData(mozilla::dom::Element*, mozilla::css::RestyleTracker::RestyleData*)
arena_dalloc_small | arena_dalloc | je_free | mozilla::FramePropertyTable::PropertyValue::DestroyValueFor(nsIFrame*)
TraverseKey
clearHashEntry
XPCWrappedNative::SweepTearOffs()
and several more


https://getsatisfaction.com/mozilla_messaging/tags/bug_803460
and
https://getsatisfaction.com/mozilla_messaging/tags/mcafee
Crash Signature: [@ PL_HashTableRawRemove | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)] [@ PL_HashTableRawLookup | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)] → [@ PL_HashTableRawRemove | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)] [@ PL_HashTableRawLookup | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)] [@ XPCWrappedNative::SweepTearOffs()] [@ js::types::TypeScri…
Whiteboard: [tbird topcrash][antivirus:McAfee] → [tbird topcrash][antivirus:McAfee][gs][support]
Duplicate of this bug: 831454
nsAnonymousContentList::GetLength(unsigned int*) is yet another signature with the McAfee extension - like bp-4338217c-fb62-412e-b940-a04712130122
Crash Signature: mozilla::css::RestyleTracker::RestyleData*) ] [@ arena_dalloc_small | arena_dalloc | je_free | mozilla::FramePropertyTable::PropertyValue::DestroyValueFor(nsIFrame*) ] [@ TraverseKey ] [@ clearHashEntry ] → mozilla::css::RestyleTracker::RestyleData*) ] [@ arena_dalloc_small | arena_dalloc | je_free | mozilla::FramePropertyTable::PropertyValue::DestroyValueFor(nsIFrame*) ] [@ TraverseKey ] [@ clearHashEntry ] [@ nsAnonymousContentList::GetLength(unsigned …
nsXBLInsertionPoint::UnbindDefaultContent() bp-ce7d2149-b82b-474e-b657-d56202130308  
nsMsgLocalMailFolder::DeleteMessages(nsIArray*, nsIMsgWindow*, bool, bool, nsIMsgCopyServiceListener*, bool) bp-680f9f88-694e-49d3-8a35-192232130106
XPCNativeSet::Mark() bp-f942e3bb-ebf9-4009-9113-1ef852121231 bp-b2d2a2fc-8496-4879-ab5a-26c222121212
Crash Signature: nsAnonymousContentList::GetLength(unsigned int*)] → nsAnonymousContentList::GetLength(unsigned int*)] [@ nsXBLInsertionPoint::UnbindDefaultContent()] [@ nsMsgLocalMailFolder::DeleteMessages(nsIArray*, nsIMsgWindow*, bool, bool, nsIMsgCopyServiceListener*, bool)] [@ XPCNativeSet::Mark()]
Summary: crash in nsNodeInfoManager::RemoveNodeInfo with McAfee Anti-spam extension → crash in nsNodeInfoManager::RemoveNodeInfo and numerous other crash signatures with McAfee Anti-spam extension
signatures that currently *most* closely correlate to McAfee are

- nsAnonymousContentList::GetLength(unsigned int*)
- TraverseKey
- PL_HashTableRawRemove | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)

PL_HashTableRawRemove is #5 topcrash and accounts for 2.6% of version 17.0.6 crashes.
#129 crash nsImageBoxFrame::~nsImageBoxFrame() ... which began fall 2012, in the time frame that McAfee crashes started
bp-03c595d6-6f09-4e11-bd6d-b54a32121027 version 16
recent examples with address of crash reporter
bp-b3de7f97-1aa2-488f-bce2-a79282130508
bp-4f4df0ef-d3b4-4230-bae4-fb8e42130630
bp-539a6f5f-49cc-4f51-9ec4-5aeaa2130709
bp-1dd5787b-5cc4-4dea-8d02-dbb4d2130704
Crash Signature: nsAnonymousContentList::GetLength(unsigned int*)] [@ nsXBLInsertionPoint::UnbindDefaultContent()] [@ nsMsgLocalMailFolder::DeleteMessages(nsIArray*, nsIMsgWindow*, bool, bool, nsIMsgCopyServiceListener*, bool)] [@ XPCNativeSet::Mark()] → nsAnonymousContentList::GetLength(unsigned int*)] [@ nsXBLInsertionPoint::UnbindDefaultContent()] [@ nsMsgLocalMailFolder::DeleteMessages(nsIArray*, nsIMsgWindow*, bool, bool, nsIMsgCopyServiceListener*, bool)] [@ XPCNativeSet::Mark()] [@ nsImageBoxF…
This is still ongoing with McAfee. Need another (third?) round of user volunters.
Status: RESOLVED → REOPENED
Keywords: qawanted
Resolution: INVALID → ---
Whiteboard: [tbird topcrash][antivirus:McAfee][gs][support] → [tbird topcrash][antivirus:McAfee][gs][support][INVALID]
I think js::types::TypeScript::destroy()  is the most common of the crash sigs, #4 for 17.0.8.  Adding the other signatures, of which there are many, certainly put the ranking higher
Crash Signature: js::types::TypeScript::destroy() ] [@ nsCycleCollectingAutoRefCnt::incr(void*) ] [@ nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) ] [@ mozilla::css::RestyleTracker::GetRestyleData(mozilla::dom::Element*, bool)] [@ XPCNativeSet::Mark()] … → nsCycleCollectingAutoRefCnt::incr(void*) ] [@ nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) ] [@ mozilla::css::RestyleTracker::GetRestyleData(mozilla::dom::Element*, bool)] [@ XPCNativeSet::Mark()] [@ nsImageBoxFrame::~nsImageBoxFrame()]…
Of the last 9 crash signatures in the signature list ...

[@ arena_dalloc_small | arena_dalloc | je_free | mozilla::FramePropertyTable::PropertyValue::DestroyValueFor(nsIFrame*) ]
[@ TraverseKey ]
[@ clearHashEntry ]
[@ nsAnonymousContentList::GetLength(unsigned int*)]
[@ nsXBLInsertionPoint::UnbindDefaultContent()]
[@ nsMsgLocalMailFolder::DeleteMessages(nsIArray*, nsIMsgWindow*, bool, bool, nsIMsgCopyServiceListener*, bool)]
[@ XPCNativeSet::Mark()]
[@ nsImageBoxFrame::~nsImageBoxFrame()]
[@ js::types::TypeScript::destroy() ]

...only XPCNativeSet::Mark() and clearHashEntry have significant crash rates.  Don't yet know if any for current versions are McAfee related.
https://crash-analysis.mozilla.com/crash_analysis/20130712/20130712_Thunderbird_17.0.7-interesting-addons.txt lists correlations for TB17.0.7 
msktbird@mcafee.com is often above 90%. for example
  js::types::TypeScript::destroy()|EXCEPTION_ACCESS_VIOLATION_READ (110 crashes)
    100% (110/110) vs.  13% (1695/12949) msktbird@mcafee.com

contrast with ...
https://crash-analysis.mozilla.com/crash_analysis/20140116/20140116_Thunderbird_24.2.0-interesting-addons.txt lists correlations for TB24.2.0.  msktbird@mcafee.com never breaks above 30%

This is not to say that McAfee never causes crashes. But based on this information there is no longer reason to believe that McAfee causes crashes on a large scale. so closing.
Status: REOPENED → RESOLVED
Closed: 10 years ago9 years ago
Resolution: --- → WORKSFORME
See Also: → 846282
Duplicate of this bug: 811219
You need to log in before you can comment on or make changes to this bug.