803460 - crash in nsNodeInfoManager::RemoveNodeInfo and numerous other crash signatures with McAfee Anti-spam extension

Status: RESOLVED WORKSFORME

(Thunderbird :: General, defect)

Description

[Ludovic Hirlimann [:Usul]]

This bug was filed from the Socorro interface and is 
report bp-40b40cde-5f63-4f24-ad0f-6c7a82121013 .
============================================================= 
0 	plds4.dll 	PL_HashTableRawRemove 	nsprpub/lib/ds/plhash.c:297
1 	plds4.dll 	PL_HashTableRemove 	nsprpub/lib/ds/plhash.c:322
2 	xul.dll 	nsNodeInfoManager::RemoveNodeInfo 	content/base/src/nsNodeInfoManager.cpp:407
3 	xul.dll 	nsNodeInfo::~nsNodeInfo 	content/base/src/nsNodeInfo.cpp:72
4 	xul.dll 	nsNodeInfo::`vector deleting destructor' 	
5 	xul.dll 	nsNodeInfo::LastRelease 	content/base/src/nsNodeInfo.cpp:230
6 	xul.dll 	nsNodeInfo::Release 	content/base/src/nsNodeInfo.cpp:184
7 	xul.dll 	nsXPCOMCycleCollectionParticipant::UnrootImpl 	objdir-tb/mozilla/xpcom/build/nsCycleCollectionParticipant.cpp:37
8 	xul.dll 	nsCycleCollector::CollectWhite 	xpcom/base/nsCycleCollector.cpp:2305
9 	xul.dll 	nsCycleCollector::FinishCollection 	xpcom/base/nsCycleCollector.cpp:2845
10 	xul.dll 	nsCycleCollector::Collect 	xpcom/base/nsCycleCollector.cpp:2730
11 	xul.dll 	nsCycleCollector::Shutdown 	xpcom/base/nsCycleCollector.cpp:2895
12 	xul.dll 	nsCycleCollector_shutdown 	xpcom/base/nsCycleCollector.cpp:3267
13 	xul.dll 	mozilla::ShutdownXPCOM 	xpcom/build/nsXPComInit.cpp:647
14 	xul.dll 	ScopedXPCOMStartup::~ScopedXPCOMStartup 	toolkit/xre/nsAppRunner.cpp:1105
15 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3893
16 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3947
17 	thunderbird.exe 	do_main 	mail/app/nsMailApp.cpp:111
18 	thunderbird.exe 	NS_internal_main 	mail/app/nsMailApp.cpp:200
19 	thunderbird.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:100
20 	thunderbird.exe 	__tmainCRTStartup 	crtexe.c:552
21 	kernel32.dll 	BaseThreadInitThunk 	
22 	ntdll.dll 	__RtlUserThreadStart 	
23 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Josh Matthews [:jdm]]

This is almost certainly not an NSPR issue.

Comment 2

[Wayne Mery (:wsmwk)]

Is this cycle collector crash?
Is PL_HashTableRawLookup | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)  related?  https://crash-stats.mozilla.com/report/index/c66363fc-3b32-4633-9638-b41e22121019

odd that 95% of crashes are windows 7.


essentially crashes all thunderbird - only one firefox crash in one month. bp-92cdcf29-9b9c-4185-9c87-bcccb2121015

Comment 3

[Scoobidiver (away)]

It's #3 top browser crasher in TB 17.0.

It's correlated with the McAfee Anti-spam extension:
  PL_HashTableRawLookup | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)|EXCEPTION_ACCESS_VIOLATION_READ (267 crashes)
    100% (267/267) vs.  13% (1836/14500) [e-mail]

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Scoobidiver from comment #3)
> It's #3 top browser crasher in TB 17.0.
> 
> It's correlated with the McAfee Anti-spam extension:

Indeed every crash I've checked (20+) have McAfee addon.
It's a train wreck for McAfee users. 

Many are also reporting performance issues.


FWIW, historically bug 548571 has been a small pit of McAfee users

Comment 5

[Wayne Mery (:wsmwk)]

Roland reports McAfee says this will be fixed in 2013Q1.

FWIW, per https://crash-analysis.mozilla.com/crash_analysis/20130116/20130116_Thunderbird_17.0.2-interesting-addons.txt additional crash signatures correlate to McAfee - making this crash easily our #1 crash for TB17
js::types::TypeScript::destroy() bug 811219
nsCycleCollectingAutoRefCnt::incr(void*)
nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*)
mozilla::css::RestyleTracker::GetRestyleData(mozilla::dom::Element*, mozilla::css::RestyleTracker::RestyleData*)
arena_dalloc_small | arena_dalloc | je_free | mozilla::FramePropertyTable::PropertyValue::DestroyValueFor(nsIFrame*)
TraverseKey
clearHashEntry
XPCWrappedNative::SweepTearOffs()
and several more


https://getsatisfaction.com/mozilla_messaging/tags/bug_803460
and
https://getsatisfaction.com/mozilla_messaging/tags/mcafee

Comment 7

[Wayne Mery (:wsmwk)]

nsAnonymousContentList::GetLength(unsigned int*) is yet another signature with the McAfee extension - like bp-4338217c-fb62-412e-b940-a04712130122

Comment 8

[Wayne Mery (:wsmwk)]

nsXBLInsertionPoint::UnbindDefaultContent() bp-ce7d2149-b82b-474e-b657-d56202130308  
nsMsgLocalMailFolder::DeleteMessages(nsIArray*, nsIMsgWindow*, bool, bool, nsIMsgCopyServiceListener*, bool) bp-680f9f88-694e-49d3-8a35-192232130106
XPCNativeSet::Mark() bp-f942e3bb-ebf9-4009-9113-1ef852121231 bp-b2d2a2fc-8496-4879-ab5a-26c222121212

Comment 9

[Wayne Mery (:wsmwk)]

signatures that currently *most* closely correlate to McAfee are

- nsAnonymousContentList::GetLength(unsigned int*)
- TraverseKey
- PL_HashTableRawRemove | PL_HashTableRemove | nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*)

PL_HashTableRawRemove is #5 topcrash and accounts for 2.6% of version 17.0.6 crashes.

Comment 10

[Wayne Mery (:wsmwk)]

#129 crash nsImageBoxFrame::~nsImageBoxFrame() ... which began fall 2012, in the time frame that McAfee crashes started
bp-03c595d6-6f09-4e11-bd6d-b54a32121027 version 16
recent examples with address of crash reporter
bp-b3de7f97-1aa2-488f-bce2-a79282130508
bp-4f4df0ef-d3b4-4230-bae4-fb8e42130630
bp-539a6f5f-49cc-4f51-9ec4-5aeaa2130709
bp-1dd5787b-5cc4-4dea-8d02-dbb4d2130704

Comment 11

[Wayne Mery (:wsmwk)]

This is still ongoing with McAfee. Need another (third?) round of user volunters.

Comment 12

[Wayne Mery (:wsmwk)]

I think js::types::TypeScript::destroy()  is the most common of the crash sigs, #4 for 17.0.8.  Adding the other signatures, of which there are many, certainly put the ranking higher

Comment 13

[Wayne Mery (:wsmwk)]

Of the last 9 crash signatures in the signature list ...

[@ arena_dalloc_small | arena_dalloc | je_free | mozilla::FramePropertyTable::PropertyValue::DestroyValueFor(nsIFrame*) ]
[@ TraverseKey ]
[@ clearHashEntry ]
[@ nsAnonymousContentList::GetLength(unsigned int*)]
[@ nsXBLInsertionPoint::UnbindDefaultContent()]
[@ nsMsgLocalMailFolder::DeleteMessages(nsIArray*, nsIMsgWindow*, bool, bool, nsIMsgCopyServiceListener*, bool)]
[@ XPCNativeSet::Mark()]
[@ nsImageBoxFrame::~nsImageBoxFrame()]
[@ js::types::TypeScript::destroy() ]

...only XPCNativeSet::Mark() and clearHashEntry have significant crash rates.  Don't yet know if any for current versions are McAfee related.

Comment 14

[Wayne Mery (:wsmwk)]

https://crash-analysis.mozilla.com/crash_analysis/20130712/20130712_Thunderbird_17.0.7-interesting-addons.txt lists correlations for TB17.0.7 
[e-mail] is often above 90%. for example
  js::types::TypeScript::destroy()|EXCEPTION_ACCESS_VIOLATION_READ (110 crashes)
    100% (110/110) vs.  13% (1695/12949) [e-mail]

contrast with ...
https://crash-analysis.mozilla.com/crash_analysis/20140116/20140116_Thunderbird_24.2.0-interesting-addons.txt lists correlations for TB24.2.0.  [e-mail] never breaks above 30%

This is not to say that McAfee never causes crashes. But based on this information there is no longer reason to believe that McAfee causes crashes on a large scale. so closing.