843582 - runaway memory usage when displaying a mail header with thousands of contacts

Status: RESOLVED DUPLICATE of bug 813496

(Thunderbird :: Message Reader UI, defect)

Description

[diemo]

Attachment: email making tb's memory use go wild

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20130201065344

Steps to reproduce:

A spam mail arrived in my inbox with arabic characters (see attachment).


Actual results:

Memory usage goes over the top (~1 GB in a few seconds), TB is unresponsive, I have to kill TB.  Full crash logs are attached, below are excerpts, always containing JSRuntime::onOutOfMemory.
After restarting TB, this happens immediately.
After moving the mail to a different folder (in web mail), TB starts fine and can display the mail.
After moving the mail back into the Inbox, the problem reappears.
Can it be the junk mail filter that is causing the memory going wild?



Expected results:

Mail displayed, checked positively for spam status, moved to junk mail folder.

Comment 1

[diemo]

Attachment: crash log 1

User stack:
    1 js::GCHelperThread::replenishAndFreeLater(void*) + 1839 (in XUL) [0x10258fa9f]
    1 JSRuntime::onOutOfMemory(void*, unsigned long, JSContext*) + 12379 (in XUL) [0x102566b0b]
    1 JS_EnumerateDiagnosticMemoryRegions + 136473 (in XUL) [0x1025b8ec9]
    1 js::NewProxyObject(JSContext*, js::BaseProxyHandler*, JS::Value const&, JSObject*, JSObject*, JSObject*, JSObject*) + 163 (in XUL) [0x1025fa733]
    1 __memcpy + 33 (in commpage [libSystem.B.dylib]) [0x7fffffe007c1]
    1 js::obj_defineSetter(JSContext*, unsigned int, JS::Value*) + 27626 (in XUL) [0x1025ce12a]

Comment 2

[diemo]

Attachment: crash log 2

User stack:
    2 ??? [0x124923070]
      1 js::StringIsArrayIndex(JSLinearString*, unsigned int*) + 57914 (in XUL) [0x10255fdea]
      1 JS_EnumerateDiagnosticMemoryRegions + 90692 (in XUL) [0x1025b08e4]
    1 __memcpy + 39 (in commpage [libSystem.B.dylib]) [0x7fffffe007c7]
    1 ??? [0x1249552e0]
      1 js::obj_defineSetter(JSContext*, unsigned int, JS::Value*) + 27347 (in XUL) [0x1025d0ea3]
    1 je_malloc_usable_size + 130 (in libmozglue.dylib) [0x100010de2]
    1 JS_GetScriptedGlobal + 2521 (in XUL) [0x102550fe9]
    1 JSRuntime::onOutOfMemory(void*, unsigned long, JSContext*) + 4910 (in XUL) [0x102567a0e]
    1 mozilla::services::_external_GetHistoryService() + 36502 (in XUL) [0x1021b8b56]
    1 non-virtual thunk to js::DirectWrapper::toWrapper() + 1381648 (in XUL) [0x1017c7060]
    1 JS_IterateCompartments + 5266 (in XUL) [0x1025960a2]
    1 JS::UserCompartmentCount(JSRuntime const*) + 30336 (in XUL) [0x1026e4db0]
    1 JS::AutoGCRooter::trace(JSTracer*) + 9286 (in XUL) [0x10259a466]
    1 je_malloc_usable_size + 178 (in libmozglue.dylib) [0x100010e12]
    1 malloc + 44 (in libSystem.B.dylib) [0x7fff80310c88]
      1 je_malloc + 179 (in libmozglue.dylib) [0x10000f653]
    1 JS_EnumerateDiagnosticMemoryRegions + 88609 (in XUL) [0x1025b00c1]
    1 JS_vsprintf_append + 1602 (in XUL) [0x1025ffd02]
    1 JSRuntime::onOutOfMemory(void*, unsigned long, JSContext*) + 5456 (in XUL) [0x102567c30]
    1 malloc + 26 (in libSystem.B.dylib) [0x7fff80310c76]
    1 JSRuntime::onOutOfMemory(void*, unsigned long, JSContext*) + 4902 (in XUL) [0x102567a06]
    1 JS_EnumerateDiagnosticMemoryRegions + 87266 (in XUL) [0x1025afb82]
    1 nsXPTCStubBase::Stub249() + 29781 (in XUL) [0x1021ff3a5]
    1 js::DirectProxyHandler::iterate(JSContext*, JSObject*, unsigned int, JS::Value*) + 11272 (in XUL) [0x1025fb7b8]
    1 JS_GetScriptedGlobal + 3013 (in XUL) [0x1025511d5]
    1 js::UnmarkGrayGCThingRecursively(void*, JSGCTraceKind) + 2785 (in XUL) [0x1026e7781]
    1 JS::UserCompartmentCount(JSRuntime const*) + 31919 (in XUL) [0x1026e53df]
    1 JSRuntime::onOutOfMemory(void*, unsigned long, JSContext*) + 5079 (in XUL) [0x102567ab7]
    1 ??? [0x10034ac18]
      1 JS_DefineDebuggerObject + 43505 (in XUL) [0x102690981]
    1 mozilla::scache::PathifyURI(nsIURI*, nsACString_internal&) + 24506 (in XUL) [0x101137aba]
    1 js::StringIsArrayIndex(JSLinearString*, unsigned int*) + 23671 (in XUL) [0x102557827]
    1 js::DirectProxyHandler::get(JSContext*, JSObject*, JSObject*, long, JS::Value*) + 16 (in XUL)

Comment 3

[diemo]

Attachment: crash log 3

User stack:
    2 ??? [0x124c552e0]
      1 js::BaseProxyHandler::toWrapper() + 162133 (in XUL) [0x101a9ba45]
      1 JS_EnumerateDiagnosticMemoryRegions + 77867 (in XUL) [0x1025ad6cb]
    1 JS::UserCompartmentCount(JSRuntime const*) + 30366 (in XUL) [0x1026e4dce]
    1 JS_GetScriptedGlobal + 3013 (in XUL) [0x1025511d5]
    1 js::CrossCompartmentWrapper::get(JSContext*, JSObject*, JSObject*, long, JS::Value*) + 91 (in XUL) [0x1026509cb]
    1 pthread_equal + 13 (in libSystem.B.dylib) [0x7fff8032727e]
    1 js::BaseProxyHandler::toWrapper() + 159928 (in XUL) [0x101a9b1a8]

Comment 4

[diemo]

Attachment: crash log 4

Comment 5

[diemo]

Comment on attachment 716526 [details]
crash log 4

  User stack:
    2 ??? [0x1242fb070]
      1 js::StringIsArrayIndex(JSLinearString*, unsigned int*) + 56197 (in XUL) [0x10255cb05]
      1 JS_EnumerateDiagnosticMemoryRegions + 113506 (in XUL) [0x1025b3512]
    1 JS_EnumerateDiagnosticMemoryRegions + 127052 (in XUL) [0x1025b69fc]
    1 JS_EnumerateDiagnosticMemoryRegions + 136613 (in XUL) [0x1025b8f55]
    1 JSRuntime::onOutOfMemory(void*, unsigned long, JSContext*) + 6777 (in XUL) [0x102565529]
    1 JS::UserCompartmentCount(JSRuntime const*) + 30656 (in XUL) [0x1026e1ed0]
    1 ??? [0x12426d0a0]
      1 JaegerInterpolineScripted + 89987 (in XUL) [0x1026ffc8a]
    1 JS_EnumerateDiagnosticMemoryRegions + 122277 (in XUL) [0x1025b5755]

Comment 6

[Wayne Mery (:wsmwk)]

Attachment: screen shot preview pane header with Cc: list ending in comma

This has tons of contacts in the header - an unterminated (ends with a comma) list 3,400 Cc: addresses.  

On my first attempt - No performance problem using my 2013-02-15 Daily build on windows. However, attempts after editing the header I had trouble - high CPU, "unresponsive script" dialog. Only modest memory increase - ~50MB

If I remove the last comma then there is trouble

Comment 7

[Wayne Mery (:wsmwk)]

essentially a duplicate of bug 813496