867099 - crash in ? (nsMsgDatabase::GetFolder)

Status: RESOLVED WORKSFORME

(MailNews Core :: Backend, defect)

Description

[Wayne Mery (:wsmwk)]

TB17.0.5 regression.
#7 crash

Majority of stacks are of this form...
bp-323735c7-8d69-4ac3-a7fa-971b62130404 
============================================================= 
0	xul.dll	nsMsgDatabase::GetFolder	mailnews/base/src/nsMsgWindow.cpp:196
1	xul.dll	nsASDOMWindowEnumerator::GetNext	xpfe/appshell/src/nsAppShellWindowEnumerator.cpp:227
2	xul.dll	MarkWindowList	content/base/src/nsCCUncollectableMarker.cpp:253
3	xul.dll	nsCCUncollectableMarker::Observe	content/base/src/nsCCUncollectableMarker.cpp:314
4	xul.dll	nsObserverList::NotifyObservers	xpcom/ds/nsObserverList.cpp:99
5	xul.dll	nsObserverService::NotifyObservers	xpcom/ds/nsObserverService.cpp:149
6	xul.dll	nsCycleCollector::ForgetSkippable	xpcom/base/nsCycleCollector.cpp:2080
7	xul.dll	nsCycleCollector_forgetSkippable	xpcom/base/nsCycleCollector.cpp:3244
8	xul.dll	FireForgetSkippable	dom/base/nsJSEnvironment.cpp:3049
9	xul.dll	CCTimerFired	dom/base/nsJSEnvironment.cpp:3287 


A few like bp-f844512c-04c1-471c-b9e4-1fa982130427 have nsMsgMailSession::GetTopmostMsgWindow on stack. Which are perhaps the same as https://crash-stats.mozilla.com/query/query?product=Thunderbird&version=ALL%3AALL&range_value=1&range_unit=weeks&date=04%2F30%2F2013+11%3A42%3A24&query_search=signature&query_type=contains&query=nsMsgMailSession%3A%3AGetTopmostMsgWindow&reason=&build_id=&process_type=any&hang_type=any&do_query=1 ?

Comment 1

[Wayne Mery (:wsmwk)]

#20 crash for esr 17.0.5 like bp-e9c1c8b5-4f52-40f3-8342-bbab22130427
some stack variation bp-cd773e81-f687-4502-a59c-a21bd2130430

No crashes found in development branches

Comment 2

[Makoto Kato [:m_kato]]

old version may be bug 694646...  by the optimization by compiler, function symbol seems to be changed...

Comment 3

[Mark Banner (:standard8)]

Yeah, GetFolder is bogus here, like Makoto says, this is probably a dupe of an older bug that's just morphed.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Makoto Kato from comment #2)
> old version may be bug 694646...  

Makoto, thanks. I agree. which raises the questions:

- what was the signature in 17.0.4?  (not terribly important - but nsMsgDatabase::GetFolder is not in 17.0.4 or 0.3)
- what is the crash sig in Thunderbird beta?   (nsMsgDatabase::GetFolder is not in beta, nor is nsXULWindow::GetDocShell)
- but most importantly, is this bad cycle collector or bad thread behavior?  or something else


Unfortunately users I have contacted are not able to reproduce. like
bp-b339b12d-1890-465f-b665-156462130414 (dr_schmidt)
bp-f844512c-04c1-471c-b9e4-1fa982130427 (roy)

Comment 5

[Wayne Mery (:wsmwk)]

On pace to be a topcrash again, for TB17.0.8.
signature disappeared in TB17.0.6 and TB17.0.7

17.0.2 nsXULWindow::GetDocShell(nsIDocShell**)
17.0.3 nsMimeBaseEmitter::GetOutputListener(nsIStreamListener**) bug 694646
17.0.4 nsMimeBaseEmitter::GetOutputListener(nsIStreamListener**) bug 694646
[17.0.5 nsMsgDatabase::GetFolder(nsIMsgFolder**) bug 867099] 
17.0.6 nsMimeBaseEmitter::GetOutputListener(nsIStreamListener**) bug 694646
17.0.7 nsMsgDatabase::GetFolder(nsIMsgFolder**)  bug 694646
17.0.8 nsMsgDatabase::GetFolder(nsIMsgFolder**) bug 867099

Comment 6

[Tracy Walker [:tracy]]

topcrash is being replaced by more precise keywords per https://bugzilla.mozilla.org/show_bug.cgi?id=927557#c3

Comment 7

[Wayne Mery (:wsmwk)]

No crashes newer than Thunderbird 17.0.8. Unclear to what extent bug 679626 helped without digging deep.