959532 - Random crash while repeating <open file, reply to, save, delete>. OOM?

Status: UNCONFIRMED

(Thunderbird :: General, defect)

Description

[fengyuan]

Attachment: core dumps and my script

Thunderbird 17.0.6esr
Solaris12_37, sparc/x86
Debian, x64

I'm making fuzz testing on Thunderbird for Solaris desktop. And thunderbird seems unsteady while repeating the fuzz work. 

What I and my scripts do:
1. generate 2000 .eml files filled with random character with readable .eml file organize.(with mailfuzz.py and make_fuzz_mail.sh)
2. Run mozmill. My mozmill script doing belows to each file: <open .eml file, reply to it, save as draft, delete draft>

What expected to happen:
It covers the 2000 .eml files without crash

What Actually happen:
It crashes at a random file. Different file each time. Rarely it covers some 300 files then crash with "no memory". Often it crashes before the 100th mail read.

Comment 1

[Wayne Mery (:wsmwk)]

awesome.

however, version 17 is a year older than current development source. It will be far more helpful if you do fuzz work using latest sources.  Please try daily build from https://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-comm-central/

Comment 2

[fengyuan]

Attachment: TB 24 and 27 core dump

Get the same result with Thunderbird 24.2.0 and 27.0b1. Debian 17.
Here's the dump file and mozmill output and script.

Comment 3

[Wayne Mery (:wsmwk)]

Thanks fengyuan.

Can you get the actual stacktrace using gdb, with the same binaries used to create the core dump?

Comment 4

[fengyuan]

(In reply to Wayne Mery (:wsmwk) from comment #3)
> Thanks fengyuan.
> 
> Can you get the actual stacktrace using gdb, with the same binaries used to
> create the core dump?

I get to know about gdb first. I'll upload it here once I get progress. Won't be fast I guess...

Comment 5

[fengyuan]

(In reply to Wayne Mery (:wsmwk) from comment #3)
> Thanks fengyuan.
> 
> Can you get the actual stacktrace using gdb, with the same binaries used to
> create the core dump?

I tried, but get no stack.

pgrep thunderbird
gdb
attach <pid>
continue

But when the error occur and mozmill terminated with "time out waiting for windows open", gbd says "program exit normally". And bt says "no stack". 

Is this means the problem was between mozmill and thunderbird, but thunderbird itself did nothing wrong? Or is it possible to get a stack with gdb when thunderbird "exit normally"?

Comment 6

[Wayne Mery (:wsmwk)]

(In reply to fengyuan from comment #5)
> But when the error occur and mozmill terminated with "time out waiting for
> windows open", gbd says "program exit normally". And bt says "no stack". 
> 
> Is this means the problem was between mozmill and thunderbird, but
> thunderbird itself did nothing wrong? Or is it possible to get a stack with
> gdb when thunderbird "exit normally"?

Joshua, can you help with this, or bring in someone who might know?

Comment 7

[fengyuan]

It's now Debian + Thunderbird 17.0.6esr and I've reproduced it without mozmill. I'll try on Thunderbird 24.0.3 later. Hopefully in 2 days.
I tried again without mozmill. This time only <open file, close window> was done. 

I open some 400 mails each time with a bash command and close them manually with Ctrl+F4. Thunderbird crashed when I'm closing the mails.

I get a Mozilla Crash Reporter pop up here. But "bt" in gdb gives nothing. Below is what's showing in gdb. What should I do to get more info? Crash Reports folder uploading. I just wondering if this kind of info can be helpful when it is on Thunderbird 24.

[New Thread 0x7ff01b0f7700 (LWP 12206)]
[New Thread 0x7ff01d0fb700 (LWP 12208)]
[Thread 0x7ff0f43fc700 (LWP 12126) exited]

Program received signal SIGSEGV, Segmentation fault.
0x00007ff1010eba6b in ?? ()
   from /usr/lib/x86_64-linux-gnu/libfcitx-gclient.so.0
(gdb) 
Continuing.
[Thread 0x7ff105dff700 (LWP 4570) exited]
[Thread 0x7ff107194700 (LWP 4569) exited]
[Thread 0x7ff089efb700 (LWP 12128) exited]
[Thread 0x7ff0aeafb700 (LWP 7227) exited]
[Thread 0x7ff01d0fb700 (LWP 12208) exited]
[Thread 0x7ff01f0ff700 (LWP 12147) exited]
[Thread 0x7ff0f53fe700 (LWP 5410) exited]
[Thread 0x7ff0be30e700 (LWP 5409) exited]
[Thread 0x7ff1010e8700 (LWP 5092) exited]
[Thread 0x7ff0c5a0b700 (LWP 5088) exited]
[Thread 0x7ff104df3700 (LWP 4571) exited]
[Thread 0x7ff1045f2700 (LWP 4572) exited]
[Thread 0x7ff103df1700 (LWP 4573) exited]
[Thread 0x7ff1032ff700 (LWP 4574) exited]
[Thread 0x7ff1008e7700 (LWP 4576) exited]
[Thread 0x7ff0ffdff700 (LWP 4577) exited]
[Thread 0x7ff0ff3ff700 (LWP 4578) exited]
[Thread 0x7ff0fe092700 (LWP 4579) exited]
[Thread 0x7ff0f65fe700 (LWP 4581) exited]
[Thread 0x7ff0f6dff700 (LWP 4587) exited]
[Thread 0x7ff0f3bfb700 (LWP 4592) exited]
[Thread 0x7ff0f5bff700 (LWP 4593) exited]
[Thread 0x7ff0f4bfd700 (LWP 4594) exited]
[Thread 0x7ff0ec0ff700 (LWP 4595) exited]
[Thread 0x7ff0eb8fe700 (LWP 4596) exited]
[Thread 0x7ff0eb0fd700 (LWP 4597) exited]
[Thread 0x7ff0eaeff700 (LWP 4598) exited]
[Thread 0x7ff0ea6fe700 (LWP 4599) exited]
[Thread 0x7ff0e90fe700 (LWP 4602) exited]
[Thread 0x7ff0e2a9d700 (LWP 4616) exited]
[Thread 0x7ff1197e6740 (LWP 4525) exited]
[Inferior 1 (process 4525) exited with code 013]
(gdb) bt
No stack.
(gdb) 


And here's Crash Reporter's report content. Guess 

Add-ons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.2.0
BuildID: 20131206072529
CrashTime: 1394394907
EMCheckCompatibility: true
InstallTime: 1389877497
Notes: OpenGL: VMware, Inc. -- Gallium 0.4 on llvmpipe (LLVM 0x209) -- 2.1 Mesa 8.0.5 -- texture_from_pixmap

ProductID: {3550f703-e582-4d05-9a08-453d09bdfdc6}
ProductName: Thunderbird
ReleaseChannel: release
SecondsSinceLastCrash: 4518589
StartupTime: 1394394003
Theme: classic/1.0
Throttleable: 1
Vendor: 
Version: 24.2.0

This report also contains technical information about the state of the application when it crashed.

Comment 8

[fengyuan]

Attachment: Linux_TB17esr_Crash Reports.rar

Comment 9

[fengyuan]

For Debian / Thunderbird 24.3.0
A crash happened. I get a stack with gdm.


[New Thread 0x7ff9a24ff700 (LWP 13585)]
[Thread 0x7ff9a24ff700 (LWP 13585) exited]
[Thread 0x7ff9956ff700 (LWP 13584) exited]
[Thread 0x7ff94e20e700 (LWP 13571) exited]
[New Thread 0x7ff94e20e700 (LWP 15984)]
[New Thread 0x7ff9956ff700 (LWP 18384)]
[New Thread 0x7ff9a24ff700 (LWP 18385)]
[Thread 0x7ff9956ff700 (LWP 18384) exited]
[New Thread 0x7ff9956ff700 (LWP 18386)]
[Thread 0x7ff94e20e700 (LWP 15984) exited]

Program received signal SIGSEGV, Segmentation fault.
0x00007ff9bf09046b in g_object_unref ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
(gdb) bt
#0  0x00007ff9bf09046b in g_object_unref ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#1  0x00007ff9ad9eb73c in ?? ()
   from /usr/lib/x86_64-linux-gnu/libfcitx-gclient.so.0
#2  0x00007ff9be23d537 in g_simple_async_result_complete ()
   from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#3  0x00007ff9be23d639 in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#4  0x00007ff9bedcc355 in g_main_context_dispatch ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007ff9bedcc688 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#6  0x00007ff9bedcc744 in g_main_context_iteration ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#7  0x00007ff9c0e9dc16 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#8  0x00007ff9c0ec14fb in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#9  0x00007ff9c0ec15c2 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#10 0x00007ff9c144500e in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so---Type <return> to continue, or q <return> to quit--- 

#11 0x00007ff9c1418f41 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#12 0x00007ff9c1141772 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#13 0x00007ff9c1469125 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#14 0x00007ff9c0ec0a07 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#15 0x00007ff9c0d9b147 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#16 0x00007ff9c048cc79 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#17 0x00007ff9c048f000 in ?? ()
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#18 0x00007ff9c048f23a in XRE_main ()
---Type <return> to continue, or q <return> to quit---
   from /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so
#19 0x000000000040371c in _start ()
(gdb) 
(gdb) continue
Continuing.
[Thread 0x7ff9a24ff700 (LWP 18385) exited]
[Thread 0x7ff9ad1e7700 (LWP 5730) exited]
[Thread 0x7ff9b3a94700 (LWP 5723) exited]
[Thread 0x7ff9ac6ff700 (LWP 5731) exited]
[Thread 0x7ff9b26ff700 (LWP 5724) exited]
[Thread 0x7ff9abcff700 (LWP 5732) exited]
[Thread 0x7ff9afbff700 (LWP 5728) exited]
[Thread 0x7ff9aa98f700 (LWP 5733) exited]
[Thread 0x7ff9a36ff700 (LWP 5741) exited]
[Thread 0x7ff9a113d700 (LWP 8294) exited]
[Thread 0x7ff9976ef700 (LWP 5756) exited]
[Thread 0x7ff9b2898700 (LWP 5757) exited]
[Thread 0x7ff9b16f3700 (LWP 5725) exited]
[Thread 0x7ff996cff700 (LWP 8557) exited]
[Thread 0x7ff998bff700 (LWP 5753) exited]
[Thread 0x7ff9964fe700 (LWP 5759) exited]
[Thread 0x7ff994efe700 (LWP 5761) exited]
[Thread 0x7ff98e69f700 (LWP 5768) exited]
[Thread 0x7ff9b0ef2700 (LWP 5726) exited]
[Thread 0x7ff9c60a4740 (LWP 5698) exited]
[Thread 0x7ff9a1cfe700 (LWP 5748) exited]
[Thread 0x7ff9956ff700 (LWP 18386) exited]
[Thread 0x7ff9ad9e8700 (LWP 8293) exited]
[Thread 0x7ff9b06f1700 (LWP 5727) exited]
[Thread 0x7ff9a2efe700 (LWP 5735) exited]
[Thread 0x7ff9981ff700 (LWP 5754) exited]
[Inferior 1 (process 5698) exited with code 013]
(gdb) 

Thunderbird Crash Reporter is trying to send a message.
Add-ons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.3.0
BuildID: 20140131124303
CrashTime: 1394455093
EMCheckCompatibility: true
InstallTime: 1394450683
Notes: OpenGL: VMware, Inc. -- Gallium 0.4 on llvmpipe (LLVM 0x209) -- 2.1 Mesa 8.0.5 -- texture_from_pixmap

ProductID: {3550f703-e582-4d05-9a08-453d09bdfdc6}
ProductName: Thunderbird
ReleaseChannel: release
SecondsSinceLastCrash: 60186
StartupTime: 1394450713
Theme: classic/1.0
Throttleable: 1
Vendor: 
Version: 24.3.0

This report also contains technical information about the state of the application when it crashed.

Attaching Crash Reporter folder as below

Comment 10

[fengyuan]

Attachment: TB24.3_CrashReporter_pending.rar

Comment 11

[Joshua Cranmer [:jcranmer]]

(In reply to fengyuan from comment #9)
> #7  0x00007ff9c0e9dc16 in ?? ()
>    from
> /home/riller2/mozmilltest/thunderbird-24.3.0.tests/thunderbird/libxul.so

This stack has no symbols which makes it completely useless. If you're using a stock Debian package, there should be a thunderbird-dbg (or equivalent) package that contains the symbols.

Comment 12

[fengyuan]

Debian is shipped with icedove which is made of thunderbird. And they have just updated it from 17 to 24.
I made a test on it.

Step: 
for a in `seq 1 200` ; do  icedove ./$a-fuzz.eml; done
#Then close them all with Ctrl+F4
for a in `seq 201 400` ; do  icedove ./$a-fuzz.eml; done
#Then close some of them with Ctrl+F4, then the bug happened.

Result:Thunderbird(icedove) become a white board and no more responding. No crash however. I collect data with (gdb)backtrace.

Now uploading attachments of screenshot and backtrace.

Comment 13

[fengyuan]

Attachment: Icedove24.5-Blank window.png

Comment 14

[fengyuan]

Attachment: Icedove24.5-backtrace

Comment 15

[fengyuan]

(In reply to fengyuan from comment #14)
> Created attachment 8436457 [details]
> Icedove24.5-backtrace

Suspending that the above one was from a misoperation of gdb, I tried 2000+ mails more. And I get 1 more segfault and 1 bus error. Attaching.

Comment 16

[fengyuan]

Attachment: Icedove24.5-fuzz-buserror

Comment 17

[fengyuan]

Attachment: Icedove24.5-fuzz-segfault

Comment 18

[fengyuan]

Attachment: Icedove24.5-fuzz-segfault

Comment 19

[Wayne Mery (:wsmwk)]

Does it happen with version 38, or current nightly source?

Comment 20

[Wayne Mery (:wsmwk)]

fengyuan, emily

On 8/17/2015 10:49 PM, stone wrote:
> Hi Mery:
>
> I'm no more working on Thunderbird Solaris testing. Now there's some one
> else taking it instead of me. 

I don't see any new fuzz testing bug reports. And there is no one interesting CC on the bug report

Who is the new tester?
Can you put us in touch with her?

Comment 21

[Wayne Mery (:wsmwk)]

(not been able to reach Emily)

I got this from fengyuan...

    1. Download the "core dumps and my script" from the bug attachment.
    2a. unzip it, enter the "fuzz" folder which contains some 350 mails.
    2b. Or you can make some more random mails with the "mailfuzz.py" and "make_fuzz_mail.sh".
    3. Make sure that .eml files are being opened by Thunderbird by default.
    4. Select some 100 mails, press enter to open them all.
    5. Alt + F4 to close all Thunderbird windows.
    6. Select next 100 mails, repeat step 4 and 5.

For me, thunderbird often crash before 500th mail was opened in Ubuntu/Debian when I was still testing on this. But now I can't try this on Win10 since I can't press enter to open them while I select more than some 20 items. Maybe I should try the for loop with bash.

Comment 22

[amh]

thunderrbird crashes all the tiime .why is that ? how can i fix it?

Comment 23

[Wayne Mery (:wsmwk)]

(In reply to amh from comment #22)

thunderrbird crashes all the tiime .why is that ? how can i fix it?

amh,
What are you doing when it crashes?