Crash with glibc invalid next size (fast)

[Dean Loros]

Current Thunderbird 2 in Intrepid crashes when picking up new messages. App needs to be force-quit.
Terminal output:

dean1@linux:~/Desktop$ thunderbird
*** glibc detected *** /usr/lib/thunderbird/thunderbird-bin: free(): invalid next size (fast): 0x09f70828 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb7464394]
/lib/tls/i686/cmov/libc.so.6(cfree+0x96)[0xb74663f6]
/usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0xb761a001]
/usr/lib/libstdc++.so.6(_ZdaPv+0x1d)[0xb761a05d]
/usr/lib/thunderbird/components/libwidget_gtk2.so[0xb6327c31]
/usr/lib/thunderbird/components/libwidget_gtk2.so[0xb6334dc9]
/usr/lib/thunderbird/libxpcom_core.so(_ZN13nsCOMPtr_base18assign_with_AddRefEP11nsISupports+0x2c)[0xb7e5586c]
/usr/lib/thunderbird/components/libnsappshell.so[0xb5957ba8]
/usr/lib/thunderbird/components/libnsappshell.so[0xb595c503]
/usr/lib/thunderbird/components/libnsappshell.so[0xb594d9f4]
/usr/lib/thunderbird/components/libgklayout.so[0xb5661caf]
/usr/lib/thunderbird/libxpcom_core.so(PL_HandleEvent+0x27)[0xb7e9f8d7]
/usr/lib/thunderbird/libxpcom_core.so(PL_ProcessPendingEvents+0x5b)[0xb7e9fbdb]
/usr/lib/thunderbird/libxpcom_core.so[0xb7ea17d8]
/usr/lib/thunderbird/components/libwidget_gtk2.so[0xb6329725]
/usr/lib/libglib-2.0.so.0[0xb77db4bd]
/usr/lib/libglib-2.0.so.0(g_main_context_dispatch+0x1e8)[0xb77a45e8]
/usr/lib/libglib-2.0.so.0[0xb77a7c93]
/usr/lib/libglib-2.0.so.0(g_main_loop_run+0x1d2)[0xb77a81b2]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main+0xb9)[0xb7b24e99]
/usr/lib/thunderbird/components/libwidget_gtk2.so[0xb6329d86]
/usr/lib/thunderbird/components/libtoolkitcomps.so[0xb622d237]
/usr/lib/thunderbird/thunderbird-bin[0x804fc1a]
/usr/lib/thunderbird/thunderbird-bin[0x804ac9f]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb740b685]
/usr/lib/thunderbird/thunderbird-bin[0x804abc1]
======= Memory map: ========
08048000-0805a000 r-xp 00000000 08:22 4227086 /usr/lib/thunderbird/thunderbird-bin
0805a000-0805b000 rw-p 00012000 08:22 4227086 /usr/lib/thunderbird/thunderbird-bin
0805b000-0805c000 rw-p 0805b000 00:00 0
08f62000-0a1b3000 rw-p 08f62000 00:00 0 [heap]
b0dfc000-b11fd000 rw-p b0dfc000 00:00 0
b13fe000-b15ff000 rw-p b13fe000 00:00 0
b1700000-b172b000 rw-p b1700000 00:00 0
b172b000-b1800000 ---p b172b000 00:00 0
b1900000-b19fe000 rw-p b1900000 00:00 0
b19fe000-b1a00000 ---p b19fe000 00:00 0
b1a25000-b1a2a000 r-xp 00000000 08:22 1722572 /usr/lib/thunderbird/components/libxpcom_compat_c.so
b1a2a000-b1a2b000 rw-p 00005000 08:22 1722572 /usr/lib/thunderbird/components/libxpcom_compat_c.so
b1a2b000-b1a46000 r-xp 00000000 08:22 1722763 /usr/lib/thunderbird/components/libwallet.so
b1a46000-b1a47000 rw-p 0001b000 08:22 1722763 /usr/lib/thunderbird/components/libwallet.so
b1a47000-b1a4d000 r-xp 00000000 08:22 1722760 /usr/lib/thunderbird/components/libmsgsmime.so
b1a4d000-b1a4e000 rw-p 00006000 08:22 1722760 /usr/lib/thunderbird/components/libmsgsmime.so
b1a4e000-b1a82000 r-xp 00000000 08:22 1722585 /usr/lib/thunderbird/components/libmork.so
b1a82000-b1a85000 rw-p 00033000 08:22 1722585 /usr/lib/thunderbird/components/libmork.so
b1a85000-b1a89000 r-xp 00000000 08:22 4415656 /lib/tls/i686/cmov/libnss_dns-2.8.90.so
b1a89000-b1a8a000 r--p 00003000 08:22 4415656 /lib/tls/i686/cmov/libnss_dns-2.8.90.so
b1a8a000-b1a8b000 rw-p 00004000 08:22 4415656 /lib/tls/i686/cmov/libnss_dns-2.8.90.so
b1a8b000-b1a8d000 r-xp 00000000 08:22 4416742 /lib/libnss_mdns4_minimal.so.2
b1a8d000-b1a8e000 rw-p 00001000 08:22 4416742 /lib/libnss_mdns4_minimal.so.2
b1a91000-b1aa4000 r-xp 00000000 08:22 1722785 /usr/lib/thunderbird/components/libmailcomps.so
b1aa4000-b1aa5000 rw-p 00012000 08:22 1722785 /usr/lib/thunderbird/components/libmailcomps.so
b1aa5000-b1aa6000 ---p b1aa5000 00:00 0
b1aa6000-b22a6000 rw-p b1aa6000 00:00 0
b22a6000-b22a7000 ---p b22a6000 00:00 0
b22a7000-b2bab000 rw-p b22a7000 00:00 0
b2bab000-b2c32000 r--p 00000000 08:22 254563 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans-Bold.ttf
b2c32000-b2d36000 rw-p b2c32000 00:00 0
b2d36000-b2dc7000 r--p 00000000 08:22 254420 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
b2dc7000-b2dd9000 r-xp 00000000 08:22 1722683 Killed

[cdmdotnet (cdmdotnet)]

I also get a similar but somewhat different error:

*** glibc detected *** /usr/lib/thunderbird/thunderbird-bin: free(): invalid next size (fast): 0x0000000003782f10 ***
======= Backtrace: =========
/lib/libc.so.6[0x7fdc7d989cb8]
/lib/libc.so.6(cfree+0x76)[0x7fdc7d98c276]
/usr/lib/thunderbird/components/libmail.so[0x7fdc75d0bc5b]
/usr/lib/thunderbird/components/libmail.so[0x7fdc75b9c220]
/usr/lib/thunderbird/libnspr4.so[0x7fdc811a8cb3]
/lib/libpthread.so.0[0x7fdc80f693ba]
/lib/libc.so.6(clone+0x6d)[0x7fdc7d9f7fcd]
======= Memory map: ========
00400000-00415000 r-xp 00000000 09:01 3245998 /usr/lib/thunderbird/thunderbird-bin
00615000-00616000 r--p 00015000 09:01 3245998 /usr/lib/thunderbird/thunderbird-bin
00616000-00617000 rw-p 00016000 09:01 3245998 /usr/lib/thunderbird/thunderbird-bin
0098d000-07890000 rw-p 0098d000 00:00 0 [heap]
7fdc40000000-7fdc40414000 rw-p 7fdc40000000 00:00 0
7fdc40414000-7fdc44000000 ---p 7fdc40414000 00:00 0
7fdc45945000-7fdc45946000 ---p 7fdc45945000 00:00 0
7fdc45946000-7fdc46146000 rw-p 7fdc45946000 00:00 0
7fdc46146000-7fdc46147000 ---p 7fdc46146000 00:00 0
7fdc46147000-7fdc46947000 rw-p 7fdc46147000 00:00 0
7fdc46947000-7fdc46948000 ---p 7fdc46947000 00:00 0
7fdc46948000-7fdc47148000 rw-p 7fdc46948000 00:00 0
7fdc47148000-7fdc4716b000 r--p 00000000 09:01 3088522 /usr/share/fonts/truetype/msttcorefonts/Verdana.ttf
7fdc4716b000-7fdc471b1000 r--p 00000000 09:01 3088504 /usr/share/fonts/truetype/msttcorefonts/Arial_Bold.ttf
7fdc471b1000-7fdc471f5000 r--p 00000000 09:01 3088506 /usr/share/fonts/truetype/msttcorefonts/Arial.ttf
7fdc471f5000-7fdc471f6000 ---p 7fdc471f5000 00:00 0
7fdc471f6000-7fdc479f7000 rw-p 7fdc471f6000 00:00 0
7fdc479f7000-7fdc479f8000 ---p 7fdc479f7000 00:00 0
7fdc479f8000-7fdc481f8000 rw-p 7fdc479f8000 00:00 0
7fdc481f8000-7fdc481f9000 ---p 7fdc481f8000 00:00 0
7fdc481f9000-7fdc490f6000 rw-p 7fdc481f9000 00:00 0
7fdc497f3000-7fdc497f4000 ---p 7fdc497f3000 00:00 0
7fdc497f4000-7fdc49ff4000 rw-p 7fdc497f4000 00:00 0
7fdc49ff4000-7fdc49ff5000 ---p 7fdc49ff4000 00:00 0
7fdc49ff5000-7fdc4a7f5000 rw-p 7fdc49ff5000 00:00 0
7fdc4a7f5000-7fdc4a7f6000 ---p 7fdc4a7f5000 00:00 0
7fdc4a7f6000-7fdc4aff6000 rw-p 7fdc4a7f6000 00:00 0
7fdc4aff6000-7fdc4aff7000 ---p 7fdc4aff6000 00:00 0
7fdc4aff7000-7fdc4b7f7000 rw-p 7fdc4aff7000 00:00 0
7fdc4b7f7000-7fdc4b7f8000 ---p 7fdc4b7f7000 00:00 0
7fdc4b7f8000-7fdc4bff8000 rw-p 7fdc4b7f8000 00:00 0
7fdc4bff8000-7fdc4bff9000 ---p 7fdc4bff8000 00:00 0
7fdc4bff9000-7fdc4c7f9000 rw-p 7fdc4bff9000 00:00 0
7fdc4c7f9000-7fdc4c7fa000 ---p 7fdc4c7f9000 00:00 0
7fdc4c7fa000-7fdc4cffa000 rw-p 7fdc4c7fa000 00:00 0
7fdc4cffa000-7fdc4cffb000 ---p 7fdc4cffa000 00:00 0
7fdc4cffb000-7fdc4d7fb000 rw-p 7fdc4cffb000 00:00 0
7fdc4d7fb000-7fdc4d7fc000 ---p 7fdc4d7fb000 00:00 0
7fdc4d7fc000-7fdc4dffc000 rw-p 7fdc4d7fc000 00:00 0
7fdc4dffc000-7fdc4dffd000 ---p 7fdc4dffc000 00:00 0
7fdc4dffd000-7fdc4e7fd000 rw-p 7fdc4dffd000 00:00 0
7fdc4e7fd000-7fdc4e7fe000 ---p 7fdc4e7fd000 00:00 0
7fdc4e7fe...

[fastfret79 (markfoxwell)]

Just to say that I had a very similar error with the same first line:

*** glibc detected *** /usr/lib/thunderbird/thunderbird-bin: free(): invalid next size (fast):

I found that the problem was caused by the Tango Icons Theme - once I uninstalled it received emails perfectly without freezing/crashing

[Przemek K. (azrael)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. We are sorry that we do not always have the capacity to look at all reported bugs in a timely manner.
There have been many changes in Ubuntu since that time you reported the bug and your problem may have been fixed with some of the updates. It would help us a lot if you could test the current Ubuntu development version (10.04). If you can test it, and it is still an issue, we would appreciate if you could upload updated logs by running apport-collect 248175, and any other logs that are relevant for this particular issue.

[Przemek K. (azrael)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future.
To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New".
If you decide to reopen this bug, it would help us a lot if you could test the current Ubuntu development version (10.10) and check if this bug is still relevant.
Thanks again!