thunderbird-bin crashed with SIGSEGV @morkWriter::PutRowDict

[Jane Silber]

Binary package hint: thunderbird

Thunderbird wasn't even the active window when it crashed. I assume it was doing a regular check for new mail when it crashed.

(I'm hoping that apport adds the log automatically to this bug report :) )

ProblemType: Crash
Architecture: i386
DistroRelease: Ubuntu 8.10
ExecutablePath: /usr/lib/thunderbird/thunderbird-bin
Package: thunderbird 2.0.0.17+nobinonly-0ubuntu1
ProcAttrCurrent: unconfined
ProcCmdline: /usr/lib/thunderbird/thunderbird-bin
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_GB.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: thunderbird
StacktraceTop:
 ?? () from /usr/lib/thunderbird/components/libmork.so
 ?? () from /usr/lib/thunderbird/components/libmork.so
 ?? () from /usr/lib/thunderbird/components/libmork.so
 ?? () from /usr/lib/thunderbird/components/libmork.so
 ?? () from /usr/lib/thunderbird/components/libmork.so
Title: thunderbird-bin crashed with SIGSEGV
Uname: Linux 2.6.27-6-generic i686
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev powerdev scanner video

[Apport retracing service (apport)]

StacktraceTop:morkWriter::PutRowDict (this=0xc75edb0, ev=0xc7db168, ioRow=0xbf06608) at morkWriter.cpp:1886
morkWriter::PutTableDict (this=0xc75edb0, ev=0xc7db168, ioTable=0xcdaceb0) at morkWriter.cpp:1455
morkWriter::WriteAllStoreTables (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:1106
morkWriter::OnStoreRowSpacesTables (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:1186
morkWriter::WriteMore (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:377

[Alexander Sack (asac)]

Forwarded from ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/thunderbird/+bug/279750 (reported against tbird 2.0.0.17).

#0 0xb7f80430 in __kernel_vsyscall ()
#1 0xb7dac4c0 in raise () from /lib/tls/i686/cmov/libpthread.so.0
#2 0x0805841e in nsProfileLock::FatalSignalHandler (signo=-1210368012) at nsProfileLock.cpp:206
 unblock_sigs = {__val = {1024, 0 <repeats 31 times>}}
 oldact = <value optimized out>
#3 <signal handler called>
#4 0xb262e151 in morkWriter::PutRowDict (this=0xc75edb0, ev=0xc7db168, ioRow=0xbf06608) at morkWriter.cpp:1886
 atom = (morkAtom *) 0x80
 stream = (class morkStream *) 0xcd43330
 yarn = {mYarn_Buf = 0x6d3a39, mYarn_Fill = 3216508232, mYarn_Size = 216129432, mYarn_More = 3216508284,
  mYarn_Form = 216113048, mYarn_Grow = 0xbfb8054c}
 buf = "(±}\f\n\025a²03Ô\fÈiÝ\f\220±}\fô\177c²]\031\207\f|Gß\fl\005¸¿#%a²8\031\207\f\224\005¸¿\000\000\000\000\002\000\000\000t\005¸¿$_'"
 end = (morkCell *) 0xbf05e88
 cells = (morkCell *) 0xbf05e18
#5 0xb262e51b in morkWriter::PutTableDict (this=0xc75edb0, ev=0xc7db168, ioTable=0xcdaceb0) at morkWriter.cpp:1455
 end = (morkRow **) 0xcf98d1c
 r = <value optimized out>
 fill = <value optimized out>
 rows = (morkRow **) 0xcf92a6c
 next = <value optimized out>
#6 0xb262f027 in morkWriter::WriteAllStoreTables (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:1106
 table = (class morkTable *) 0xcdaceb0
 space = (class morkRowSpace *) 0xc8718c8
 c = <value optimized out>
 store = <value optimized out>
#7 0xb262f0dd in morkWriter::OnStoreRowSpacesTables (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:1186
 stream = (class morkStream *) 0xbf05e18
#8 0xb262f279 in morkWriter::WriteMore (this=0xc75edb0, ev=0xc7db168) at morkWriter.cpp:377
No locals.
#9 0xb2629423 in morkThumb::DoMore_Commit (this=0xc75ec08, ev=0xc7db168) at morkThumb.cpp:514
 writer = (class morkWriter *) 0xc75edb0
#10 0xb262967f in morkThumb::DoMore (this=0xc75ec08, ev=0xc7db168, outTotal=0xbfb806f4, outCurrent=0xbfb806f8,
    outDone=0xbfb806ec "", outBroken=0xbfb806f0 "") at morkThumb.cpp:530
No locals.
#11 0xb26297c5 in morkThumb::DoMore (this=0xc75ec08, mev=0xc7db190, outTotal=0xbfb806f4, outCurrent=0xbfb806f8,
    outDone=0xbfb806ec "", outBroken=0xbfb806f0 "") at morkThumb.cpp:193
 outErr = <value optimized out>
 ev = (class morkEnv *) 0xc7db168
#12 0xb6e7cce8 in nsMsgDatabase::Commit (this=0xc517270, commitType=1) at nsMsgDatabase.cpp:1439
 outTotal = 13
 outCurrent = 0
 outDone = 0 '\0'
 outBroken = 0 '\0'
 err = 0
 commitThumb = (class nsIMdbThumb *) 0xc75ec30
 rv = <value optimized out>
 accountManager = {<nsCOMPtr_base> = {mRawPtr = 0xc55d238}, <No data fields>}
#13 0xb6e7c94e in nsMsgDatabase::DeleteHeader (this=0xc517270, msg=0xb689790, instigator=0x0, commit=1, notify=1)
    at nsMsgDatabase.cpp:1905
 key = 989
 flags = 9
 threadParent = 4294967295
 ret = 0
#14 0xb6e7c67e in nsMsgDatabase::DeleteMessages (this=0xc517270, nsMsgKeys=0xbfb80834, instigator=0x0)
    at nsMsgDatabase.cpp:1847
 key = 989
 msgHdr = {<nsCOMPtr_base> = {mRawPtr = 0xb689790}, <No data fields>}
 hasKey = 1
 err = <value optimized out>
 kindex = 0
#15 0xb6ebc522 in nsImapMailFolder::UpdateImapMailboxInfo (this=0xa083f88, aP...

[Alexander Sack (asac)]

posted to upstream tracker: https://bugzilla.mozilla.org/show_bug.cgi?id=466801

[Vseerror (vseerror)]

appears to be same as these 3.0b4 crashes
bp-d33752af-6824-4153-9726-def3b2091018
bp-80f14980-3cff-4b81-b440-1eaf22091021

[Vseerror (vseerror)]

comment 0 report states "Thunderbird wasn't even the active window when it crashed. I assume it was doing a regular check for new mail when it crashed."

bp-8e6635ce-ffa6-4519-865e-de9802091214 comment is "browsing imap folders"

[Vseerror (vseerror)]

#159 crash for v3.1.7.
related? to Bug 628381 - crash [@ morkWriter::PutTableDict(morkEnv*, morkTable*)] ... [@ nsMsgDatabase::Commit]

----------
line 1885

currently, majority of morkWriter::PutRowDict(morkEnv*, morkRow*) crashes are like
bp-11a6eda3-a291-4ba3-b17e-7ff5b2110121
EXCEPTION_ACCESS_VIOLATION_READ
0x60004
0
1 thunderbird.exe morkWriter::PutTableDict db/mork/src/morkWriter.cpp:1455
2 thunderbird.exe morkWriter::WriteAllStoreTables db/mork/src/morkWriter.cpp:1106
3 thunderbird.exe morkWriter::OnStoreRowSpacesTables db/mork/src/morkWriter.cpp:1186
4 thunderbird.exe morkWriter::WriteMore db/mork/src/morkWriter.cpp:377
5 thunderbird.exe morkThumb::DoMore_Commit db/mork/src/morkThumb.cpp:514
6 thunderbird.exe morkThumb::DoMore db/mork/src/morkThumb.cpp:408
7 thunderbird.exe morkThumb::DoMore db/mork/src/morkThumb.cpp:193
8 thunderbird.exe nsMsgDatabase::Commit mailnews/db/msgdb/src/nsMsgDatabase.cpp:1343
9 thunderbird.exe nsMailDatabase::SetSummaryValid mailnews/db/msgdb/src/nsMailDatabase.cpp:505
10 thunderbird.exe nsMailDatabase::EndBatch mailnews/db/msgdb/src/nsMailDatabase.cpp:164

-----
line 1886

bp-31561f8c-beff-45f8-8c67-50c43210120 (saunders) v3.1.6
0 thunderbird.exe morkWriter::PutRowDict db/mork/src/morkWriter.cpp:1886
1 thunderbird.exe morkWriter::PutTableDict db/mork/src/morkWriter.cpp:1455
2 thunderbird.exe morkWriter::WriteAllStoreTables db/mork/src/morkWriter.cpp:1106
3 thunderbird.exe morkWriter::OnStoreRowSpacesTables db/mork/src/morkWriter.cpp:1186
4 thunderbird.exe morkWriter::WriteMore db/mork/src/morkWriter.cpp:377
5 thunderbird.exe morkThumb::DoMore_Commit db/mork/src/morkThumb.cpp:514
6 thunderbird.exe morkThumb::DoMore db/mork/src/morkThumb.cpp:408
7 thunderbird.exe morkThumb::DoMore db/mork/src/morkThumb.cpp:193
8 thunderbird.exe nsMsgDatabase::Commit mailnews/db/msgdb/src/nsMsgDatabase.cpp:1343
9 thunderbird.exe nsMsgDBFolder::SetStringProperty mailnews/base/util/nsMsgDBFolder.cpp:2038
10 thunderbird.exe nsMsgDBFolder::SetMRUTime mailnews/base/util/nsMsgDBFolder.cpp:5629
11 thunderbird.exe nsMsgDBFolder::SetHasNewMessages mailnews/base/util/nsMsgDBFolder.cpp:525
12 thunderbird.exe nsMsgDBFolder::CheckWithNewMessagesStatus mailnews/base/util/nsMsgDBFolder.cpp:1042

bp-203a6c32-8836-4b72-a4b7-9d6822101010 Mac v3.1.5
bp-d0417ff8-8112-4465-860f-e11452110124 windows v3.1.7

[Vseerror (vseerror)]

@ morkWriter::PutRowDict for Mac and linux

[Acelists (acelists)]

Just got this in TB11.0.1:
bp-f6d6d67d-62c7-4496-aa13-663b02120519

And the conditions were the same as in comment 1.

After TB restart I found 3 copies of the same message (same UIDL from POP3 server) in 2 folders (one in Inbox, 2 in the folder where a filter would normally put them).

[Vseerror (vseerror)]

(In reply to :aceman from comment #5)
> Just got this in TB11.0.1:
> bp-f6d6d67d-62c7-4496-aa13-663b02120519
>
> And the conditions were the same as in comment 1.

do you mean comment 2?

freaky.

unfortunately I have no further info to offer. none of the crashes for all releases of last 4 months have any comments.

[Acelists (acelists)]

Yes, comment 2.
Other than this single crash, TB was stable for me for a long time (I do not remember any past crashes but I could look in about:crashes).

[Vseerror (vseerror)]

ranks as #1 mork crash

[Vseerror (vseerror)]

bp-4b752274-d8a5-4083-9003-086292130713
0 xul.dll morkWriter::PutRowDict db/mork/src/morkWriter.cpp:1854
1 xul.dll morkWriter::PutTableDict db/mork/src/morkWriter.cpp:1423
2 xul.dll morkWriter::WriteAllStoreTables db/mork/src/morkWriter.cpp:1074
3 xul.dll morkWriter::OnStoreRowSpacesTables db/mork/src/morkWriter.cpp:1154
4 xul.dll morkWriter::WriteMore db/mork/src/morkWriter.cpp:345
5 xul.dll morkThumb::DoMore_Commit db/mork/src/morkThumb.cpp:478
6 xul.dll morkThumb::DoMore db/mork/src/morkThumb.cpp:372
7 xul.dll morkThumb::DoMore db/mork/src/morkThumb.cpp:157
8 xul.dll nsMsgDatabase::Commit mailnews/db/msgdb/src/nsMsgDatabase.cpp:1588
9 xul.dll nsMsgDBFolder::SetStringProperty mailnews/base/util/nsMsgDBFolder.cpp:2192
10 xul.dll nsMsgDBFolder::SetMRUTime mailnews/base/util/nsMsgDBFolder.cpp:5726
11 xul.dll nsMsgDBFolder::SetHasNewMessages mailnews/base/util/nsMsgDBFolder.cpp:483
12 xul.dll nsMsgDBFolder::OnHdrAdded mailnews/base/util/nsMsgDBFolder.cpp:1067
13 xul.dll nsMsgDatabase::NotifyHdrAddedAll mailnews/db/msgdb/src/nsMsgDatabase.cpp:875
14 xul.dll nsMsgDatabase::AddNewHdrToDB mailnews/db/msgdb/src/nsMsgDatabase.cpp:3551
15 xul.dll nsParseNewMailState::PublishMsgHeader mailnews/local/src/nsParseMailbox.cpp:1915
16 xul.dll nsParseNewMailState::DoneParsingFolder mailnews/local/src/nsParseMailbox.cpp:1810
17 xul.dll nsMsgMailboxParser::OnStopRequest mailnews/local/src/nsParseMailbox.cpp:166
18 xul.dll nsMsgLocalMailFolder::AddMessageBatch mailnews/local/src/nsLocalMailFolder.cpp:3551
19 xul.dll nsMsgLocalMailFolder::AddMessage mailnews/local/src/nsLocalMailFolder.cpp:3486

matjk7@8377 1835 mork_bool
matjk7@8377 1836 morkWriter::PutRowDict(morkEnv* ev, morkRow* ioRow)
matjk7@8377 1837 {
matjk7@8377 1838 mWriter_RowForm = mWriter_TableForm;
matjk7@8377 1839
matjk7@8377 1840 morkCell* cells = ioRow->mRow_Cells;
matjk7@8377 1841 if ( cells )
matjk7@8377 1842 {
matjk7@8377 1843 morkStream* stream = mWriter_Stream;
matjk7@8377 1844 mdbYarn yarn; // to ref content inside atom
matjk7@8377 1845 char buf[ 64 ]; // buffer for staging the dict alias hex ID
matjk7@8377 1846 char* idBuf = buf + 1; // where the id always starts
matjk7@8377 1847 buf[ 0 ] = '('; // we always start with open paren
matjk7@8377 1848
matjk7@8377 1849 morkCell* end = cells + ioRow->mRow_Length;
matjk7@8377 1850 --cells; // prepare for preincrement:
matjk7@8377 1851 while ( ++cells < end && ev->Good() )
matjk7@8377 1852 {
matjk7@8377 1853 morkAtom* atom = cells->GetAtom();
matjk7@8377 1854 if ( atom && atom->IsAtomDirty() )

[Vseerror (vseerror)]

With bug 1572000 and addressbook rewrite coming, no mork crashes ranking above #160, and no one wanting to touch Mork code, it's safe to say that no one is going to fix any currently reported mork crash. Thus => wontfix (and we don't have to see these rare crashes as open bugs anymore)