Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Package: thunderbird Version: 1.5.0.7-1 Severity: important Thunderbird crashes very often (every hour) while checking mail (on a POP3 account). A gdb backtrace follows. -- Gdb Backtrace: (gdb) bt #0 0xb75cbc80 in free () from /lib/tls/i686/cmov/libc.so.6 #1 0xb75cd83f in malloc () from /lib/tls/i686/cmov/libc.so.6 #2 0xb7e38495 in PL_strdup () from /usr/lib/thunderbird/libplc4.so #3 0xb5403001 in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #4 0xb5407f07 in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #5 0xb540b18e in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #6 0xb537b6de in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #7 0xb730a1d1 in NSGetModule () from /usr/lib/thunderbird/components/libnecko.so #8 0xb730a32f in NSGetModule () from /usr/lib/thunderbird/components/libnecko.so #9 0xb7e9659c in NS_AsyncCopy () from /usr/lib/thunderbird/libxpcom_core.so #10 0xb7eaae87 in PL_HandleEvent () from /usr/lib/thunderbird/libxpcom_core.so #11 0xb7eab199 in PL_ProcessPendingEvents () from /usr/lib/thunderbird/libxpcom_core.so #12 0xb7ead01e in nsAutoMonitor::NewMonitor () from /usr/lib/thunderbird/libxpcom_core.so #13 0xb696dea5 in ?? () from /usr/lib/thunderbird/components/libwidget_gtk2.so #14 0x080c1740 in ?? () #15 0x083dec20 in ?? () #16 0xbff95a58 in ?? () #17 0xb77fad1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #18 0xb77fad1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #19 0xb77d17b1 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #20 0xb77d4826 in g_main_context_check () from /usr/lib/libglib-2.0.so.0 #21 0xb77d4be7 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #22 0xb7c19141 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 #23 0xb696e2f2 in ?? () from /usr/lib/thunderbird/components/libwidget_gtk2.so #24 0x0813d8a8 in ?? () #25 0xb6832278 in ?? () from /usr/lib/thunderbird/components/libnsappshell.so #26 0xbff95bb8 in ?? () #27 0x08057f8c in _IO_stdin_used () #28 0x0805980c in ?? () #29 0x0813d868 in ?? () #30 0xbff95bc8 in ?? () #31 0xb692dd80 in NSGetModule () from /usr/lib/thunderbird/components/libtoolkitcomps.so #32 0xb692dd80 in NSGetModule () from /usr/lib/thunderbird/components/libtoolkitcomps.so #33 0x0804e66a in ?? () #34 0x0813d868 in ?? () #35 0x080573a8 in _IO_stdin_used () #36 0x in ?? () -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.15-1-686 Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15) Versions of packages thunderbird depends on: ii debconf [debconf-2.0] 1.5.4Debian configuration management sy ii libatk1.0-0 1.12.2-1 The ATK accessibility toolkit ii libc6 2.3.6.ds1-4 GNU C Library: Shared libraries ii libcairo2 1.2.4-1 The Cairo 2D vector graphics libra ii libfontconfig1 2.4.1-2 generic font configuration library ii libgcc1 1:4.1.1-13 GCC support library ii libglib2.0-02.12.3-2 The GLib library of C routines ii libgtk2.0-0 2.8.20-1 The GTK+ graphical user interface ii libjpeg62 6b-13The Independent JPEG Group's JPEG ii libpango1.0-0 1.12.4-1 Layout and rendering of internatio ii libpng12-0 1.2.8rel-5.2 PNG library - runtime ii libstdc++6 4.1.1-13 The GNU Standard C++ Library v3 ii libx11-62:1.0.0-9X11 client-side library ii libxcursor1 1.1.7-4 X cursor management library ii libxext61:1.0.1-2X11 miscellaneous extension librar ii libxfixes3 1:4.0.1-4X11 miscellaneous 'fixes' extensio ii libxft2 2.1.8.2-8FreeType-based font drawing librar ii libxi6 1:1.0.1-3X11 Input extension library ii libxinerama11:1.0.1-4.1 X11 Xinerama extension library ii libxrandr2 2:1.1.0.2-4 X11 RandR extension library ii libxrender1 1:0.9.1-3X Rendering Extension client libra ii libxt6 1:1.0.2-2X11 toolkit intrinsics library ii myspell-fr [myspell-diction 1.4-20 The French dictionary for myspell ii zlib1g 1:1.2.3-13 compression library - runtime thunderbird recommends no packages. -- debconf information: * thunderbird/browser: Debian -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Fri, Sep 29, 2006 at 11:59:05PM +0200, Nicolas Bonifas wrote: > Package: thunderbird > Version: 1.5.0.7-1 > Severity: important > > Thunderbird crashes very often (every hour) while checking mail (on a POP3 > account). A gdb backtrace follows. Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg package installed? - Alexander p.s. please take care that the bug is listed as To: or CC: when replying to this mail (e.g. /reply-all/). -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Thunderbird crashes very often (every hour) while checking mail (on a POP3 account). A gdb backtrace follows. Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg package installed? Here is the gdb backtrace with thunderbird 1.5.0.7-2. Please note that my POP3 account contains approximately 2000 mails. Regards, Nicolas Program received signal SIGABRT, Aborted. [Switching to Thread -1220401472 (LWP 13738)] 0xe410 in __kernel_vsyscall () (gdb) bt #0 0xe410 in __kernel_vsyscall () #1 0xb754c821 in raise () from /lib/tls/i686/cmov/libc.so.6 #2 0xb754dfb9 in abort () from /lib/tls/i686/cmov/libc.so.6 #3 0xb7581c4a in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6 #4 0xb75893ec in mallopt () from /lib/tls/i686/cmov/libc.so.6 #5 0xb7589582 in free () from /lib/tls/i686/cmov/libc.so.6 #6 0xb7dd608f in PR_Free (ptr=0x0) at prmem.c:490 #7 0xb53a7d42 in nsPop3Protocol::FreeMsgInfo (this=0x8895be0) at nsPop3Protocol.cpp:923 #8 0xb53a884a in ~nsPop3Protocol (this=0x8895be0) at nsPop3Protocol.cpp:626 #9 0xb531f11c in nsMsgProtocol::Release (this=0x8895be0) at nsMsgProtocol.cpp:70 #10 0xb53a829d in nsPop3Protocol::Release (this=0x8895be0) at nsPop3Protocol.cpp:503 #11 0xb7e22e5c in nsCOMPtr_base::assign_with_AddRef (this=0x87c4cd4, rawPtr=0x0) at ./../glue/nsCOMPtr.h:531 #12 0xb72c19af in nsInputStreamPump::OnStateStop (this=0x87c4cc0) at ../../../dist/include/xpcom/nsCOMPtr.h:713 #13 0xb72c2368 in nsInputStreamPump::OnInputStreamReady (this=0x87c4cc0, stream=0x8b58370) at nsInputStreamPump.cpp:343 #14 0xb7e557cc in nsInputStreamReadyEvent::EventHandler (plevent=0x8b17fac) at nsStreamUtils.cpp:119 #15 0xb7e6a0d7 in PL_HandleEvent (self=0x8b17fac) at plevent.c:688 ---Type to continue, or q to quit--- #16 0xb7e6a3e9 in PL_ProcessPendingEvents (self=0x80c1778) at plevent.c:623 #17 0xb7e6c26e in nsEventQueueImpl::ProcessPendingEvents (this=0x80c1740) at nsEventQueue.cpp:417 #18 0xb6925ea5 in event_processor_callback (source=0x81a3168, condition=G_IO_IN, data=0x6) at nsAppShell.cpp:67 #19 0xb77b8d1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #20 0xb778f7b1 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #21 0xb7792826 in g_main_context_check () from /usr/lib/libglib-2.0.so.0 #22 0xb7792be7 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #23 0xb7bd8141 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 #24 0xb69262f2 in nsAppShell::Run (this=0x813d8a8) at nsAppShell.cpp:139 #25 0xb68e5d80 in nsAppStartup::Run (this=0x813d868) at nsAppStartup.cpp:150 #26 0x0804e69a in XRE_main (argc=1, argv=0xbfc574d4, aAppData=0x8059020) at nsAppRunner.cpp:2374 #27 0x0804abdf in main (argc=Cannot access memory at address 0x35aa ) at nsMailApp.cpp:62 #28 0xb7538ea8 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6 #29 0x0804ab11 in _start () at ../sysdeps/i386/elf/start.S:119 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Sat, Sep 30, 2006 at 09:47:43AM +0200, Nicolas Bonifas wrote: > >>Thunderbird crashes very often (every hour) while checking mail (on a > >>POP3 account). A gdb backtrace follows. > > > >Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg > >package installed? > > Here is the gdb backtrace with thunderbird 1.5.0.7-2. Please note that > my POP3 account contains approximately 2000 mails. > Regards, > Nicolas Sorry for the delay ... can you still reproduce this crash? - Alexander p.s. please take care that the bug is listed as To: or CC: when replying to this mail (e.g. /reply-all/). -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Sorry for the delay ... can you still reproduce this crash? Yes, I can. But I have new informations: the pop3 server I used was buggy: it sent twice some lines in the answer to the UIDL command. In the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at each line of the UIDL answer. As this bug is due to a grave bug in the server, I don't know if you will want to correct it. If you want to do so, it is an easy thing: As m_pop3ConData is initialized to 0 by PR_NEWZAP, changing if (token) { msg_num = atol(token); m_listpos++; if(m_listpos <= m_pop3ConData->number_of_messages && m_listpos > 0) { token = nsCRT::strtok(newStr, " ", &newStr); if (token) { m_pop3ConData->msg_info[m_listpos-1].size = atol(token); m_pop3ConData->msg_info[m_listpos-1].msgnum = msg_num; } } } into if (token) { msg_num = atol(token); if(!m_pop3ConData->msg_info[m_listpos-1].msgnum) { m_listpos++; if(m_listpos <= m_pop3ConData->number_of_messages && m_listpos > 0) { token = nsCRT::strtok(newStr, " ", &newStr); if (token) { m_pop3ConData->msg_info[m_listpos-1].size = atol(token); m_pop3ConData->msg_info[m_listpos-1].msgnum = msg_num; } } } } would solve the problem. Regards, Nicolas -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Tue, Dec 19, 2006 at 06:18:32PM +0100, Nicolas Bonifas wrote: > >Sorry for the delay ... can you still reproduce this crash? > > Yes, I can. But I have new informations: the pop3 server I used was > buggy: it sent twice some lines in the answer to the UIDL command. In > the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at > each line of the UIDL answer. > As this bug is due to a grave bug in the server, I don't know if you > will want to correct it. If you want to do so, it is an easy thing: We want to investigate for sure. > > As m_pop3ConData is initialized to 0 by PR_NEWZAP, changing I don't understand how your fix prevents the NULL dereference if m_pop3ConData == NULL? You still do if(!m_pop3ConData->msg_info[m_listpos-1].msgnum) in your fix. BTW, can you still reproduce the jsgc memory stack? - Alexander -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Tue, Dec 19, 2006 at 06:18:32PM +0100, Nicolas Bonifas wrote: > >Sorry for the delay ... can you still reproduce this crash? > > Yes, I can. But I have new informations: the pop3 server I used was > buggy: it sent twice some lines in the answer to the UIDL command. In > the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at > each line of the UIDL answer. > As this bug is due to a grave bug in the server, I don't know if you > will want to correct it. If you want to do so, it is an easy thing: Ah ... and attach a bt full from the first bt you submitted. Thanks, - Alexander -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Hello, You still do if(!m_pop3ConData->msg_info[m_listpos-1].msgnum) in your fix. Yes, you are right. My fix does not work. Anyway, the problem comes from m_listpos being incremented at each line of the answer to the UIDL command. BTW, can you still reproduce the jsgc memory stack? I did not manage to reproduce it today (I tried a few times), but it does not necessarily means that it is corrected: the crash occurred at several points. Ah ... and attach a bt full from the first bt you submitted. Here is a full backtrace from Icedove 1.5.0.9.dfsg1-1: #0 0xb7521cc0 in free () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #1 0xb752387f in malloc () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #2 0xb7db9495 in PL_strdup (s=0x8975798 "112695870š^·4491") at strdup.c:53 n = 17 #3 0xb521e0b1 in put_hash (table=0x89757b0, key=0x8a58ef0 "1126958738.14354", value=, dateReceived=1166983101) at nsPop3Protocol.cpp:166 No locals. #4 0xb5222d6f in nsPop3Protocol::GetMsg (this=0x892e410) at nsPop3Protocol.cpp:2746 rv = mailboxSpaceLeft = folder = { = {mRawPtr = 0x89f515d}, fields>} path = { = {mRawPtr = 0x897842c}, } c = i = 1884 prefBool = 0 popstateTimestamp = 1166983101 #5 0xb522626e in nsPop3Protocol::ProcessProtocolState (this=0x892e410, url=0x897842c, aInputStream=0x8a5e1c0, sourceOffset=65133, aLength=2356) at nsPop3Protocol.cpp:3786 prefBool = -1222916272 status = 0 mailnewsurl = { = {mRawPtr = 0x897842c}, data fields>} #6 0xb519670e in nsMsgProtocol::OnDataAvailable (this=0x892e410, request=0x89f85d8, ctxt=0x897842c, inStr=0x8a5e1c0, sourceOffset=65133, count=2356) at nsMsgProtocol.cpp:350 uri = { = {mRawPtr = 0x897842c}, } #7 0xb71481d1 in nsInputStreamPump::OnStateTransfer (this=0x89f85d8) at nsInputStreamPump.cpp:437 offsetBefore = seekable = { = {mRawPtr = 0x8a5e1c4}, fields>} rv = avail = 2356 #8 0xb714832f in nsInputStreamPump::OnInputStreamReady (this=0x89f85d8, stream=0x8a5e1c0) at nsInputStreamPump.cpp:340 nextState = 926430520 #9 0xb7e177cc in nsInputStreamReadyEvent::EventHandler (plevent=0x87e7efc) at nsStreamUtils.cpp:119 ev = #10 0xb7e2c0d7 in PL_HandleEvent (self=0x87e7efc) at plevent.c:688 result = #11 0xb7e2c3e9 in PL_ProcessPendingEvents (self=0x89d83e0) at plevent.c:623 event = (PLEvent *) 0x31393434 count = 2 #12 0xb7e2e26e in nsEventQueueImpl::ProcessPendingEvents (this=0x8967768) at nsEventQueue.cpp:417 correctThread = #13 0xb67aaf75 in event_processor_callback (source=0x842a008, condition=G_IO_IN, data=0x37383538) at nsAppShell.cpp:67 No locals. #14 0xb7756c7f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #15 0xb772d731 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #16 0xb77307a6 in g_main_context_check () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #17 0xb7730d27 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0 No symbol table info available. #18 0xb67ab416 in nsAppShell::DispatchNativeEvent (this=0x8a0bcc8, aRealEvent=0, aEvent=0x0) at nsAppShell.cpp:274 No locals. #19 0xb60e538c in nsXULWindow::ShowModal (this=0xb7d67000) at nsXULWindow.cpp:404 data = (void *) 0x0 isRealEvent = 0 processEvent = 1 cx = (JSContext *) 0xbf81916c appShell = { = {mRawPtr = 0x8a0bcc8}, fields>} window = { = {mRawPtr = 0x89904d0}, fields>} tempRef = { = {mRawPtr = 0x8936858}, fields>} appShellService = { = {mRawPtr = 0x81e6c38}, data fields>} stack = { = {mRawPtr = 0x8107ed8}, } rv = 134698472 #20 0xb60e0f87 in nsContentTreeOwner::ShowAsModal (this=0x864ba18) at nsContentTreeOwner.cpp:430 No locals. #21 0xb66dc228 in nsWindowWatcher::OpenWindowJS (this=0x813c478, aParent=0x831cd88, aUrl=0xb66f8ea0 "chrome://global/content/commonDialog.xul", aName=0xb66f89c0 "_blank", aFeatures=0xb66f8d54 "centerscreen,chrome,modal,titlebar", aDialog=1, argc=1, argv=0x8994848, _retval=0xbf819260) at nsWindowWatcher.cpp:824 newTreeOwner = { = {mRawPtr = 0x8960678}, data fields>} newChrome = { = {mRawPtr = 0x864ba24}, fields>} rv = nameSpecified = 1 featuresSpecified = 1 windowIsNew = 1 windowIsModal = 1 uriToLoadIsChrome = 1 chromeFlags = 4160750598 name = { = { = { = { = {mVTable = 0xb7e61ce8, mData = 0xbf81903c, mLength = 6, mFlags = 65553}, }, }, mFixedCapacity = 63, mFixedBuf = 0xbf81903c}, mStorage = {95, 98, 108, 97, 110, 107, 0, 49025, 17284, 47070, 37184, 49025, 7808, 2057, 36416, 46703, 21836, 47067, 9688, 47078, 42232, 46942, 18472, 2201, 107, 0, 3672, 2207, 72, 0, 12, 0, 37000, 49025, 62977, 46672, 52616, 2
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Hello, Any progress on this bug? Please tell me if you need further informations. Thanks, Nicolas -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]