Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Package: thunderbird Version: 1.5.0.7-1 Severity: important Thunderbird crashes very often (every hour) while checking mail (on a POP3 account). A gdb backtrace follows. -- Gdb Backtrace: (gdb) bt #0 0xb75cbc80 in free () from /lib/tls/i686/cmov/libc.so.6 #1 0xb75cd83f in malloc () from /lib/tls/i686/cmov/libc.so.6 #2 0xb7e38495 in PL_strdup () from /usr/lib/thunderbird/libplc4.so #3 0xb5403001 in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #4 0xb5407f07 in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #5 0xb540b18e in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #6 0xb537b6de in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #7 0xb730a1d1 in NSGetModule () from /usr/lib/thunderbird/components/libnecko.so #8 0xb730a32f in NSGetModule () from /usr/lib/thunderbird/components/libnecko.so #9 0xb7e9659c in NS_AsyncCopy () from /usr/lib/thunderbird/libxpcom_core.so #10 0xb7eaae87 in PL_HandleEvent () from /usr/lib/thunderbird/libxpcom_core.so #11 0xb7eab199 in PL_ProcessPendingEvents () from /usr/lib/thunderbird/libxpcom_core.so #12 0xb7ead01e in nsAutoMonitor::NewMonitor () from /usr/lib/thunderbird/libxpcom_core.so #13 0xb696dea5 in ?? () from /usr/lib/thunderbird/components/libwidget_gtk2.so #14 0x080c1740 in ?? () #15 0x083dec20 in ?? () #16 0xbff95a58 in ?? () #17 0xb77fad1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #18 0xb77fad1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #19 0xb77d17b1 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #20 0xb77d4826 in g_main_context_check () from /usr/lib/libglib-2.0.so.0 #21 0xb77d4be7 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #22 0xb7c19141 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 #23 0xb696e2f2 in ?? () from /usr/lib/thunderbird/components/libwidget_gtk2.so #24 0x0813d8a8 in ?? () #25 0xb6832278 in ?? () from /usr/lib/thunderbird/components/libnsappshell.so #26 0xbff95bb8 in ?? () #27 0x08057f8c in _IO_stdin_used () #28 0x0805980c in ?? () #29 0x0813d868 in ?? () #30 0xbff95bc8 in ?? () #31 0xb692dd80 in NSGetModule () from /usr/lib/thunderbird/components/libtoolkitcomps.so #32 0xb692dd80 in NSGetModule () from /usr/lib/thunderbird/components/libtoolkitcomps.so #33 0x0804e66a in ?? () #34 0x0813d868 in ?? () #35 0x080573a8 in _IO_stdin_used () #36 0x in ?? () -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.15-1-686 Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15) Versions of packages thunderbird depends on: ii debconf [debconf-2.0] 1.5.4Debian configuration management sy ii libatk1.0-0 1.12.2-1 The ATK accessibility toolkit ii libc6 2.3.6.ds1-4 GNU C Library: Shared libraries ii libcairo2 1.2.4-1 The Cairo 2D vector graphics libra ii libfontconfig1 2.4.1-2 generic font configuration library ii libgcc1 1:4.1.1-13 GCC support library ii libglib2.0-02.12.3-2 The GLib library of C routines ii libgtk2.0-0 2.8.20-1 The GTK+ graphical user interface ii libjpeg62 6b-13The Independent JPEG Group's JPEG ii libpango1.0-0 1.12.4-1 Layout and rendering of internatio ii libpng12-0 1.2.8rel-5.2 PNG library - runtime ii libstdc++6 4.1.1-13 The GNU Standard C++ Library v3 ii libx11-62:1.0.0-9X11 client-side library ii libxcursor1 1.1.7-4 X cursor management library ii libxext61:1.0.1-2X11 miscellaneous extension librar ii libxfixes3 1:4.0.1-4X11 miscellaneous 'fixes' extensio ii libxft2 2.1.8.2-8FreeType-based font drawing librar ii libxi6 1:1.0.1-3X11 Input extension library ii libxinerama11:1.0.1-4.1 X11 Xinerama extension library ii libxrandr2 2:1.1.0.2-4 X11 RandR extension library ii libxrender1 1:0.9.1-3X Rendering Extension client libra ii libxt6 1:1.0.2-2X11 toolkit intrinsics library ii myspell-fr [myspell-diction 1.4-20 The French dictionary for myspell ii zlib1g 1:1.2.3-13 compression library - runtime thunderbird recommends no packages. -- debconf information: * thunderbird/browser: Debian -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Fri, Sep 29, 2006 at 11:59:05PM +0200, Nicolas Bonifas wrote: > Package: thunderbird > Version: 1.5.0.7-1 > Severity: important > > Thunderbird crashes very often (every hour) while checking mail (on a POP3 > account). A gdb backtrace follows. Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg package installed? - Alexander p.s. please take care that the bug is listed as To: or CC: when replying to this mail (e.g. /reply-all/). -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Thunderbird crashes very often (every hour) while checking mail (on a POP3 account). A gdb backtrace follows. Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg package installed? Here is the gdb backtrace with thunderbird 1.5.0.7-2. Please note that my POP3 account contains approximately 2000 mails. Regards, Nicolas Program received signal SIGABRT, Aborted. [Switching to Thread -1220401472 (LWP 13738)] 0xe410 in __kernel_vsyscall () (gdb) bt #0 0xe410 in __kernel_vsyscall () #1 0xb754c821 in raise () from /lib/tls/i686/cmov/libc.so.6 #2 0xb754dfb9 in abort () from /lib/tls/i686/cmov/libc.so.6 #3 0xb7581c4a in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6 #4 0xb75893ec in mallopt () from /lib/tls/i686/cmov/libc.so.6 #5 0xb7589582 in free () from /lib/tls/i686/cmov/libc.so.6 #6 0xb7dd608f in PR_Free (ptr=0x0) at prmem.c:490 #7 0xb53a7d42 in nsPop3Protocol::FreeMsgInfo (this=0x8895be0) at nsPop3Protocol.cpp:923 #8 0xb53a884a in ~nsPop3Protocol (this=0x8895be0) at nsPop3Protocol.cpp:626 #9 0xb531f11c in nsMsgProtocol::Release (this=0x8895be0) at nsMsgProtocol.cpp:70 #10 0xb53a829d in nsPop3Protocol::Release (this=0x8895be0) at nsPop3Protocol.cpp:503 #11 0xb7e22e5c in nsCOMPtr_base::assign_with_AddRef (this=0x87c4cd4, rawPtr=0x0) at ./../glue/nsCOMPtr.h:531 #12 0xb72c19af in nsInputStreamPump::OnStateStop (this=0x87c4cc0) at ../../../dist/include/xpcom/nsCOMPtr.h:713 #13 0xb72c2368 in nsInputStreamPump::OnInputStreamReady (this=0x87c4cc0, stream=0x8b58370) at nsInputStreamPump.cpp:343 #14 0xb7e557cc in nsInputStreamReadyEvent::EventHandler (plevent=0x8b17fac) at nsStreamUtils.cpp:119 #15 0xb7e6a0d7 in PL_HandleEvent (self=0x8b17fac) at plevent.c:688 ---Type to continue, or q to quit--- #16 0xb7e6a3e9 in PL_ProcessPendingEvents (self=0x80c1778) at plevent.c:623 #17 0xb7e6c26e in nsEventQueueImpl::ProcessPendingEvents (this=0x80c1740) at nsEventQueue.cpp:417 #18 0xb6925ea5 in event_processor_callback (source=0x81a3168, condition=G_IO_IN, data=0x6) at nsAppShell.cpp:67 #19 0xb77b8d1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #20 0xb778f7b1 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #21 0xb7792826 in g_main_context_check () from /usr/lib/libglib-2.0.so.0 #22 0xb7792be7 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #23 0xb7bd8141 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 #24 0xb69262f2 in nsAppShell::Run (this=0x813d8a8) at nsAppShell.cpp:139 #25 0xb68e5d80 in nsAppStartup::Run (this=0x813d868) at nsAppStartup.cpp:150 #26 0x0804e69a in XRE_main (argc=1, argv=0xbfc574d4, aAppData=0x8059020) at nsAppRunner.cpp:2374 #27 0x0804abdf in main (argc=Cannot access memory at address 0x35aa ) at nsMailApp.cpp:62 #28 0xb7538ea8 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6 #29 0x0804ab11 in _start () at ../sysdeps/i386/elf/start.S:119 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Sat, Sep 30, 2006 at 09:47:43AM +0200, Nicolas Bonifas wrote: > >>Thunderbird crashes very often (every hour) while checking mail (on a > >>POP3 account). A gdb backtrace follows. > > > >Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg > >package installed? > > Here is the gdb backtrace with thunderbird 1.5.0.7-2. Please note that > my POP3 account contains approximately 2000 mails. > Regards, > Nicolas Sorry for the delay ... can you still reproduce this crash? - Alexander p.s. please take care that the bug is listed as To: or CC: when replying to this mail (e.g. /reply-all/). -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Sorry for the delay ... can you still reproduce this crash?
Yes, I can. But I have new informations: the pop3 server I used was
buggy: it sent twice some lines in the answer to the UIDL command. In
the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at
each line of the UIDL answer.
As this bug is due to a grave bug in the server, I don't know if you
will want to correct it. If you want to do so, it is an easy thing:
As m_pop3ConData is initialized to 0 by PR_NEWZAP, changing
if (token)
{
msg_num = atol(token);
m_listpos++;
if(m_listpos <= m_pop3ConData->number_of_messages && m_listpos > 0)
{
token = nsCRT::strtok(newStr, " ", &newStr);
if (token)
{
m_pop3ConData->msg_info[m_listpos-1].size = atol(token);
m_pop3ConData->msg_info[m_listpos-1].msgnum = msg_num;
}
}
}
into
if (token)
{
msg_num = atol(token);
if(!m_pop3ConData->msg_info[m_listpos-1].msgnum)
{
m_listpos++;
if(m_listpos <= m_pop3ConData->number_of_messages && m_listpos > 0)
{
token = nsCRT::strtok(newStr, " ", &newStr);
if (token)
{
m_pop3ConData->msg_info[m_listpos-1].size = atol(token);
m_pop3ConData->msg_info[m_listpos-1].msgnum = msg_num;
}
}
}
}
would solve the problem.
Regards,
Nicolas
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Tue, Dec 19, 2006 at 06:18:32PM +0100, Nicolas Bonifas wrote: > >Sorry for the delay ... can you still reproduce this crash? > > Yes, I can. But I have new informations: the pop3 server I used was > buggy: it sent twice some lines in the answer to the UIDL command. In > the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at > each line of the UIDL answer. > As this bug is due to a grave bug in the server, I don't know if you > will want to correct it. If you want to do so, it is an easy thing: We want to investigate for sure. > > As m_pop3ConData is initialized to 0 by PR_NEWZAP, changing I don't understand how your fix prevents the NULL dereference if m_pop3ConData == NULL? You still do if(!m_pop3ConData->msg_info[m_listpos-1].msgnum) in your fix. BTW, can you still reproduce the jsgc memory stack? - Alexander -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Tue, Dec 19, 2006 at 06:18:32PM +0100, Nicolas Bonifas wrote: > >Sorry for the delay ... can you still reproduce this crash? > > Yes, I can. But I have new informations: the pop3 server I used was > buggy: it sent twice some lines in the answer to the UIDL command. In > the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at > each line of the UIDL answer. > As this bug is due to a grave bug in the server, I don't know if you > will want to correct it. If you want to do so, it is an easy thing: Ah ... and attach a bt full from the first bt you submitted. Thanks, - Alexander -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Hello,
You still do
if(!m_pop3ConData->msg_info[m_listpos-1].msgnum)
in your fix.
Yes, you are right. My fix does not work. Anyway, the problem comes from
m_listpos being incremented at each line of the answer to the UIDL command.
BTW, can you still reproduce the jsgc memory stack?
I did not manage to reproduce it today (I tried a few times), but it
does not necessarily means that it is corrected: the crash occurred at
several points.
Ah ... and attach a bt full from the first bt you submitted.
Here is a full backtrace from Icedove 1.5.0.9.dfsg1-1:
#0 0xb7521cc0 in free () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#1 0xb752387f in malloc () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#2 0xb7db9495 in PL_strdup (s=0x8975798 "112695870š^·4491") at strdup.c:53
n = 17
#3 0xb521e0b1 in put_hash (table=0x89757b0, key=0x8a58ef0
"1126958738.14354", value=, dateReceived=1166983101)
at nsPop3Protocol.cpp:166
No locals.
#4 0xb5222d6f in nsPop3Protocol::GetMsg (this=0x892e410) at
nsPop3Protocol.cpp:2746
rv =
mailboxSpaceLeft =
folder = { = {mRawPtr = 0x89f515d}, fields>}
path = { = {mRawPtr = 0x897842c}, }
c =
i = 1884
prefBool = 0
popstateTimestamp = 1166983101
#5 0xb522626e in nsPop3Protocol::ProcessProtocolState (this=0x892e410,
url=0x897842c, aInputStream=0x8a5e1c0, sourceOffset=65133, aLength=2356)
at nsPop3Protocol.cpp:3786
prefBool = -1222916272
status = 0
mailnewsurl = { = {mRawPtr = 0x897842c}, data fields>}
#6 0xb519670e in nsMsgProtocol::OnDataAvailable (this=0x892e410,
request=0x89f85d8, ctxt=0x897842c, inStr=0x8a5e1c0, sourceOffset=65133,
count=2356) at nsMsgProtocol.cpp:350
uri = { = {mRawPtr = 0x897842c}, }
#7 0xb71481d1 in nsInputStreamPump::OnStateTransfer (this=0x89f85d8) at
nsInputStreamPump.cpp:437
offsetBefore =
seekable = { = {mRawPtr = 0x8a5e1c4}, fields>}
rv =
avail = 2356
#8 0xb714832f in nsInputStreamPump::OnInputStreamReady (this=0x89f85d8,
stream=0x8a5e1c0) at nsInputStreamPump.cpp:340
nextState = 926430520
#9 0xb7e177cc in nsInputStreamReadyEvent::EventHandler
(plevent=0x87e7efc) at nsStreamUtils.cpp:119
ev =
#10 0xb7e2c0d7 in PL_HandleEvent (self=0x87e7efc) at plevent.c:688
result =
#11 0xb7e2c3e9 in PL_ProcessPendingEvents (self=0x89d83e0) at plevent.c:623
event = (PLEvent *) 0x31393434
count = 2
#12 0xb7e2e26e in nsEventQueueImpl::ProcessPendingEvents
(this=0x8967768) at nsEventQueue.cpp:417
correctThread =
#13 0xb67aaf75 in event_processor_callback (source=0x842a008,
condition=G_IO_IN, data=0x37383538) at nsAppShell.cpp:67
No locals.
#14 0xb7756c7f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#15 0xb772d731 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#16 0xb77307a6 in g_main_context_check () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#17 0xb7730d27 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#18 0xb67ab416 in nsAppShell::DispatchNativeEvent (this=0x8a0bcc8,
aRealEvent=0, aEvent=0x0) at nsAppShell.cpp:274
No locals.
#19 0xb60e538c in nsXULWindow::ShowModal (this=0xb7d67000) at
nsXULWindow.cpp:404
data = (void *) 0x0
isRealEvent = 0
processEvent = 1
cx = (JSContext *) 0xbf81916c
appShell = { = {mRawPtr = 0x8a0bcc8}, fields>}
window = { = {mRawPtr = 0x89904d0}, fields>}
tempRef = { = {mRawPtr = 0x8936858}, fields>}
appShellService = { = {mRawPtr = 0x81e6c38}, data fields>}
stack = { = {mRawPtr = 0x8107ed8}, }
rv = 134698472
#20 0xb60e0f87 in nsContentTreeOwner::ShowAsModal (this=0x864ba18) at
nsContentTreeOwner.cpp:430
No locals.
#21 0xb66dc228 in nsWindowWatcher::OpenWindowJS (this=0x813c478,
aParent=0x831cd88, aUrl=0xb66f8ea0
"chrome://global/content/commonDialog.xul",
aName=0xb66f89c0 "_blank", aFeatures=0xb66f8d54
"centerscreen,chrome,modal,titlebar", aDialog=1, argc=1, argv=0x8994848,
_retval=0xbf819260)
at nsWindowWatcher.cpp:824
newTreeOwner = { = {mRawPtr = 0x8960678}, data fields>}
newChrome = { = {mRawPtr = 0x864ba24}, fields>}
rv =
nameSpecified = 1
featuresSpecified = 1
windowIsNew = 1
windowIsModal = 1
uriToLoadIsChrome = 1
chromeFlags = 4160750598
name = { = { = { =
{ = {mVTable = 0xb7e61ce8, mData = 0xbf81903c,
mLength = 6,
mFlags = 65553}, }, },
mFixedCapacity = 63, mFixedBuf = 0xbf81903c}, mStorage = {95, 98, 108,
97, 110,
107, 0, 49025, 17284, 47070, 37184, 49025, 7808, 2057, 36416,
46703, 21836, 47067, 9688, 47078, 42232, 46942, 18472, 2201, 107, 0, 3672,
2207, 72, 0, 12, 0, 37000, 49025, 62977, 46672, 52616, 2
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Hello, Any progress on this bug? Please tell me if you need further informations. Thanks, Nicolas -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
