Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Hello, Any progress on this bug? Please tell me if you need further informations. Thanks, Nicolas -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Hello,
You still do
if(!m_pop3ConData-msg_info[m_listpos-1].msgnum)
in your fix.
Yes, you are right. My fix does not work. Anyway, the problem comes from
m_listpos being incremented at each line of the answer to the UIDL command.
BTW, can you still reproduce the jsgc memory stack?
I did not manage to reproduce it today (I tried a few times), but it
does not necessarily means that it is corrected: the crash occurred at
several points.
Ah ... and attach a bt full from the first bt you submitted.
Here is a full backtrace from Icedove 1.5.0.9.dfsg1-1:
#0 0xb7521cc0 in free () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#1 0xb752387f in malloc () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#2 0xb7db9495 in PL_strdup (s=0x8975798 112695870š^·4491) at strdup.c:53
n = 17
#3 0xb521e0b1 in put_hash (table=0x89757b0, key=0x8a58ef0
1126958738.14354, value=value optimized out, dateReceived=1166983101)
at nsPop3Protocol.cpp:166
No locals.
#4 0xb5222d6f in nsPop3Protocol::GetMsg (this=0x892e410) at
nsPop3Protocol.cpp:2746
rv = value optimized out
mailboxSpaceLeft = value optimized out
folder = {nsCOMPtr_base = {mRawPtr = 0x89f515d}, No data
fields}
path = {nsCOMPtr_base = {mRawPtr = 0x897842c}, No data fields}
c = value optimized out
i = 1884
prefBool = 0
popstateTimestamp = 1166983101
#5 0xb522626e in nsPop3Protocol::ProcessProtocolState (this=0x892e410,
url=0x897842c, aInputStream=0x8a5e1c0, sourceOffset=65133, aLength=2356)
at nsPop3Protocol.cpp:3786
prefBool = -1222916272
status = 0
mailnewsurl = {nsCOMPtr_base = {mRawPtr = 0x897842c}, No
data fields}
#6 0xb519670e in nsMsgProtocol::OnDataAvailable (this=0x892e410,
request=0x89f85d8, ctxt=0x897842c, inStr=0x8a5e1c0, sourceOffset=65133,
count=2356) at nsMsgProtocol.cpp:350
uri = {nsCOMPtr_base = {mRawPtr = 0x897842c}, No data fields}
#7 0xb71481d1 in nsInputStreamPump::OnStateTransfer (this=0x89f85d8) at
nsInputStreamPump.cpp:437
offsetBefore = value optimized out
seekable = {nsCOMPtr_base = {mRawPtr = 0x8a5e1c4}, No data
fields}
rv = value optimized out
avail = 2356
#8 0xb714832f in nsInputStreamPump::OnInputStreamReady (this=0x89f85d8,
stream=0x8a5e1c0) at nsInputStreamPump.cpp:340
nextState = 926430520
#9 0xb7e177cc in nsInputStreamReadyEvent::EventHandler
(plevent=0x87e7efc) at nsStreamUtils.cpp:119
ev = value optimized out
#10 0xb7e2c0d7 in PL_HandleEvent (self=0x87e7efc) at plevent.c:688
result = value optimized out
#11 0xb7e2c3e9 in PL_ProcessPendingEvents (self=0x89d83e0) at plevent.c:623
event = (PLEvent *) 0x31393434
count = 2
#12 0xb7e2e26e in nsEventQueueImpl::ProcessPendingEvents
(this=0x8967768) at nsEventQueue.cpp:417
correctThread = value optimized out
#13 0xb67aaf75 in event_processor_callback (source=0x842a008,
condition=G_IO_IN, data=0x37383538) at nsAppShell.cpp:67
No locals.
#14 0xb7756c7f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#15 0xb772d731 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#16 0xb77307a6 in g_main_context_check () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#17 0xb7730d27 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#18 0xb67ab416 in nsAppShell::DispatchNativeEvent (this=0x8a0bcc8,
aRealEvent=0, aEvent=0x0) at nsAppShell.cpp:274
No locals.
#19 0xb60e538c in nsXULWindow::ShowModal (this=0xb7d67000) at
nsXULWindow.cpp:404
data = (void *) 0x0
isRealEvent = 0
processEvent = 1
cx = (JSContext *) 0xbf81916c
appShell = {nsCOMPtr_base = {mRawPtr = 0x8a0bcc8}, No data
fields}
window = {nsCOMPtr_base = {mRawPtr = 0x89904d0}, No data
fields}
tempRef = {nsCOMPtr_base = {mRawPtr = 0x8936858}, No data
fields}
appShellService = {nsCOMPtr_base = {mRawPtr = 0x81e6c38}, No
data fields}
stack = {nsCOMPtr_base = {mRawPtr = 0x8107ed8}, No data fields}
rv = 134698472
#20 0xb60e0f87 in nsContentTreeOwner::ShowAsModal (this=0x864ba18) at
nsContentTreeOwner.cpp:430
No locals.
#21 0xb66dc228 in nsWindowWatcher::OpenWindowJS (this=0x813c478,
aParent=0x831cd88, aUrl=0xb66f8ea0
chrome://global/content/commonDialog.xul,
aName=0xb66f89c0 _blank, aFeatures=0xb66f8d54
centerscreen,chrome,modal,titlebar, aDialog=1, argc=1, argv=0x8994848,
_retval=0xbf819260)
at nsWindowWatcher.cpp:824
newTreeOwner = {nsCOMPtr_base = {mRawPtr = 0x8960678}, No
data fields}
newChrome = {nsCOMPtr_base = {mRawPtr = 0x864ba24}, No data
fields}
rv = value optimized out
nameSpecified = 1
featuresSpecified = 1
windowIsNew = 1
windowIsModal = 1
uriToLoadIsChrome = 1
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Sat, Sep 30, 2006 at 09:47:43AM +0200, Nicolas Bonifas wrote: Thunderbird crashes very often (every hour) while checking mail (on a POP3 account). A gdb backtrace follows. Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg package installed? Here is the gdb backtrace with thunderbird 1.5.0.7-2. Please note that my POP3 account contains approximately 2000 mails. Regards, Nicolas Sorry for the delay ... can you still reproduce this crash? - Alexander p.s. please take care that the bug is listed as To: or CC: when replying to this mail (e.g. /reply-all/). -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Sorry for the delay ... can you still reproduce this crash?
Yes, I can. But I have new informations: the pop3 server I used was
buggy: it sent twice some lines in the answer to the UIDL command. In
the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at
each line of the UIDL answer.
As this bug is due to a grave bug in the server, I don't know if you
will want to correct it. If you want to do so, it is an easy thing:
As m_pop3ConData is initialized to 0 by PR_NEWZAP, changing
if (token)
{
msg_num = atol(token);
m_listpos++;
if(m_listpos = m_pop3ConData-number_of_messages m_listpos 0)
{
token = nsCRT::strtok(newStr, , newStr);
if (token)
{
m_pop3ConData-msg_info[m_listpos-1].size = atol(token);
m_pop3ConData-msg_info[m_listpos-1].msgnum = msg_num;
}
}
}
into
if (token)
{
msg_num = atol(token);
if(!m_pop3ConData-msg_info[m_listpos-1].msgnum)
{
m_listpos++;
if(m_listpos = m_pop3ConData-number_of_messages m_listpos 0)
{
token = nsCRT::strtok(newStr, , newStr);
if (token)
{
m_pop3ConData-msg_info[m_listpos-1].size = atol(token);
m_pop3ConData-msg_info[m_listpos-1].msgnum = msg_num;
}
}
}
}
would solve the problem.
Regards,
Nicolas
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Tue, Dec 19, 2006 at 06:18:32PM +0100, Nicolas Bonifas wrote: Sorry for the delay ... can you still reproduce this crash? Yes, I can. But I have new informations: the pop3 server I used was buggy: it sent twice some lines in the answer to the UIDL command. In the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at each line of the UIDL answer. As this bug is due to a grave bug in the server, I don't know if you will want to correct it. If you want to do so, it is an easy thing: We want to investigate for sure. As m_pop3ConData is initialized to 0 by PR_NEWZAP, changing I don't understand how your fix prevents the NULL dereference if m_pop3ConData == NULL? You still do if(!m_pop3ConData-msg_info[m_listpos-1].msgnum) in your fix. BTW, can you still reproduce the jsgc memory stack? - Alexander -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Tue, Dec 19, 2006 at 06:18:32PM +0100, Nicolas Bonifas wrote: Sorry for the delay ... can you still reproduce this crash? Yes, I can. But I have new informations: the pop3 server I used was buggy: it sent twice some lines in the answer to the UIDL command. In the function GetList (nsPop3Protocol.cpp) m_listpos is incremented at each line of the UIDL answer. As this bug is due to a grave bug in the server, I don't know if you will want to correct it. If you want to do so, it is an easy thing: Ah ... and attach a bt full from the first bt you submitted. Thanks, - Alexander -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Thunderbird crashes very often (every hour) while checking mail (on a POP3 account). A gdb backtrace follows. Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg package installed? Here is the gdb backtrace with thunderbird 1.5.0.7-2. Please note that my POP3 account contains approximately 2000 mails. Regards, Nicolas Program received signal SIGABRT, Aborted. [Switching to Thread -1220401472 (LWP 13738)] 0xe410 in __kernel_vsyscall () (gdb) bt #0 0xe410 in __kernel_vsyscall () #1 0xb754c821 in raise () from /lib/tls/i686/cmov/libc.so.6 #2 0xb754dfb9 in abort () from /lib/tls/i686/cmov/libc.so.6 #3 0xb7581c4a in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6 #4 0xb75893ec in mallopt () from /lib/tls/i686/cmov/libc.so.6 #5 0xb7589582 in free () from /lib/tls/i686/cmov/libc.so.6 #6 0xb7dd608f in PR_Free (ptr=0x0) at prmem.c:490 #7 0xb53a7d42 in nsPop3Protocol::FreeMsgInfo (this=0x8895be0) at nsPop3Protocol.cpp:923 #8 0xb53a884a in ~nsPop3Protocol (this=0x8895be0) at nsPop3Protocol.cpp:626 #9 0xb531f11c in nsMsgProtocol::Release (this=0x8895be0) at nsMsgProtocol.cpp:70 #10 0xb53a829d in nsPop3Protocol::Release (this=0x8895be0) at nsPop3Protocol.cpp:503 #11 0xb7e22e5c in nsCOMPtr_base::assign_with_AddRef (this=0x87c4cd4, rawPtr=0x0) at ./../glue/nsCOMPtr.h:531 #12 0xb72c19af in nsInputStreamPump::OnStateStop (this=0x87c4cc0) at ../../../dist/include/xpcom/nsCOMPtr.h:713 #13 0xb72c2368 in nsInputStreamPump::OnInputStreamReady (this=0x87c4cc0, stream=0x8b58370) at nsInputStreamPump.cpp:343 #14 0xb7e557cc in nsInputStreamReadyEvent::EventHandler (plevent=0x8b17fac) at nsStreamUtils.cpp:119 #15 0xb7e6a0d7 in PL_HandleEvent (self=0x8b17fac) at plevent.c:688 ---Type return to continue, or q return to quit--- #16 0xb7e6a3e9 in PL_ProcessPendingEvents (self=0x80c1778) at plevent.c:623 #17 0xb7e6c26e in nsEventQueueImpl::ProcessPendingEvents (this=0x80c1740) at nsEventQueue.cpp:417 #18 0xb6925ea5 in event_processor_callback (source=0x81a3168, condition=G_IO_IN, data=0x6) at nsAppShell.cpp:67 #19 0xb77b8d1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #20 0xb778f7b1 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #21 0xb7792826 in g_main_context_check () from /usr/lib/libglib-2.0.so.0 #22 0xb7792be7 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #23 0xb7bd8141 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 #24 0xb69262f2 in nsAppShell::Run (this=0x813d8a8) at nsAppShell.cpp:139 #25 0xb68e5d80 in nsAppStartup::Run (this=0x813d868) at nsAppStartup.cpp:150 #26 0x0804e69a in XRE_main (argc=1, argv=0xbfc574d4, aAppData=0x8059020) at nsAppRunner.cpp:2374 #27 0x0804abdf in main (argc=Cannot access memory at address 0x35aa ) at nsMailApp.cpp:62 #28 0xb7538ea8 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6 #29 0x0804ab11 in _start () at ../sysdeps/i386/elf/start.S:119 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
Package: thunderbird Version: 1.5.0.7-1 Severity: important Thunderbird crashes very often (every hour) while checking mail (on a POP3 account). A gdb backtrace follows. -- Gdb Backtrace: (gdb) bt #0 0xb75cbc80 in free () from /lib/tls/i686/cmov/libc.so.6 #1 0xb75cd83f in malloc () from /lib/tls/i686/cmov/libc.so.6 #2 0xb7e38495 in PL_strdup () from /usr/lib/thunderbird/libplc4.so #3 0xb5403001 in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #4 0xb5407f07 in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #5 0xb540b18e in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #6 0xb537b6de in NSGetModule () from /usr/lib/thunderbird/components/libmail.so #7 0xb730a1d1 in NSGetModule () from /usr/lib/thunderbird/components/libnecko.so #8 0xb730a32f in NSGetModule () from /usr/lib/thunderbird/components/libnecko.so #9 0xb7e9659c in NS_AsyncCopy () from /usr/lib/thunderbird/libxpcom_core.so #10 0xb7eaae87 in PL_HandleEvent () from /usr/lib/thunderbird/libxpcom_core.so #11 0xb7eab199 in PL_ProcessPendingEvents () from /usr/lib/thunderbird/libxpcom_core.so #12 0xb7ead01e in nsAutoMonitor::NewMonitor () from /usr/lib/thunderbird/libxpcom_core.so #13 0xb696dea5 in ?? () from /usr/lib/thunderbird/components/libwidget_gtk2.so #14 0x080c1740 in ?? () #15 0x083dec20 in ?? () #16 0xbff95a58 in ?? () #17 0xb77fad1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #18 0xb77fad1f in g_io_channel_unix_get_fd () from /usr/lib/libglib-2.0.so.0 #19 0xb77d17b1 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #20 0xb77d4826 in g_main_context_check () from /usr/lib/libglib-2.0.so.0 #21 0xb77d4be7 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #22 0xb7c19141 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 #23 0xb696e2f2 in ?? () from /usr/lib/thunderbird/components/libwidget_gtk2.so #24 0x0813d8a8 in ?? () #25 0xb6832278 in ?? () from /usr/lib/thunderbird/components/libnsappshell.so #26 0xbff95bb8 in ?? () #27 0x08057f8c in _IO_stdin_used () #28 0x0805980c in ?? () #29 0x0813d868 in ?? () #30 0xbff95bc8 in ?? () #31 0xb692dd80 in NSGetModule () from /usr/lib/thunderbird/components/libtoolkitcomps.so #32 0xb692dd80 in NSGetModule () from /usr/lib/thunderbird/components/libtoolkitcomps.so #33 0x0804e66a in ?? () #34 0x0813d868 in ?? () #35 0x080573a8 in _IO_stdin_used () #36 0x in ?? () -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.15-1-686 Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15) Versions of packages thunderbird depends on: ii debconf [debconf-2.0] 1.5.4Debian configuration management sy ii libatk1.0-0 1.12.2-1 The ATK accessibility toolkit ii libc6 2.3.6.ds1-4 GNU C Library: Shared libraries ii libcairo2 1.2.4-1 The Cairo 2D vector graphics libra ii libfontconfig1 2.4.1-2 generic font configuration library ii libgcc1 1:4.1.1-13 GCC support library ii libglib2.0-02.12.3-2 The GLib library of C routines ii libgtk2.0-0 2.8.20-1 The GTK+ graphical user interface ii libjpeg62 6b-13The Independent JPEG Group's JPEG ii libpango1.0-0 1.12.4-1 Layout and rendering of internatio ii libpng12-0 1.2.8rel-5.2 PNG library - runtime ii libstdc++6 4.1.1-13 The GNU Standard C++ Library v3 ii libx11-62:1.0.0-9X11 client-side library ii libxcursor1 1.1.7-4 X cursor management library ii libxext61:1.0.1-2X11 miscellaneous extension librar ii libxfixes3 1:4.0.1-4X11 miscellaneous 'fixes' extensio ii libxft2 2.1.8.2-8FreeType-based font drawing librar ii libxi6 1:1.0.1-3X11 Input extension library ii libxinerama11:1.0.1-4.1 X11 Xinerama extension library ii libxrandr2 2:1.1.0.2-4 X11 RandR extension library ii libxrender1 1:0.9.1-3X Rendering Extension client libra ii libxt6 1:1.0.2-2X11 toolkit intrinsics library ii myspell-fr [myspell-diction 1.4-20 The French dictionary for myspell ii zlib1g 1:1.2.3-13 compression library - runtime thunderbird recommends no packages. -- debconf information: * thunderbird/browser: Debian -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#390230: thunderbird: Thunderbird segfaults while checking mail
On Fri, Sep 29, 2006 at 11:59:05PM +0200, Nicolas Bonifas wrote: Package: thunderbird Version: 1.5.0.7-1 Severity: important Thunderbird crashes very often (every hour) while checking mail (on a POP3 account). A gdb backtrace follows. Can you please upgrade to 1.5.0.7-2 and do a backtrace with -dbg package installed? - Alexander p.s. please take care that the bug is listed as To: or CC: when replying to this mail (e.g. /reply-all/). -- GPG messages preferred. | .''`. ** Debian GNU/Linux ** Alexander Sack| : :' : The universal [EMAIL PROTECTED] | `. `' Operating System http://www.asoftsite.org | `-http://www.debian.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
