This bug was filed from the Socorro interface and is report bp-713eeeec-8f8f-42c4-9dee-813692151102. ============================================================= Crashed twice in a row with this on Daily from yesterday. Per bug 1151643: Crashes with this signature indicate that a cycle collected object is either being used after the cycle collector is shut down, or on a thread that does not have a cycle collector. PS: Yes, Wayne, I'm on Daily now, not long enough for a verdict, though

This is a regression from bug 931283, which landed in Fx44. That patch made it so that any nsIVariant created by the component manager are mainthread-only, and this is being called on some database thread. I worked around similar issues in Firefox code in bug 1210517, by directly calling |new nsVariant()| rather than using the component manager. The fix here is to do the same thing in nsGlodaRankerFunction::OnFunctionCall(). That is the only direct use of the variant contract id in C++ in Thunderbird: http://mxr.mozilla.org/comm-central/search?string=%40mozilla.org/variant%3B1 There are also a few places that use NS_VARIANT_CONTRACTID (which is just a macro for the same contract id) from C++, that somebody should audit and decide if they are used off the main thread. If so, they will need to be converted similarly. Even if they aren't, they could be changed to |new nsVariantCC()|, which would be a little cleaner, but not really necessary. http://mxr.mozilla.org/comm-central/ident?i=NS_VARIANT_CONTRACTID

Sorry, I should have checked comm-central for this variant pattern and filed a bug about it! Somehow it slipped my mind.

Thanks for the hings. And this is a topcrash for 44.0a2 and 45.0a1

I have had daily crash 3 times in a row with this : exactly the same pattern of behaviour : attempted to do a search over all folders. I noticed LavasoftLSP was mentioned in the crash dump : I will try the following - switch to safe mode - delete global-messages-db.sqlite - switch off email protection in ad-aware I will report back with my results!

(In reply to helkav from comment #4) > I have had daily crash 3 times in a row with this : exactly the same pattern > of behaviour : attempted to do a search over all folders. > > I noticed LavasoftLSP was mentioned in the crash dump : I will try the > following > > - switch to safe mode > - delete global-messages-db.sqlite > - switch off email protection in ad-aware > > I will report back with my results! none of these had any effect : I am going to earlybird to see how that does ...

regression checking: 43.0a2 : not affected 44.0a1 : affected 44.0a2 : affected so the issue has arisen between 43.0a2 and 44.0a1 , unless there's a build inbetween , but I couldn't find any

45.0a1 : affected this is the current version for daily ...

We need to fix this in aurora ASAP based on stats of https://crash-stats.mozilla.com/topcrasher/products/Thunderbird/versions/44.0a2 - within the next week would be ideal (In reply to Wayne Mery (:wsmwk, use Needinfo for questions) from comment #3) > Thanks for the hings. c/Thanks for the hings./Thanks for the hints./

Comment on attachment 8685593 [details] [diff] [review] bug1220667_crash_in_gloda_NS_CycleCollectorSuspect3.patch Review of attachment 8685593 [details] [diff] [review]: ----------------------------------------------------------------- This looks to me like it will fix the issue. Thanks!

Comment on attachment 8685593 [details] [diff] [review] bug1220667_crash_in_gloda_NS_CycleCollectorSuspect3.patch Review of attachment 8685593 [details] [diff] [review]: ----------------------------------------------------------------- Willing to sign off on this.

https://hg.mozilla.org/comm-central/rev/acb8e32e8c55 -> FIXED

did an update of daily today and this is now fixed noticed the version number is still 45.0a1 in the about dialog and troubleshooting page I don't normally check the build number (currently 20151112030427) but is there a reason the version number has not been updated?

What version number did you expect? I think it's expected for nightlies to be at 45.0a1 atm.

ok I just didn't know if the nightlys were updating the version number nightly...I'm guessing not by your reply - so I should also check the build date. should have been obvious I suppose...

Crash with similar signature is reported during comm-aurora xpcshell tests: > TEST-UNEXPECTED-FAIL | mailnews/db/gloda/test/unit/test_fts3_tokenizer.js | xpcshell return code: -11 > PROCESS-CRASH | mailnews/db/gloda/test/unit/test_fts3_tokenizer.js | application crashed [@ NS_CycleCollectorSuspect3] > TEST-UNEXPECTED-FAIL | mailnews/db/gloda/test/unit/test_msg_search.js | xpcshell return code: -11 > PROCESS-CRASH | mailnews/db/gloda/test/unit/test_msg_search.js | application crashed [@ NS_CycleCollectorSuspect3] Will this be ported back to comm-aurora for Thunderbird 44?

Comment on attachment 8685593 [details] [diff] [review] bug1220667_crash_in_gloda_NS_CycleCollectorSuspect3.patch Review of attachment 8685593 [details] [diff] [review]: ----------------------------------------------------------------- Yeah this should land on 44 too.

Looking great from crash-stats POV. no crashes for 45.0a1 builds newer than 11-11 no crashes for 44.0a2 builds newer than 12-05 v.fixed