crash [@ nsMsgDBFolder::NotifyIntPropertyChanged(nsIAtom*, int, int)] (Mac), also [@ nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**)] - [@ nsMsgDBFolder::NotifyIntPropertyChanged] (win) Mac version bp-615d4974-4cb9-4d26-becf-af7302100812 windows crash reported by gsfn user is bp-366f259b-b396-42a2-857c-e1f862100812 along with bp-615fa28f-ee45-48cf-81e1-cf5772100812 and bp-615fa28f-ee45-48cf-81e1-cf5772100812 - both nsMsgXFGroupThread::FindMsgHdr (no bug report and no crashes found with that top of stack bp-366f259b-b396-42a2-857c-e1f862100812 0 xpcom_core.dll nsComponentManagerImpl::CreateInstanceByContractID xpcom/components/nsComponentManager.cpp:1664 1 thunderbird.exe nsMsgDBFolder::NotifyIntPropertyChanged mailnews/base/util/nsMsgDBFolder.cpp:4858 2 thunderbird.exe nsMsgDBFolder::UpdateSummaryTotals mailnews/base/util/nsMsgDBFolder.cpp:4050 3 thunderbird.exe mailnews/base/util/nsMsgDBFolder.cpp:5005 4 thunderbird.exe nsMsgLocalMailFolder::DeleteMessages mailnews/local/src/nsLocalMailFolder.cpp:1513 5 thunderbird.exe mailnews/local/src/nsLocalMailFolder.cpp:2855 6 thunderbird.exe mailnews/base/src/nsCopyMessageStreamListener.cpp:179 7 thunderbird.exe mailnews/base/src/nsCopyMessageStreamListener.cpp:190 8 thunderbird.exe mailnews/base/util/nsMsgProtocol.cpp:401 9 thunderbird.exe mailnews/local/src/nsMailboxProtocol.cpp:381 10 thunderbird.exe 11 thunderbird.exe nsInputStreamPump::OnInputStreamReady 12 xpcom_core.dll nsInputStreamReadyEvent::Run 13 xpcom_core.dll nsThread::ProcessNextEvent 14 xpcom_core.dll NS_ProcessNextEvent_P 15 thunderbird.exe nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:170

this seems to be more popular in tb 12 b2

indeed. uptick seems to have started around 20120315030113 v13.0a2 https://crash-stats.mozilla.com/report/index/29fe0f34-7206-40ea-b401-1889c2120316 or perhaps a month earlier with https://crash-stats.mozilla.com/report/index/88ab577b-5e68-432d-b5c4-3a7272120220

I got this crash today with TB 12a2 from March 20th while testing bug 744706. So I have moved all the messages from a folder into an other one. Thunderbird crashed immediately. Crash report: bp-a548f310-8851-4e64-b8d6-b97c72120419 It's not reproducible for now.

bp-9856e483-e990-4884-8482-0253d2140210 TB24.3.0 ehsan@13324 4869 nsMsgDBFolder::NotifyIntPropertyChanged(nsIAtom *aProperty, int32_t aOldValue, ehsan@13324 4870 int32_t aNewValue) hg@0 4871 { hg@0 4872 // Don't send off count notifications if they are turned off. hg@0 4873 if (!mNotifyCountChanges && hg@0 4874 ((aProperty == kTotalMessagesAtom) || hg@0 4875 (aProperty == kTotalUnreadMessagesAtom))) hg@0 4876 return NS_OK; hg@0 4877 hg@0 4878 NS_OBSERVER_ARRAY_NOTIFY_OBSERVERS(mListeners, nsIFolderListener, hg@0 4879 OnItemIntPropertyChanged, hg@0 4880 (this, aProperty, aOldValue, aNewValue)); hg@0 4881 hg@0 4882 // Notify listeners who listen to every folder hg@0 4883 nsresult rv; hg@0 4884 nsCOMPtr<nsIFolderListener> folderListenerManager = hg@0 4885 do_GetService(NS_MSGMAILSESSION_CONTRACTID, &rv);

currently most of the crashes are nsMsgDBFolder::NotifyIntPropertyChanged, at a rate of about 100 per week for 55.2.1

Can you make anything out of the current stacks? Or will a testcase be needed? Most crashes are 0xffffffffe5e5e5fd: bp-25c3a527-f359-4c0d-a67f-bc6fb0181124 bp-1889fcba-5ca4-45f2-b812-972610181124 A few crash addresses are 0x19 bp-78491e4c-e647-4043-837a-5802f0181123 bp-dc4adca1-8427-4214-a6b7-6cef80181114 60.3.0 claims to have crashed shortly after compact (In reply to Wayne Mery (:wsmwk) from comment #5) > currently most of the crashes are nsMsgDBFolder::NotifyIntPropertyChanged, > at a rate of about 100 per week for 55.2.1 crash rate for current versions totaled is tripple the above rate, which includes 60.3.0 and 60.3.1

The crash site is nsMsgDBFolder.cpp:5009 which is: NS_OBSERVER_ARRAY_NOTIFY_OBSERVERS(mListeners, nsIFolderListener, OnItemIntPropertyChanged, (this, aProperty, aOldValue, aNewValue)); Maybe mListeners has gone stale/free'd, that's what the 0xffffffffe5e5e5fd may suggest. Maybe Magnus would like to check this. Nothing obvious comes to my mind here.

I would guess that there's a problem with mListeners though. The comment here is worrying: https://hg.mozilla.org/releases/comm-esr60/annotate/tip/mailnews/base/util/nsMsgDBFolder.h#l217 // This can't be refcounted due to ownsership issues nsTObserverArray<nsIFolderListener*> mListeners; But that is from version 0, so perhaps we're lucky and we could make it nsTObserverArray<nsCOMPtr<nsIFolderListener>> mListeners; But, hah! We already did that in bug 409458. So for 64.0+ that cause should not be an issue anymore

Good catch, should be fixed by bug 409458.

This crash signature is gone in 60.3.2 and 60.3.3 so bug 409458 has done it's job. Thanks!