Bug #385325 “[armel] thunderbird-bin crashed with SIGSEGVI” : Bugs : thunderbird package : Ubuntu

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-09:

#1

Dependencies.txt Edit (2.6 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (473 bytes, text/plain; charset="utf-8")
ProcMaps.txt Edit (44.9 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (689 bytes, text/plain; charset="utf-8")
Registers.txt Edit (589 bytes, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (163 bytes, text/plain; charset="utf-8")

Changed in thunderbird (Ubuntu):
assignee:	nobody → Michael Casadevall (mcasadevall)
importance:	Undecided → High
milestone:	none → karmic-alpha-3

Revision history for this message

Apport retracing service (apport) wrote on 2009-06-09: Stacktrace.txt (retraced)

#2

Stacktrace.txt (retraced) Edit (12.6 KiB, text/plain)

StacktraceTop:mult (a=0x2ac5d8, b=0x2ac5f8) at jsdtoa.c:659
pow5mult (b=0x2ac5f8, k=1185) at jsdtoa.c:789
JS_dtostr (buffer=0xbe9c98e6 "�\b�\005",
js_NumberToString (cx=0x5b4f0, d=2147500034) at jsnum.c:724
js_ValueToString (cx=0x5b4f0, v=2742650) at jsstr.c:2689

Revision history for this message

Apport retracing service (apport) wrote on 2009-06-09: ThreadStacktrace.txt (retraced)

#3

ThreadStacktrace.txt (retraced) Edit (12.7 KiB, text/plain)

Changed in thunderbird (Ubuntu):
importance:	High → Medium
tags:	removed: need-armel-retrace

Michael Casadevall (mcasadevall) on 2009-06-09

description:	updated
summary:	- [armel] thunderbird-bin crashed with SIGSEGV + [armel] thunderbird-bin crashed with SIGSEGVI
visibility:	private → public

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-11:

#4

Talked with asac, this issue doesn't current with the current beta snapshots of Thunderbird 3, so its an issue with the older codebase.

Changed in thunderbird (Ubuntu):
status:	New → Confirmed

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-11:

#5

Download full text (17.9 KiB)

Redone backtrace with optimization disabled, and --enable-debug built into thunderbird, with a patch applied to get --enable-debug to build:

(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/mcasadevall/src/thunderbird-2.0.0.21+nobinonly/build-tree/mozilla/dist/bin/thunderbird-bin
[Thread debugging using libthread_db enabled]
[New Thread 0x411e85e0 (LWP 31113)]
No Persistent Registry Found.
Type Manifest File: /home/mcasadevall/src/thunderbird-2.0.0.21+nobinonly/build-tree/mozilla/dist/bin/components/xpti.dat
*** Registering Apprunner components (all right -- a generic module!)
nsNativeComponentLoader: autoregistering begins.
*** Registering mozgnome components (all right -- a generic module!)
*** Registering necko_secondary_protocols components (all right -- a generic module!)
*** Registering embedcomponents components (all right -- a generic module!)
*** Registering nsFileViewModule components (all right -- a generic module!)
*** Registering nsImportServiceModule components (all right -- a generic module!)
*** Registering nsWidgetGtk2Module components (all right -- a generic module!)
*** Registering BOOT components (all right -- a generic module!)
*** Registering JavaScript_Debugger components (all right -- a generic module!)
*** Registering nsMailCompsModule components (all right -- a generic module!)
*** Registering nsTransactionManagerModule components (all right -- a generic module!)
*** Registering nsUCvMathModule components (all right -- a generic module!)
*** Registering nsMorkModule components (all right -- a generic module!)
*** Registering nsComposerModule components (all right -- a generic module!)
*** Registering nsEditorModule components (all right -- a generic module!)
*** Registering mozMySpellModule components (all right -- a generic module!)
*** Registering nsJarModule components (all right -- a generic module!)
*** Registering nsPrefModule components (all right -- a generic module!)
*** Registering nsUniversalCharDetModule components (all right -- a generic module!)
*** Registering nsGfxPSModule components (all right -- a generic module!)
*** Registering nsWebServicesModule components (all right -- a generic module!)
*** Registering nsAuthModule components (all right -- a generic module!)
*** Registering nsRDFModule components (all right -- a generic module!)
*** Registering xpcomObsoleteModule components (all right -- a generic module!)
*** Registering nsAccessibilityModule components (all right -- a generic module!)
*** Registering Browser_Embedding_Module components (all right -- a generic module!)
*** Registering nsWalletModule components (all right -- a generic module!)
*** Registering nsImageLib2Module components (all right -- a generic module!)
*** Registering nsLayoutModule components (all right -- a generic module!)
*** Registering application components (all right -- a generic module!)
*** Registering nsGfxGTKModule components (all right -- a generic module!)
*** Registering nsToolkitCompsModule components (all right -- a generic module!)
*** Registering nsFindComponent components (all right -- a generic module!)
*** Registering PKI com...

Redone backtrace with optimization disabled, and --enable-debug built into thunderbird, with a patch applied to get --enable-debug to build:

(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/mcasadevall/src/thunderbird-2.0.0.21+nobinonly/build-tree/mozilla/dist/bin/thunderbird-bin 
[Thread debugging using libthread_db enabled]
[New Thread 0x411e85e0 (LWP 31113)]
No Persistent Registry Found.
Type Manifest File: /home/mcasadevall/src/thunderbird-2.0.0.21+nobinonly/build-tree/mozilla/dist/bin/components/xpti.dat
*** Registering Apprunner components (all right -- a generic module!)
nsNativeComponentLoader: autoregistering begins.
*** Registering mozgnome components (all right -- a generic module!)
*** Registering necko_secondary_protocols components (all right -- a generic module!)
*** Registering embedcomponents components (all right -- a generic module!)
*** Registering nsFileViewModule components (all right -- a generic module!)
*** Registering nsImportServiceModule components (all right -- a generic module!)
*** Registering nsWidgetGtk2Module components (all right -- a generic module!)
*** Registering BOOT components (all right -- a generic module!)
*** Registering JavaScript_Debugger components (all right -- a generic module!)
*** Registering nsMailCompsModule components (all right -- a generic module!)
*** Registering nsTransactionManagerModule components (all right -- a generic module!)
*** Registering nsUCvMathModule components (all right -- a generic module!)
*** Registering nsMorkModule components (all right -- a generic module!)
*** Registering nsComposerModule components (all right -- a generic module!)
*** Registering nsEditorModule components (all right -- a generic module!)
*** Registering mozMySpellModule components (all right -- a generic module!)
*** Registering nsJarModule components (all right -- a generic module!)
*** Registering nsPrefModule components (all right -- a generic module!)
*** Registering nsUniversalCharDetModule components (all right -- a generic module!)
*** Registering nsGfxPSModule components (all right -- a generic module!)
*** Registering nsWebServicesModule components (all right -- a generic module!)
*** Registering nsAuthModule components (all right -- a generic module!)
*** Registering nsRDFModule components (all right -- a generic module!)
*** Registering xpcomObsoleteModule components (all right -- a generic module!)
*** Registering nsAccessibilityModule components (all right -- a generic module!)
*** Registering Browser_Embedding_Module components (all right -- a generic module!)
*** Registering nsWalletModule components (all right -- a generic module!)
*** Registering nsImageLib2Module components (all right -- a generic module!)
*** Registering nsLayoutModule components (all right -- a generic module!)
*** Registering application components (all right -- a generic module!)
*** Registering nsGfxGTKModule components (all right -- a generic module!)
*** Registering nsToolkitCompsModule components (all right -- a generic module!)
*** Registering nsFindComponent components (all right -- a generic module!)
*** Registering PKI components (all right -- a generic module!)
*** Registering nsUConvModule components (all right -- a generic module!)
*** Registering nsWalletViewerModule components (all right -- a generic module!)
*** Registering docshell_provider components (all right -- a generic module!)
*** Registering xpconnect components (all right -- a generic module!)
*** Registering nsChromeModule components (all right -- a generic module!)
*** Registering nsMailModule components (all right -- a generic module!)
*** Registering nsLDAPProtocolModule components (all right -- a generic module!)
*** Registering nsSystemPrefModule components (all right -- a generic module!)
*** Registering NSS components (all right -- a generic module!)
*** Registering mozSpellCheckerModule components (all right -- a generic module!)
*** Registering nsI18nModule components (all right -- a generic module!)
*** Registering mozStorageModule components (all right -- a generic module!)
*** Registering nsParserModule components (all right -- a generic module!)
*** Registering TransformiixModule components (all right -- a generic module!)
*** Registering CommandLineModule components (all right -- a generic module!)
*** Registering nsSoftwareUpdate components (all right -- a generic module!)
*** Registering nsMsgSMIMEModule components (all right -- a generic module!)
*** Registering nsXMLExtrasModule components (all right -- a generic module!)
*** Registering nsIconDecoderModule components (all right -- a generic module!)
*** Registering appshell components (all right -- a generic module!)
*** Registering nsAutoConfigModule components (all right -- a generic module!)
*** Registering necko_core_and_primary_protocols components (all right -- a generic module!)
*** Registering RemoteServiceModule components (all right -- a generic module!)
*** Registering nsSecurityManagerModule components (all right -- a generic module!)
nsNativeComponentLoader: autoregistering succeeded
[New Thread 0x441b9430 (LWP 31114)]
*** Registering Addressbook LDAP Attribute Map components
*** Registering smime account manager extension.
*** Registering mdn account manager extension.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x411e85e0 (LWP 31113)]
Balloc (k=16) at jsdtoa.c:409
409	        freelist[k] = rv->next;
Current language:  auto; currently c
(gdb) bt full
#0  Balloc (k=16) at jsdtoa.c:409
	x = <value optimized out>
	rv = (Bigint *) 0x1
#1  0x40052fd8 in mult (a=0x32c028, b=0x32c028) at jsdtoa.c:655
	c = (Bigint *) 0x15b738
	k = 1
	wc = 38044
	y = 19022
	xc = <value optimized out>
	xc0 = (uint32 *) 0x2e20
	xce = <value optimized out>
	x = (const uint32 *) 0x33e974
	xa = (const uint32 *) 0x32c03c
	xae = (const uint32 *) 0x4a4e
	xb = (const uint32 *) 0x32c028
	xbe = <value optimized out>
	carry = <value optimized out>
	z = <value optimized out>
#2  0x40053a4c in pow5mult (b=0x15b738, k=1185) at jsdtoa.c:800
	b1 = (Bigint *) 0x15b738
	p5 = (Bigint *) 0x32c028
	p51 = (Bigint *) 0x40113e20
	i = <value optimized out>
	p05 = {5, 25, 125}
#3  0x400545c0 in js_dtoa (d=2147500034, 
    mode=<value optimized out>, biasUp=<value optimized out>, 
    ndigits=0, decpt=0xbef2086c, sign=0x0, rve=0xbef20864, 
    buf=0xbef208ae "\004@h�\006", bufsize=3203532900)
    at jsdtoa.c:2493
	bbits = 3013940
	b2 = 4
	b5 = 0
	be = 1092519392
	dig = <value optimized out>
	i = <value optimized out>
	ieps = <value optimized out>
	ilim = 1105199112
	ilim1 = -1
	j = <value optimized out>
	j1 = <value optimized out>
	k = 621764783
	k_check = 1
	leftright = 1
	m2 = 0
	m5 = 0
	s2 = 621765855
	s5 = 621764783
	spec_case = <value optimized out>
	try_quick = <value optimized out>
	L = <value optimized out>
	denorm = 0
	x = <value optimized out>
	b = (Bigint *) 0x2e43f8
	b1 = <value optimized out>
	delta = <value optimized out>
	mlo = <value optimized out>
	mhi = <value optimized out>
	S = (Bigint *) 0x2dfd10
	d2 = 1.0430373231079063e-307
	ds = <value optimized out>
	eps = <value optimized out>
	s = <value optimized out>
#4  0x4005692c in JS_dtostr (buffer=0xbef208ac "�\021\004@h�\006", 
    bufferSize=26, mode=DTOSTR_STANDARD, precision=0, d=2147500034)
    at jsdtoa.c:2771
	decPt = <value optimized out>
	sign = <value optimized out>
	nDigits = <value optimized out>
	numBegin = 0xbef208ae "\004@h�\006"
	numEnd = <value optimized out>
	dtoaRet = <value optimized out>
#5  0x4008eba8 in js_NumberToString (cx=0x6b768, d=2147500034)
    at jsnum.c:724
	buf = "�\021\004@h�\006\000\000\000\000\000\000\000\000\000�\t���\b��\000\020"
	numStr = <value optimized out>
#6  0x400c8d58 in js_ValueToString (cx=0x6b768, v=2921842)
    at jsstr.c:2689
	obj = <value optimized out>
	str = <value optimized out>
#7  0x40066548 in js_ReportUncaughtException (cx=0x6b768)
    at jsexn.c:1290
	exn = 440208
	exnObject = (JSObject *) 0x0
	vp = {0, 0, 0, 0, 0}
	tvr = {down = 0x0, count = 0, u = {value = 440208, 
    object = 0x6b790, string = 0x6b790, xml = 0x6b790, 
    qname = 0x6b790, nspace = 0x6b790, marker = 0x6b790, 
    sprop = 0x6b790, weakRoots = 0x6b790, script = 0x6b790, 
    array = 0x6b790}}
	reportp = (JSErrorReport *) 0x0
	report = {filename = 0x0, lineno = 0, linebuf = 0x0, 
  tokenptr = 0x0, uclinebuf = 0x0, uctokenptr = 0x0, flags = 0, 
  errorNumber = 0, ucmessage = 0x0, messageArgs = 0x0}
	str = <value optimized out>
	bytes = <value optimized out>
	ok = <value optimized out>
#8  0x400326a8 in JS_CallFunctionValue (cx=0x6b768, 
    obj=<value optimized out>, fval=<value optimized out>, 
    argc=<value optimized out>, argv=0x6b768, rval=0x42c8d910)
    at jsapi.c:4390
	ok = 0
#9  0x42c8d910 in nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject
    (this=<value optimized out>, ccx=<value optimized out>, 
    jsobj=0x2c9510, aIID=@0x42cac1f8) at xpcwrappedjsclass.cpp:278
	args = {2921816}
	retval = <value optimized out>
	retObj = <value optimized out>
	fun = 1120461140
	_val_247 = {mVal = 2921760, mValPtr = 0xbef209b4}
	cx = (JSContext *) 0x6b768
	id = <value optimized out>
	funid = <value optimized out>
	_automarker_247 = {<AutoMarkingPtr> = {
    _vptr.AutoMarkingPtr = 0x42cd98e0, mNext = 0x0, 
    mTLS = 0x6b408}, mPtr = 0xbef209b4}
	scriptEval = {mJSContext = 0x6b768, mState = 0x0, 
  mOldErrorReporter = 0x42ca7070 <mozJSLoaderErrorReporter(JSContext*, char const*, JSErrorReport*)>, mEvaluated = 1, 
  mContextHasThread = 211336}
#10 0x42c8d988 in nsXPCWrappedJSClass::GetRootJSObject (
    this=0x165750, ccx=@0xbef20aa8, aJSObj=0x2c9510)
    at xpcwrappedjsclass.cpp:674
No locals.
#11 0x42c89940 in nsXPCWrappedJS::GetNewOrUsed (ccx=@0xbef20aa8, 
    aJSObj=0x2c9510, aIID=@0x42cb4030, 
    aOuter=<value optimized out>, wrapperResult=0xbef20a68)
    at xpcwrappedjs.cpp:242
	root = <value optimized out>
	wrapper = <value optimized out>
	rt = (XPCJSRuntime *) 0x129068
	map = (JSObject2WrappedJSMap *) 0x129238
	rootJSObj = (JSObject *) 0x42cb3f4c
	clazz = (class nsXPCWrappedJSClass *) 0x2c9510
#12 0x42c75a9c in XPCConvert::JSObject2NativeInterface (
    ccx=@0xbef20aa8, dest=0xbef20b98, src=0x2c9510, iid=0x42cb4030, 
    aOuter=0x0, pErr=0xbef20b24) at xpcconvert.cpp:1253
	cx = (JSContext *) 0x6b768
	iface = <value optimized out>
	wrapper = <value optimized out>
	rv = <value optimized out>
#13 0x42c5c2c8 in nsXPConnect::WrapJS (this=<value optimized out>, 
    aJSContext=0x6b768, aJSObj=0x2c9510, aIID=@0x42cb4030, 
    result=0xbef20b98) at nsXPConnect.cpp:647
	ccx = {<nsIXPCNativeCallContext> = {<nsISupports> = {
      _vptr.nsISupports = 0x42cd9c98}, <No data fields>}, 
  mRefCnt = {mValue = 0}, _mOwningThread = {mThread = 0x33988}, 
  mState = XPCCallContext::HAVE_CONTEXT, mXPC = 0x129030, 
  mThreadData = 0x6b408, mXPCContext = 0x12ceb0, 
  mJSContext = 0x6b768, mContextPopRequired = 1, 
  mDestroyJSContextInDestructor = 0, 
  mCallerLanguage = XPCContext::LANG_NATIVE, 
  mPrevCallerLanguage = XPCContext::LANG_UNKNOWN, 
  mPrevCallContext = 0x0, mOperandJSObject = 0xbef20b34, 
  mCurrentJSObject = 0x14c, mFlattenedJSObject = 0x40092984, 
  mWrapper = 0x40111000, mTearOff = 0x2c9510, 
  mScriptableInfo = 0x6b768, mSet = 0x1, mInterface = 0xbef20b34, 
  mMember = 0x40093be0, mName = 2921808, 
  mStaticMemberIsLocal = 440168, mArgc = 438640, mArgv = 0x2c9510, 
  mRetVal = 0x2c9510, mExceptionWasThrown = -1091433572, 
  mReturnValueWasSet = 440168, mMethodIndex = 1, mCallee = 0x0}
	rv = <value optimized out>
#14 0x42ca5de8 in mozJSComponentLoader::ModuleForLocation (
    this=0x6b170, 
    registryLocation=0x2da048 "rel:nsMailDefaultHandler.js", 
    component=<value optimized out>, status=0xbef20d0c)
    at mozJSComponentLoader.cpp:1007
	rv = 0
	cm_holder = {mRawPtr = 0x2e4458}
	argv = {2921800, 2921812}
	retval = 2921744
	module = <value optimized out>
	he = <value optimized out>
	cx = {mContext = 0x6b768, mContextThread = 211336}
	cm_jsobj = (JSObject *) 0xbef20bac
	aers = {mContext = 0x6b768, mOldReporter = 0}
	jsModuleObj = (JSObject *) 0xbef20bbc
	hash = <value optimized out>
	hep = <value optimized out>
	xpc = {mRawPtr = 0x129030}
	NSGetModule_val = 0
	global = (JSObject *) 0x2c9548
#15 0x42ca6348 in mozJSComponentLoader::AttemptRegistration (
    this=0x6b170, component=0x2dc360, 
    deferred=<value optimized out>) at mozJSComponentLoader.cpp:761
	registryLocation = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x40229d80, 
        mData = 0x2da048 "rel:nsMailDefaultHandler.js", 
        mLength = 27, 
        mFlags = 9}, <No data fields>}, <No data fields>}, <No data fields>}
	rv = 0
	module = (class nsIModule *) 0xbef20db8
	observerService = {mRawPtr = 0x0}
	obsoleteManager = {mRawPtr = 0x63870}
	mgr = {mRawPtr = 0x17}
	fileName = {<nsAutoString> = {<nsFixedString> = {<nsString> = {<nsSubstring> = {<nsAString_internal> = {mVTable = 0x2dc3e8, 
            mData = 0x2dc3c8, mLength = 3203533924, 
            mFlags = 2999272}, <No data fields>}, <No data fields>}, mFixedCapacity = 182, mFixedBuf = 0x401ce30c}, mStorage = {5, 0, 
      183, 0, 3160, 48882, 20652, 16413, 3160, 48882, 42940, 16412, 
      29627, 10, 3424, 16413, 40320, 16418, 55516, 16413, 0, 0, 
      58428, 16412, 3384, 48882, 0, 0, 23, 0, 23, 0, 50016, 45, 0, 
      0, 3520, 48882, 59668, 16412, 24, 0, 0, 0, 188, 16409, 0, 0, 
      0, 0, 3384, 48882, 50252, 45, 3384, 48882, 50016, 45, 3408, 
      48882, 23, 0, 60200, 16412}}, <No data fields>}
#16 0x42ca67e8 in mozJSComponentLoader::AutoRegisterComponent (
    this=0x6b170, when=<value optimized out>, component=0x2dc360, 
    registered=0xbef20db8) at mozJSComponentLoader.cpp:688
	rv = <value optimized out>
	jsExtension = ".js"
	leafName = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x40229d80, 
          mData = 0xbef20d50 "nsMailDefaultHandler.js", 
          mLength = 23, 
          mFlags = 65553}, <No data fields>}, <No data fields>}, 
    mFixedCapacity = 63, 
    mFixedBuf = 0xbef20d50 "nsMailDefaultHandler.js"}, 
  mStorage = "nsMailDefaultHandler.js\000\030[1J\000\000\000\000A51J\000\000\000\000A51J\000\000\000\000��h\000\000\000\000\000�\r��\004\006\031@"}
	isFile = -1091433012
#17 0x42ca3268 in mozJSComponentLoader::RegisterComponentsInDir (
    this=0x6b170, when=0, dir=<value optimized out>)
    at mozJSComponentLoader.cpp:596
	registered = 0
	rv = <value optimized out>
	isDir = -1091433016
	dirIterator = {mRawPtr = 0x6b210}
	dirEntry = (class nsIFile *) 0x0
	more = 0
#18 0x40197eb4 in nsComponentManagerImpl::AutoRegisterNonNativeComponents (this=0x63850, spec=<value optimized out>)
    at nsComponentManager.cpp:3262
	i = 2
	rv = <value optimized out>
	directory = {mRawPtr = 0x6d560}
#19 0x401993bc in nsComponentManagerImpl::AutoRegisterImpl (
    this=0x63850, when=<value optimized out>, 
    inDirSpec=<value optimized out>, 
    fileIsCompDir=<value optimized out>)
    at nsComponentManager.cpp:3232
	dir = {mRawPtr = 0x6d560}
	rv = 2
	iim = {mRawPtr = 0x6d8c8}
	loaderEnum = {mRawPtr = 0x6db88}
	hasMore = -1091432776
#20 0x4019951c in nsComponentManagerImpl::AutoRegister (
    this=0x63850, aSpec=0x0) at nsComponentManager.cpp:3404
	directory = <value optimized out>
#21 0x4014a7e4 in NS_InitXPCOM3_P (result=<value optimized out>, 
    binDirectory=<value optimized out>, 
    appFileLocationProvider=0xbef2125c, 
    staticComponents=<value optimized out>, componentCount=1)
    at nsXPComInit.cpp:635
	dirList = {mRawPtr = 0x0}
	compregFile = {mRawPtr = 0xbef20f70}
	rv = 2152857618
	compMgr = <value optimized out>
	registrar = {mRawPtr = 0x63858}
	iim = <value optimized out>
	memory = {mRawPtr = 0x4022a910}
#22 0x0000d0a4 in ScopedXPCOMStartup::Initialize (this=0xbef20ffc)
    at nsAppRunner.cpp:807
	rv = <value optimized out>
#23 0x0000d8b4 in ImportProfiles (aPService=0x63988, 
    aNative=0x61650) at nsAppRunner.cpp:1719
	xpcom = {mServiceManager = 0x63854}
#24 0x0000eba0 in SelectProfile (aResult=0xbef21368, 
    aNative=0x61650, aStartOffline=<value optimized out>)
    at nsAppRunner.cpp:1884
	rv = 0
	count = 299
	useDefault = <value optimized out>
	ar = <value optimized out>
	arg = 0x0
	profileSvc = {mRawPtr = 0x63988}
#25 0x0000f974 in XRE_main (argc=<value optimized out>, 
    argv=<value optimized out>, aAppData=<value optimized out>)
    at nsAppRunner.cpp:2528
	ar = <value optimized out>
	glib2 = (PRLibrary *) 0xbef21380
	profLD = {mRawPtr = 0x4000970c}
	rv = 0
	dirProvider = {<nsIDirectoryServiceProvider2> = {<nsIDirectoryServiceProvider> = {<nsISupports> = {
        _vptr.nsISupports = 0x31be0}, <No data fields>}, <No data fields>}, <nsIProfileStartup> = {<nsISupports> = {
      _vptr.nsISupports = 0x31c04}, <No data fields>}, mAppDir = {
    mRawPtr = 0x34bf0}, mXULAppDir = {mRawPtr = 0x0}, 
  mProfileDir = {mRawPtr = 0x0}, mProfileLocalDir = {
    mRawPtr = 0x0}, mProfileNotified = 0}
	nativeApp = {mRawPtr = 0x61650}
	startOffline = 0
	upgraded = <value optimized out>
	versionOK = <value optimized out>
	appInitiatedRestart = <value optimized out>
	i = <value optimized out>
	canRun = -1091431564
	xremotearg = <value optimized out>
	profileLock = {mRawPtr = 0x0}
	profD = {mRawPtr = 0x400255dc}
	version = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x4001ae78, 
          mData = 0x6 <Address 0x6 out of bounds>, 
          mLength = 3203535352, 
          mFlags = 3203535588}, <No data fields>}, <No data fields>}, mFixedCapacity = 7977666, mFixedBuf = 0x4028fcc0 ""}, 
  mStorage = "\000\000\000\000\000\000\000\000\001\000\000\000Y\000\000\000�s\036AP�\001@ҳ%@�\017)@�\212%@\001\000\000\0000\022��`�\001@�\022��\000\000\000\000\r\000\000\000\000�*@"}
	needsRestart = <value optimized out>
	gtkModules = <value optimized out>
	registryFile = {mRawPtr = 0x626a0}
	osABI = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0xbef21384, mData = 0xbef21378 "\001", 
        mLength = 311133519, 
        mFlags = 1089642996}, <No data fields>}, <No data fields>}, <No data fields>}
#26 0x40e2906c in __libc_start_main () from /lib/vfp/libc.so.6
No symbol table info available.
#27 0x0000af2c in _start ()
No locals.
(gdb)

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-15:

#6

I've been talking with Alexander Sac. As it stands, Thunderbird 3 properly works, and there has been no code changes that could explain the working behavior in mult() or Balloc(); there have been considerable changes elsewhere in Thunderbird 3, which would make isolating the specific change to correct the segfault extremely difficult, and time consuming, and even if the specific commit is isolated, it may not be backport-able.

According to asac, TB 2 is mostly inactive, and its unlikely there would be consider help in resolving this issue; and searching the Mozilla bugzilla has not turned up any bugs opened or provided any clues on what was changed to fix the crash in TB3.

Revision history for this message

Loïc Minier (lool) wrote on 2009-06-15:

#7

The backtrace in https://bugzilla.mozilla.org/show_bug.cgi?id=385583 looks similar; this bug relates to ARM EABI support and the patch seems to apply to thunderbird/mozilla/nsprpub; it looks like it could fix this bug:
https://bug385583.bugzilla.mozilla.org/attachment.cgi?id=347009

Revision history for this message

Loïc Minier (lool) wrote on 2009-06-16:

#8

I think we want to patch the nspr source package where this patch seems to apply; thunderbird bdeps on libnspr4-dev.

Revision history for this message

Dave Martin (dave-martin-arm) wrote on 2009-06-16:

#9

If tb2 can't easily be fixed, will tb3 be made available in jaunty as a backport or update?

I'd be concerned if there will not be any working version of tb at all in jaunty.

Revision history for this message

Loïc Minier (lool) wrote on 2009-06-16:

#10

libnspr4-0d_4.7.3-0ubuntu2arm1_armel.deb Edit (127.3 KiB, application/x-debian-package)

Alexander uploaded a fixed nspr to karmic; could someone please confirm it fixes the bug?

I've added this patch alone to jaunty's nspr; I'd love if someone could confirm the attached .deb fixes the issue for jaunty.

Revision history for this message

Dave Martin (dave-martin-arm) wrote on 2009-06-16:

#11

Doesn't seem to work for me, I'm afraid. Thunderbird (2.0.0.21+nobinonly-0ubuntu1.9.04.1) still segfaults with the same symptoms.

Revision history for this message

Loïc Minier (lool) wrote on 2009-06-16:

#12

Ah, asac recommended respinning Thunderbird which definitely makes sense: these are macros used all over the place, the code is not necessarily in the nspr shared lib. asac will push a respin of tb to karmic.

Revision history for this message

Dave Martin (dave-martin-arm) wrote on 2009-06-16:

#13

Download full text (4.6 KiB)

MOZILLA_FIVE_HOME=.
  LD_LIBRARY_PATH=.:./plugins:.
DISPLAY=:0.0
DYLD_LIBRARY_PATH=.:.
     LIBRARY_PATH=.:./components:.
       SHLIB_PATH=.:.
          LIBPATH=.:.
       ADDON_PATH=.
      MOZ_PROGRAM=/usr/lib/thunderbird/thunderbird-bin
      MOZ_TOOLKIT=
        moz_debug=1
     moz_debugger=gdb
/usr/bin/gdb /usr/lib/thunderbird/thunderbird-bin -x /tmp/mozargs.ZsTAko
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabi"...
(gdb) r
Starting program: /usr/lib/thunderbird/thunderbird-bin
[Thread debugging using libthread_db enabled]
[New Thread 0x40f6b4c0 (LWP 7214)]
[New Thread 0x42e30440 (LWP 7217)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x40f6b4c0 (LWP 7214)]
0x4004899c in mult (a=0x2d9400, b=0x2d9420) at jsdtoa.c:659
659 jsdtoa.c: No such file or directory.
in jsdtoa.c
Current language: auto; currently c
(gdb) backtrace
#0 0x4004899c in mult (a=0x2d9400, b=0x2d9420) at jsdtoa.c:659
#1 0x40049598 in pow5mult (b=0x2d9420, k=1185) at jsdtoa.c:789
#2 0x4004b738 in JS_dtostr (buffer=0xbe9a5846 "Ã@\020\204\a",
    bufferSize=621765855, mode=DTOSTR_STANDARD, precision=0,
    d=8.2265532824141687e-308) at jsdtoa.c:2493
#3 0x40073aac in js_NumberToString (cx=0x783f8, d=2147500034) at jsnum.c:724
#4 0x400a3b2c in js_ValueToString (cx=0x783f8, v=3101778) at jsstr.c:2689
#5 0x400595a4 in js_ReportUncaughtException (cx=0x783f8) at jsexn.c:1290
#6 0x40032428 in JS_CallFunctionValue (cx=0x783f8,
    obj=<value optimized out>, fval=<value optimized out>,
    argc=<value optimized out>, argv=0xbe9a5964, rval=0x783f8) at jsapi.c:4390
#7 0x4174ed40 in nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject (
    this=<value optimized out>, ccx=<value optimized out>, jsobj=0x2f53e8,
    aIID=@0x41765bb8) at xpcwrappedjsclass.cpp:278
#8 0x4174ee24 in nsXPCWrappedJSClass::GetRootJSObject (this=0x2d9460,
    ccx=@0x2d9400, aJSObj=0x0) at xpcwrappedjsclass.cpp:674
#9 0x4174c38c in nsXPCWrappedJS::GetNewOrUsed (ccx=@0xbe9a5a1c,
    aJSObj=0x2f53e8, aIID=@0x41768d60, aOuter=0x0, wrapperResult=0xbe9a59d4)
    at xpcwrappedjs.cpp:242
#10 0x4173e388 in XPCConvert::JSObject2NativeInterface (ccx=@0xbe9a5a1c,
    dest=0xbe9a5af4, src=0x2f53e8, iid=0x41768d60, aOuter=0x0,
    pErr=0xbe9a5a94) at xpcconvert.cpp:1253
#11 0x4173120c in nsXPConnect::WrapJS (this=<value optimized out>,
    aJSContext=<value optimized out>, aJSObj=0x2f53e8, aIID=@0x41768d60,
    result=0xbe9a5af4) at nsXPConnect.cpp:647
#12 0x41763280 in mozJSComponentLoader::ModuleForLocation (this=0x8ac38,
    registryLocation=0x2bf868 "rel:nsMailDefaultHandler.js",
    component=<value optimized out>, status=0xbe9a5c5c)
    at mozJSComponentLoader.cpp:1007
#13 0x4176377c in mozJSComponentLoader::AttemptRegistration (this=0x8ac38,
    component=0x274260, deferred=2573064) at mozJSComponentLoader.cpp:761
#14 0x41763c50 in mozJSComponentLoader...

After another round of debugging this weekend, and googling, I managed to make some progress on this. Here's a quick technical examination; The initial issue is caused by a change on old ARM ABI, and new ARM ABI with respect to the handling of floating point operations. Without going into too much detail, the main issue came from the behavior of OABI ARM when using the FPA API; although ARM is traditionally a little endian architecture (with a handful of big-endian systems existing), in OABI ARM, the FPU (or FPU emulation) always took big-endian formatted doubles vs. little-endian doubles; any application which did bitwise operations on doubles needed to be aware of this and treat any doubles as big-endian while handling any non-FPU operation as little-endian. On EABI systems which mandate the VFP FPU format, all doubles are little-endian; newer versions of thunderbird and firefox have been properly patched to handle this, but thunderbird lacked the necessary change.

I was tipped off to this quirk in OABI ARM by http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=215067, which shows that NSPR segfaults if you try to pass very large numbers into it. A look at the backtrace reveals this happens in in the Javascript library; specifically:

#3 0x40073aac in js_NumberToString (cx=0x783f8, d=2147500034) at jsnum.c:724
 
and the end result can be seen in:

#2 0x4004b738 in JS_dtostr (buffer=0xbe9a5846 "Ã@\020\204\a",
    bufferSize=621765855, mode=DTOSTR_STANDARD, precision=0,
    d=8.2265532824141687e-308) at jsdtoa.c:2493

(this function coverts a double to a string, with d going in being close to the max. size of doubles on the ARM architecture).

The value is then passed into NSPR, which tries to use memory more memory than its allocated, and promptly segfaults (a more indepth explination of this behavior is in the original Debian bug). Loic's patch corrects a different behavior in NSPR that prevents mult()/Balloc() from working when using NSPR's user-land thread emulation, and not the system pthreads library; configure output suggests we do indeed use pthreads vs. NSPR's emulation. A couple of grep's later, and I found the necessary preprocessor macro's to change to force LITTLE_ENDIAN behavior in libjzmoz. The upshot is that the import wizard now runs (although it comes up with the window very large), and then thunderbird segfaults again, this time in fontconfig (the backtrace is incomplete, I'll post a more complete one later).

As it stands, I need to clean up my patch and source tree, so I'll post my current debdiff once I do that so others can continue to build off the work I've started. I'm hoping the current segfault is simply a side-effect from a non-clean build-environment.

My current backtrace:
(gdb) bt
#0  FcPatternObjectAddWithBinding (p=0x0, object=1, value=
        {type = 3439344, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 2.121995791459338e-314, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, binding=390632, append=1) at fcpat.c:476
#1  0x40a37230 in FcPatternObjectAdd (p=0x0, object=1, value=
        {type = 3439344, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 495.00000000000006, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, append=3) at fcpat.c:545
#2  0x40a37310 in FcPatternObjectAddString (p=0x0, object=1, s=<value optimized out>)
    at fcpat.c:664
#3  0x407c7a30 in ?? () from /usr/lib/vfp/libpangoft2-1.0.so.0
#4  0x4096e5cc in pango_font_map_load_fontset () from /usr/lib/vfp/libpango-1.0.so.0
#5  0x4096c514 in ?? () from /usr/lib/vfp/libpango-1.0.so.0
#6  0x4096cb4c in pango_itemize_with_base_dir () from /usr/lib/vfp/libpango-1.0.so.0
#7  0x40974af4 in ?? () from /usr/lib/vfp/libpango-1.0.so.0
#8  0x40977d48 in pango_layout_get_unknown_glyphs_count () from /usr/lib/vfp/libpango-1.0.so.0
#9  0x4037a200 in ?? () from /usr/lib/vfp/libgtk-x11-2.0.so.0
#10 0x40381f94 in ?? () from /usr/lib/vfp/libgtk-x11-2.0.so.0
#11 0x40a80c04 in g_type_create_instance () from /usr/lib/libgobject-2.0.so.0
#12 0x40a62518 in ?? () from /usr/lib/libgobject-2.0.so.0
#13 0x40a62fc8 in g_object_newv () from /usr/lib/libgobject-2.0.so.0
#14 0x40a63aec in g_object_new_valist () from /usr/lib/libgobject-2.0.so.0
#15 0x40a63c5c in g_object_new () from /usr/lib/libgobject-2.0.so.0
#16 0x42b65cf8 in nsLookAndFeel::GetMetric (this=<value optimized out>, 
    aID=nsILookAndFeel::eMetric_SelectTextfieldsOnKeyFocus, aMetric=@0xbea3ecd0)
    at nsLookAndFeel.cpp:379
#17 0x43aab644 in nsEventStateManager::Init (this=<value optimized out>)
    at nsEventStateManager.cpp:323
#18 0x4384d200 in nsPresContext::Init (this=0x3421b8, aDeviceContext=<value optimized out>)
    at nsPresContext.cpp:722
#19 0x4383928c in DocumentViewerImpl::InitInternal (this=0x341d10, aParentWidget=0x251950, 
    aState=<value optimized out>, aDeviceContext=0x341f30, aBounds=@0xbea3ef44, 
    aDoCreation=1, aInPrintPreview=0) at nsDocumentViewer.cpp:805
#20 0x43839bcc in DocumentViewerImpl::Init (this=0x0, aParentWidget=0x0, 
    aDeviceContext=0x43839bcc, aBounds=<value optimized out>) at nsDocumentViewer.cpp:637
#21 0x424600d8 in nsDocShell::SetupNewViewer (this=0x260a38, aNewViewer=<value optimized out>)
    at nsDocShell.cpp:6155
#22 0x42458fc4 in nsDocShell::Embed (this=0x260a38, aContentViewer=0x341d10, 
    aCommand=<value optimized out>, aExtraInfo=<value optimized out>) at nsDocShell.cpp:4660
#23 0x42462760 in nsDocShell::CreateAboutBlankContentViewer (this=0x260a38)
    at nsDocShell.cpp:5065
#24 0x424630dc in nsDocShell::EnsureContentViewer (this=0x260a38) at nsDocShell.cpp:4944
#25 0x4246b744 in nsDocShell::GetInterface (this=0x260a38, aIID=@0x43cfd7bc, aSink=0xbea3f178)
    at nsDocShell.cpp:428
#26 0x401455b4 in nsGetInterface::operator() (this=0xbea3f194, aIID=@0x43cfd7bc, 
    aInstancePtr=0xbea3f178) at nsIInterfaceRequestorUtils.cpp:53
#27 0x4399732c in nsCOMPtr<nsIDOMDocument>::assign_from_helper (this=0xbea3f1a0, 
    helper=<value optimized out>, aIID=<value optimized out>)
    at ../../../dist/include/xpcom/nsCOMPtr.h:1292
#28 0x439981c4 in nsCOMPtr (this=0xbea3f1a0, helper=@0xbea3f194)
    at ../../../dist/include/xpcom/nsCOMPtr.h:694
#29 0x43ba2c24 in nsGlobalWindow::GetDocument (this=<value optimized out>, 
    aDocument=0xbea3f1c4) at nsGlobalWindow.cpp:1970
#30 0x42d06ac4 in nsWindowWatcher::URIfromURL (aURL=0x33ade0 "chrome://messenger/content/", 
    aParent=<value optimized out>, aURI=0xbea3f508) at nsWindowWatcher.cpp:1329
#31 0x42d072a4 in nsWindowWatcher::OpenWindowJSInternal (this=<value optimized out>, 
    aParent=0x0, aUrl=0x33ade0 "chrome://messenger/content/", aName=0x33ae18 "_blank", 
    aFeatures=0x33b368 "chrome,dialog=no,all", aDialog=1, argc=1, argv=0x33e9a4, 
    aCalledFromJS=0, _retval=0x33e9a4) at nsWindowWatcher.cpp:577
#32 0x42d08914 in nsWindowWatcher::OpenWindow (this=0x15a000, aParent=0x0, 
    aUrl=0x33ade0 "chrome://messenger/content/", aName=0x33ae18 "_blank", 
    aFeatures=0x33b368 "chrome,dialog=no,all", aArguments=0x401ca2f4, _retval=0xbea3f720)
    at nsWindowWatcher.cpp:478
#33 0x401ca2f4 in XPTC_InvokeByIndex (that=<value optimized out>, methodIndex=0, 
    paramCount=215672, params=0x1) at xptcinvoke_arm.cpp:217
#34 0xbea3f774 in ?? ()

Changed in thunderbird (Ubuntu Jaunty):
assignee:	nobody → Michael Casadevall (mcasadevall)
importance:	Undecided → Medium
milestone:	none → jaunty-updates
status:	New → Confirmed

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-23:

#16

GDB backtrace. Edit (31.3 KiB, text/plain)

Here's my current debdiff and gdb backtrace (as complete as I can get it; something in Thunderbird is preventing from seeing the entire stack). It seems we might have tripped a pango/fontconfig bug, as it seems too deep in the pango stack to be a bug from thunderbird. Googling around reveals this gem of a bug report: https://bugs.maemo.org/show_bug.cgi?id=3150

Since I'm currently building thunderbird -O0 to help improve backtraces, its possible I'm tripped the bug reported in maemo. I'm currently rebuilding TB2 with its normal optimization settings to see if it changes anything.

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-23:

#17

tunderbird debug debdiff Edit (3.5 KiB, text/plain)

Revision history for this message

Loïc Minier (lool) wrote on 2009-06-23:

#18

I've backported upstream commit 2538:3f78d5e894bc from http://hg.mozilla.org/releases/mozilla-1.9.1/ which carries a similar change and also clarifies the macro names and comments.

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-24:

#19

Download full text (33.6 KiB)

Here's a more complete backtrace with debugging enable and -O0 on pango and fontconfig. I tested TB with --disable-pango, no change in the trace, so it seems this issue is not TB specific.

mcasadevall@dawn:~/src/thunderbird-2.0.0.22+build1+nobinonly/build-tree/mozilla$ dist/bin/thunderbird -g
dist/bin/run-mozilla.sh -g dist/bin/thunderbird-bin
MOZILLA_FIVE_HOME=dist/bin
  LD_LIBRARY_PATH=dist/bin:dist/bin/plugins:/usr/lib/mre/mre-2.0.0.22
DISPLAY=localhost:10.0
DYLD_LIBRARY_PATH=dist/bin:/usr/lib/mre/mre-2.0.0.22
     LIBRARY_PATH=dist/bin:dist/bin/components:/usr/lib/mre/mre-2.0.0.22
       SHLIB_PATH=dist/bin:/usr/lib/mre/mre-2.0.0.22
          LIBPATH=dist/bin:/usr/lib/mre/mre-2.0.0.22
       ADDON_PATH=dist/bin
      MOZ_PROGRAM=dist/bin/thunderbird-bin
      MOZ_TOOLKIT=
        moz_debug=1
     moz_debugger=
/usr/bin/gdb dist/bin/thunderbird-bin -x /tmp/mozargs.CSf6z5
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabi"...
(gdb) set pagination 0
(gdb) handle SIG33 pass nostop noprint
Signal Stop Print Pass to program Description
SIG33 No No Yes Real-time event 33
(gdb) r
Starting program: /home/mcasadevall/src/thunderbird-2.0.0.22+build1+nobinonly/build-tree/mozilla/dist/bin/thunderbird-bin
[Thread debugging using libthread_db enabled]
[New Thread 0x412365f0 (LWP 11375)]
Type Manifest File: /home/mcasadevall/.mozilla-thunderbird/am3ei364.default/xpti.dat
*** Registering Apprunner components (all right -- a generic module!)
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nsNativeComponentLoader: registering deferred (0)
pldhash: for the table at address 0xb45c0, the given entrySize of 44 probably favors chaining over double hashing.
[New Thread 0x42291430 (LWP 11378)]
[New Thread 0x435bf430 (LWP 11380)]
GFX: dpi=96 t2p=0.0666667 p2t=15 depth=24
++WEBSHELL == 1
[New Thread 0x4479c430 (LWP 11381)]
++DOMWINDOW == 1

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x412365f0 (LWP 11375)]
FcPatternObjectAddWithBinding (p=0x0, object=1, value={type = 3448088, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 2.121995791459338e-314, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, binding=FcValueBindingStrong, append=1) at fcpat.c:476
476 if (p->ref == FC_REF_CONSTANT)
Current language: auto; currently c
(gdb) backtrace full
#0 FcPatternObjectAddWithBinding (p=0x0, object=1, value={type = 3448088, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 2.121995791459338e-314, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, binding=FcValueBindingStrong, append=1) at fcpat.c:476
e = <value optimized out>
new = <value optimized out>
prev = <value optimized out>
#1 0x40a64c10 in FcPatternObjectAdd (p=0x0, object=1, value={type = 3448088, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 4.9406564584124654e-324, m = 0x1, c = 0x1, f ...

Here's a more complete backtrace with debugging enable and -O0 on pango and fontconfig. I tested TB with --disable-pango, no change in the trace, so it seems this issue is not TB specific.

mcasadevall@dawn:~/src/thunderbird-2.0.0.22+build1+nobinonly/build-tree/mozilla$ dist/bin/thunderbird -g
dist/bin/run-mozilla.sh -g dist/bin/thunderbird-bin
MOZILLA_FIVE_HOME=dist/bin
  LD_LIBRARY_PATH=dist/bin:dist/bin/plugins:/usr/lib/mre/mre-2.0.0.22
DISPLAY=localhost:10.0
DYLD_LIBRARY_PATH=dist/bin:/usr/lib/mre/mre-2.0.0.22
     LIBRARY_PATH=dist/bin:dist/bin/components:/usr/lib/mre/mre-2.0.0.22
       SHLIB_PATH=dist/bin:/usr/lib/mre/mre-2.0.0.22
          LIBPATH=dist/bin:/usr/lib/mre/mre-2.0.0.22
       ADDON_PATH=dist/bin
      MOZ_PROGRAM=dist/bin/thunderbird-bin
      MOZ_TOOLKIT=
        moz_debug=1
     moz_debugger=
/usr/bin/gdb dist/bin/thunderbird-bin -x /tmp/mozargs.CSf6z5
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabi"...
(gdb) set pagination 0
(gdb) handle SIG33 pass nostop noprint
Signal        Stop	Print	Pass to program	Description
SIG33         No	No	Yes		Real-time event 33
(gdb) r
Starting program: /home/mcasadevall/src/thunderbird-2.0.0.22+build1+nobinonly/build-tree/mozilla/dist/bin/thunderbird-bin 
[Thread debugging using libthread_db enabled]
[New Thread 0x412365f0 (LWP 11375)]
Type Manifest File: /home/mcasadevall/.mozilla-thunderbird/am3ei364.default/xpti.dat
*** Registering Apprunner components (all right -- a generic module!)
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nsNativeComponentLoader: registering deferred (0)
pldhash: for the table at address 0xb45c0, the given entrySize of 44 probably favors chaining over double hashing.
[New Thread 0x42291430 (LWP 11378)]
[New Thread 0x435bf430 (LWP 11380)]
GFX: dpi=96 t2p=0.0666667 p2t=15 depth=24
++WEBSHELL == 1
[New Thread 0x4479c430 (LWP 11381)]
++DOMWINDOW == 1

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x412365f0 (LWP 11375)]
FcPatternObjectAddWithBinding (p=0x0, object=1, value={type = 3448088, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 2.121995791459338e-314, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, binding=FcValueBindingStrong, append=1) at fcpat.c:476
476	    if (p->ref == FC_REF_CONSTANT)
Current language:  auto; currently c
(gdb) backtrace full
#0  FcPatternObjectAddWithBinding (p=0x0, object=1, value={type = 3448088, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 2.121995791459338e-314, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, binding=FcValueBindingStrong, append=1) at fcpat.c:476
	e = <value optimized out>
	new = <value optimized out>
	prev = <value optimized out>
#1  0x40a64c10 in FcPatternObjectAdd (p=0x0, object=1, value={type = 3448088, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 4.9406564584124654e-324, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, append=3) at fcpat.c:545
No locals.
#2  0x40a64cf0 in FcPatternObjectAddString (p=0x0, object=1, s=<value optimized out>) at fcpat.c:664
	v = {type = FcTypeString, u = {s = 0x349d18 "Sans", i = 3448088, b = 3448088, d = 2854.5937515680089, m = 0x349d18, c = 0x349d18, f = 0x349d18, l = 0x349d18}}
#3  0x407bea04 in pango_fc_make_pattern (description=0x3446c0, language=0x34dfec, pixel_size=13653, dpi=96) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pangofc-fontmap.c:1470
	pattern = (FcPattern *) 0x0
	prgname = 0x118058 "gecko"
	slant = 0
	weight = 80
	gravity = PANGO_GRAVITY_SOUTH
	vertical = 0
	families = (char **) 0x349d00
	i = 0
	width = 100
#4  0x407bf0b8 in pango_fc_fontset_key_make_pattern (key=0xbe94c2dc) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pangofc-fontmap.c:1625
No locals.
#5  0x407bf0ec in pango_fc_font_map_get_patterns (fontmap=0x601e8, key=0xbe94c2dc) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pangofc-fontmap.c:1639
	fcfontmap = (PangoFcFontMap *) 0x601e8
	patterns = (PangoFcPatterns *) 0x62aa0
	pattern = (FcPattern *) 0x0
#6  0x407bf404 in pango_fc_font_map_load_fontset (fontmap=0x601e8, context=0x2e4890, desc=0x344260, language=0x34dfec) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pangofc-fontmap.c:1742
	patterns = (PangoFcPatterns *) 0xbe94c9b8
	fcfontmap = (PangoFcFontMap *) 0x601e8
	priv = (PangoFcFontMapPrivate *) 0x60208
	fontset = (PangoFcFontset *) 0x0
	key = {fontmap = 0x601e8, language = 0x34dfec, desc = 0x3446c0, matrix = {xx = 1, xy = 0, yx = 0, yy = 1, x0 = 0, y0 = 0}, pixelsize = 13653, resolution = 96, context_key = 0x351118}
#7  0x4098cea0 in pango_font_map_load_fontset (fontmap=0x601e8, context=0x2e4890, desc=0x344260, language=0x34dfec) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-fontmap.c:136
	__PRETTY_FUNCTION__ = "pango_font_map_load_fontset"
#8  0x40989ec4 in itemize_state_update_for_new_run (state=0xbe94c404) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-context.c:1289
No locals.
#9  0x4098a004 in itemize_state_process_run (state=0xbe94c404) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-context.c:1328
	p = 0x0
	last_was_forced_break = 0
	__PRETTY_FUNCTION__ = "itemize_state_process_run"
#10 0x4098a528 in pango_itemize_with_base_dir (context=0x2e4890, base_dir=PANGO_DIRECTION_LTR, text=0x3498f8 "�\227\217", start_index=0, length=3, attrs=0x250f70, cached_iter=0x63340) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-context.c:1467
	state = {context = 0x2e4890, text = 0x3498f8 "�\227\217", end = 0x3498fb "", run_start = 0x3498f8 "�\227\217", run_end = 0x3498fb "", result = 0x0, item = 0x0, embedding_levels = 0x349918 "", embedding_end_offset = 1, embedding_end = 0x3498fb "", embedding = 0 '\0', gravity = PANGO_GRAVITY_AUTO, gravity_hint = PANGO_GRAVITY_HINT_NATURAL, resolved_gravity = PANGO_GRAVITY_SOUTH, font_desc_gravity = PANGO_GRAVITY_AUTO, centered_baseline = 0, attr_iter = 0x63340, free_attr_iter = 0, attr_end = 0x3498fb "", font_desc = 0x344260, lang = 0x34dfec, extra_attrs = 0x25f208, copy_extra_attrs = 0, changed = 31, script_iter = {text_start = 0x3498f8 "�\227\217", text_end = 0x3498fb "", script_start = 0x3498f8 "�\227\217", script_end = 0x3498fb "", script_code = PANGO_SCRIPT_COMMON, paren_stack = {{pair_index = 1073894876, script_code = 1073852024}, {pair_index = 10, script_code = -1097546604}, {pair_index = -1097546368, script_code = 4451990}, {pair_index = 1085150744, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 0, script_code = PANGO_SCRIPT_BOPOMOFO}, {pair_index = 252, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 1073879840, script_code = 1083645437}, {pair_index = 1085172264, script_code = 1083633712}, {pair_index = 1, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 1073876800, script_code = -1097546368}, {pair_index = -1097546380, script_code = 142463690}, {pair_index = 0, script_code = 1083645437}, {pair_index = 0, script_code = -1097546320}, {pair_index = 1073781048, script_code = -1097546380}, {pair_index = 1073895452, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 0, script_code = PANGO_SCRIPT_BOPOMOFO}, {pair_index = 0, script_code = PANGO_SCRIPT_INHERITED}, {pair_index = 0, script_code = 80}, {pair_index = 1073781048, script_code = -1097546340}, {pair_index = 1073893376, script_code = 1073876800}, {pair_index = -1097546288, script_code = 1073876360}, {pair_index = 0, script_code = PANGO_SCRIPT_INHERITED}, {pair_index = 1089962484, script_code = 80}, {pair_index = 536, script_code = 80}, {pair_index = 1073893376, script_code = 1073876800}, {pair_index = -1097546248, script_code = 1073876360}, {pair_index = 64, script_code = 1073877056}, {pair_index = 1089962484, script_code = 1090011688}, {pair_index = 120, script_code = PANGO_SCRIPT_INHERITED}, {pair_index = 0, script_code = PANGO_SCRIPT_GOTHIC}, {pair_index = 1090011136, script_code = 96}, {pair_index = 13, script_code = 1085154776}, {pair_index = 1073879840, script_code = -1097546072}, {pair_index = 236750820, script_code = PANGO_SCRIPT_BENGALI}, {pair_index = 0, script_code = 1092840080}, {pair_index = 1083641184, script_code = 1073876360}, {pair_index = 1073893376, script_code = 1083625472}, {pair_index = 1092838896, script_code = 409748}, {pair_index = -1097546316, script_code = 1073798980}, {pair_index = 1073780736, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 1, script_code = PANGO_SCRIPT_BOPOMOFO}, {pair_index = 0, script_code = 18472}, {pair_index = 3465196, script_code = 3465201}, {pair_index = 96599618, script_code = PANGO_SCRIPT_COPTIC}, {pair_index = 1085307180, script_code = 3465196}, {pair_index = 1085976576, script_code = 3465196}, {pair_index = 0, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 1084035072, script_code = 1085976576}, {pair_index = 1085499152, script_code = 1092838896}, {pair_index = 0, script_code = 1090015276}, {pair_index = 1085089808, script_code = 1092838896}, {pair_index = 680, script_code = 1085089808}, {pair_index = 1085976576, script_code = 1085089808}, {pair_index = 680, script_code = 1076501168}, {pair_index = 1085089808, script_code = 680}, {pair_index = 664, script_code = 700}, {pair_index = 1085552368, script_code = 1085087744}, {pair_index = 3446880, script_code = 1032}, {pair_index = 3446880, script_code = 1085976576}, {pair_index = 1085499152, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 1084956884, script_code = 2477312}, {pair_index = 3033232, script_code = 1085976576}, {pair_index = 1085499152, script_code = 1092838896}, {pair_index = 1084959748, script_code = 1080987016}, {pair_index = 1085976576, script_code = 404136}, {pair_index = 680, script_code = 1085976576}, {pair_index = 1076501168, script_code = 2428944}, {pair_index = 1178624, script_code = 404128}, {pair_index = 404128, script_code = 792}, {pair_index = 1085088536, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 404136, script_code = 1085087744}, {pair_index = 508, script_code = 404128}, {pair_index = 1092833616, script_code = PANGO_SCRIPT_MYANMAR}, {pair_index = 1088830444, script_code = PANGO_SCRIPT_BUGINESE}, {pair_index = 1073780492, script_code = PANGO_SCRIPT_BUGINESE}, {pair_index = 1073894876, script_code = 1073852024}, {pair_index = 12, script_code = -1097546004}, {pair_index = -1097545768, script_code = 91775486}, {pair_index = 1088838200, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 0, script_code = PANGO_SCRIPT_BOPOMOFO}, {pair_index = 169, script_code = 1092835184}, {pair_index = 1073883912, script_code = 1083641480}, {pair_index = 1088871928, script_code = 1083640096}, {pair_index = 1, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 1073876800, script_code = -1097545768}, {pair_index = -1097545780, script_code = -1358151732}, {pair_index = 0, script_code = 1083641480}, {pair_index = 0, script_code = -1097545720}, {pair_index = 1073781048, script_code = -1097545780}, {pair_index = 1073895452, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 1092835184, script_code = PANGO_SCRIPT_BOPOMOFO}, {pair_index = 0, script_code = PANGO_SCRIPT_INHERITED}, {pair_index = 1073895452, script_code = 80}, {pair_index = 0, script_code = PANGO_SCRIPT_BOPOMOFO}, {pair_index = 1073893376, script_code = 1073876800}, {pair_index = -1097545688, script_code = 1073876360}, {pair_index = 1073781048, script_code = -1097545716}, {pair_index = 1073893376, script_code = 1073876800}, {pair_index = -1097545664, script_code = 1073876360}, {pair_index = 0, script_code = PANGO_SCRIPT_INHERITED}, {pair_index = 1085089808, script_code = 80}, {pair_index = 680, script_code = 1085089808}, {pair_index = 1073893376, script_code = 1073876800}, {pair_index = -1097545624, script_code = 1073876360}, {pair_index = 1073780440, script_code = 1076492244}, {pair_index = 1073894876, script_code = 1073852024}, {pair_index = 1092833592, script_code = 1088840904}, {pair_index = 1073883912, script_code = 1085167272}, {pair_index = 179915312, script_code = 1085976576}, {pair_index = 0, script_code = 1092840080}, {pair_index = 1083641184, script_code = 1073876360}, {pair_index = 1073893376, script_code = 1083625472}, {pair_index = 1092838896, script_code = 410228}, {pair_index = -1097545716, script_code = 1073798980}, {pair_index = 1073780736, script_code = 1092835184}, {pair_index = 1, script_code = PANGO_SCRIPT_BOPOMOFO}, {pair_index = 0, script_code = 1073798980}, {pair_index = 1092838900, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 1088840904, script_code = PANGO_SCRIPT_BOPOMOFO}, {pair_index = 1084035072, script_code = PANGO_SCRIPT_INHERITED}, {pair_index = -1097545288, script_code = -1097545276}, {pair_index = 404128, script_code = PANGO_SCRIPT_COMMON}, {pair_index = 0, script_code = -1097545560}, {pair_index = 1073823776, script_code = 3447032}, {pair_index = 1083893668, script_code = PANGO_SCRIPT_ARMENIAN}, {pair_index = 9679, script_code = 1084035072}, {pair_index = -1097545600, script_code = 3447032}, {pair_index = 9679, script_code = -1097545532}}, paren_sp = -1}, script_end = 0x3498fb "", script = PANGO_SCRIPT_COMMON, derived_lang = 0x34dfec, lang_engine = 0x0, current_fonts = 0x0, cache = 0x0, base_font = 0x0, enable_fallback = 0, exact_engines = 0x0, fallback_engines = 0x0}
	__PRETTY_FUNCTION__ = "pango_itemize_with_base_dir"
#11 0x4099961c in pango_layout_check_lines (layout=0x62aa0) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-layout.c:3830
	delim_len = 0
	end = 0x3498fb ""
	delimiter_index = 3
	next_para_index = 3
	start = 0x3498f8 "�\227\217"
	done = 1
	start_offset = 0
	attrs = (PangoAttrList *) 0x250f70
	no_shape_attrs = (PangoAttrList *) 0x0
	iter = (PangoAttrIterator *) 0x63340
	prev_base_dir = PANGO_DIRECTION_LTR
	base_dir = PANGO_DIRECTION_LTR
	state = {line_height = -1, remaining_height = -1, attrs = 0x250f70, items = 0xbc73b7e, base_dir = PANGO_DIRECTION_TTB_LTR, line_of_par = 0, glyphs = 0x41236a90, start_offset = 1083641184, properties = {uline = 1073876360, strikethrough = 1073893376, rise = 1083625472, letter_spacing = 1092838896, shape_set = 1083640144, shape_ink_rect = 0x40020d88, shape_logical_rect = 0x4000df44}, log_widths = 0xc4f2f94, log_widths_offset = 0, line_start_index = 0, line_start_offset = 1092840080, line_width = 1076757188, remaining_width = 1073870760}
	__PRETTY_FUNCTION__ = "pango_layout_check_lines"
#12 0x40994004 in pango_layout_get_unknown_glyphs_count (layout=0x62aa0) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-layout.c:1212
	line = (PangoLayoutLine *) 0xbe94c9b8
	run = (PangoLayoutRun *) 0xbe94c9c4
	lines_list = (GSList *) 0x62aa0
	runs_list = (GSList *) 0x0
	i = 0
	count = 0
	__PRETTY_FUNCTION__ = "pango_layout_get_unknown_glyphs_count"
#13 0x40370200 in find_invisible_char (widget=<value optimized out>) at /build/buildd/gtk+2.0-2.17.2/gtk/gtkentry.c:2201
	text = "�\227\217\000\000\000"
	len = <value optimized out>
	layout = (PangoLayout *) 0x62aa0
	attr_list = <value optimized out>
	i = 1
	invisible_chars = {0, 9679, 8226, 10033, 10042}
#14 0x40377f94 in gtk_entry_init (entry=0x34e000) at /build/buildd/gtk+2.0-2.17.2/gtk/gtkentry.c:2228
No locals.
#15 0x40ab2c04 in IA__g_type_create_instance (type=<value optimized out>) at /build/buildd/glib2.0-2.21.2/gobject/gtype.c:1674
	node = (TypeNode *) 0x343ed0
	instance = (GTypeInstance *) 0x34e000
	class = (GTypeClass *) 0x345638
	i = 1076501168
	total_size = <value optimized out>
#16 0x40a94518 in g_object_constructor (type=0, n_construct_properties=1, construct_params=0x3) at /build/buildd/glib2.0-2.21.2/gobject/gobject.c:1338
	object = (GObject *) 0x343ed0
#17 0x40a94fc8 in IA__g_object_newv (object_type=<value optimized out>, n_parameters=0, parameters=<value optimized out>) at /build/buildd/glib2.0-2.21.2/gobject/gobject.c:1215
	nqueue = (GObjectNotifyQueue *) 0x318
	object = <value optimized out>
	class = (GObjectClass *) 0x345638
	unref_class = (GObjectClass *) 0x345638
	slist = <value optimized out>
	n_total_cparams = 0
	n_cparams = 0
	n_oparams = <value optimized out>
	n_cvalues = 0
	clist = (GList *) 0x0
	i = 0
	__PRETTY_FUNCTION__ = "IA__g_object_newv"
#18 0x40a95aec in IA__g_object_new_valist (object_type=<value optimized out>, first_property_name=<value optimized out>, var_args=<value optimized out>) at /build/buildd/glib2.0-2.21.2/gobject/gobject.c:1278
	params = <value optimized out>
	name = <value optimized out>
	object = <value optimized out>
	n_params = <value optimized out>
	n_alloced_params = 8
	__PRETTY_FUNCTION__ = "IA__g_object_new_valist"
#19 0x40a95c5c in IA__g_object_new (object_type=3423952, first_property_name=0x43d63a88 "dom.popup_allowed_events") at /build/buildd/glib2.0-2.21.2/gobject/gobject.c:1060
	var_args = {__ap = 0x42b97cf8}
	__PRETTY_FUNCTION__ = "IA__g_object_new"
#20 0x42b97cf8 in nsLookAndFeel::GetMetric (this=<value optimized out>, aID=nsILookAndFeel::eMetric_SelectTextfieldsOnKeyFocus, aMetric=@0xbe94cce0) at nsLookAndFeel.cpp:379
	entry = <value optimized out>
	select_on_focus = <value optimized out>
	res = 0
#21 0x43add5f8 in nsEventStateManager::Init (this=<value optimized out>) at nsEventStateManager.cpp:323
	lookNFeel = {mRawPtr = 0xffd78}
	selectTextfieldsOnKeyFocus = 0
	rv = 741904
	observerService = {mRawPtr = 0xe18b0}
	prefBranch = {mRawPtr = 0xb5210}
#22 0x4387f1ec in nsPresContext::Init (this=0x343f90, aDeviceContext=<value optimized out>) at nsPresContext.cpp:722
	rv = <value optimized out>
	pixelsToTwips = <value optimized out>
#23 0x4386b27c in DocumentViewerImpl::InitInternal (this=0x343b10, aParentWidget=0x250b58, aState=<value optimized out>, aDeviceContext=0x343d30, aBounds=@0xbe94cf54, aDoCreation=1, aInPrintPreview=0) at nsDocumentViewer.cpp:805
	rv = <value optimized out>
	rv = 1075079476
	makeCX = 1119686656
	requestor = {mRawPtr = 0x424a7ea0}
#24 0x4386bbbc in DocumentViewerImpl::Init (this=0x0, aParentWidget=0x0, aDeviceContext=0x4386bbbc, aBounds=<value optimized out>) at nsDocumentViewer.cpp:637
No locals.
#25 0x424920d8 in nsDocShell::SetupNewViewer (this=0x262410, aNewViewer=<value optimized out>) at nsDocShell.cpp:6155
	cx = 100
	parentAsItem = {mRawPtr = 0x0}
	parent = {mRawPtr = 0x0}
	defaultCharset = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x4022ad80, mData = 0xbe94cf14 "", mLength = 0, mFlags = 65553}, <No data fields>}, <No data fields>}, mFixedCapacity = 63, mFixedBuf = 0xbe94cf14 ""}, mStorage = "\000P.\000��\"@\2109\003\000��\224�x�\224�\200�\224��e#A4i\024@\0000�C\005\000\000\000\020$&\000\034\002\000\000���C\003\000\000\000 �3\000��\"@"}
	newMUDV = {mRawPtr = 0x0}
	bgSet = 0
	cy = 100
	textZoom = <value optimized out>
	focusController = (class nsIFocusController *) 0x2e42a0
	x = 0
	prevDocCharset = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x4022ad80, mData = 0xbe94ce0c "", mLength = 0, mFlags = 65553}, <No data fields>}, <No data fields>}, mFixedCapacity = 63, mFixedBuf = 0xbe94ce0c ""}, mStorage = "\000\000\000\000H\237\022@D\000wC\000P\002@\b@&\000��\224�P>&\000��\224�\021�3~\000\000\000\000~\034wC\000\000\000\000\020�\224�8\231\000@��\224�\034X\002@"}
	bgcolor = 0
	kungfuDeathGrip = {mRawPtr = 0x0}
	y = 0
	hintCharset = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x4022ad80, mData = 0xbe94ce64 "", mLength = 0, mFlags = 65553}, <No data fields>}, <No data fields>}, mFixedCapacity = 63, mFixedBuf = 0xbe94ce64 ""}, mStorage = "\0006�C\005\000\000\000\000P.\000��\"@x�\224�D�\224�h�\224��i\024@\024\001\000\000t�'@\0000�C`P.\000\000P.\000\2109\003\0000��C�ǽC"}
	widget = {mRawPtr = 0x250b58}
	forceCharset = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x4022ad80, mData = 0xbe94cebc "", mLength = 0, mFlags = 65553}, <No data fields>}, <No data fields>}, mFixedCapacity = 63, mFixedBuf = 0xbe94cebc ""}, mStorage = "\000P.\000��\"@x�\224�\200�\224�h�\224��i\024@\024\001\000\000t�'@\0000�C`P.\000\000P.\000\2109\003\000��\224��ǽC0��C\000P."}
	hintCharsetSource = <value optimized out>
	styleDisabled = <value optimized out>
	bounds = {x = 0, y = 0, width = 100, height = 100}
#26 0x4248afc4 in nsDocShell::Embed (this=0x262410, aContentViewer=0x343b10, aCommand=<value optimized out>, aExtraInfo=<value optimized out>) at nsDocShell.cpp:4660
	rv = <value optimized out>
#27 0x42494760 in nsDocShell::CreateAboutBlankContentViewer (this=0x262410) at nsDocShell.cpp:5065
	domdoc = {mRawPtr = 0x33d2b0}
	blankDoc = {mRawPtr = 0x33d220}
	viewer = {mRawPtr = 0x343b10}
	rv = 0
	catMan = {mRawPtr = 0x88b40}
	docFactory = {mRawPtr = 0x33d1f8}
	kungFuDeathGrip = {mRawPtr = 0x2624ac}
	contractId = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x4022ad80, mData = 0x33d1a8 "@mozilla.org/content/document-loader-factory;1", mLength = 46, mFlags = 9}, <No data fields>}, <No data fields>}, <No data fields>}
#28 0x424950dc in nsDocShell::EnsureContentViewer (this=0x262410) at nsDocShell.cpp:4944
	principal = (class nsIPrincipal *) 0x0
	piDOMWindow = {mRawPtr = 0x2e5000}
	rv = 2499600
#29 0x4249d744 in nsDocShell::GetInterface (this=0x262410, aIID=@0x43d2f760, aSink=0xbe94d188) at nsDocShell.cpp:428
No locals.
#30 0x401455b4 in nsGetInterface::operator() (this=0xbe94d1a4, aIID=@0x43d2f760, aInstancePtr=0xbe94d188) at nsIInterfaceRequestorUtils.cpp:53
	factoryPtr = {mRawPtr = 0x262428}
	status = 3197423968
#31 0x439c9320 in nsCOMPtr<nsIDOMDocument>::assign_from_helper (this=0xbe94d1b0, helper=<value optimized out>, aIID=<value optimized out>) at ../../../dist/include/xpcom/nsCOMPtr.h:1292
	newRawPtr = (class nsIDOMDocument *) 0x0
#32 0x439ca1b8 in nsCOMPtr (this=0xbe94d1b0, helper=@0xbe94d1a4) at ../../../dist/include/xpcom/nsCOMPtr.h:694
No locals.
#33 0x43bd4bc8 in nsGlobalWindow::GetDocument (this=<value optimized out>, aDocument=0xbe94d1d4) at nsGlobalWindow.cpp:1970
	domdoc = {mRawPtr = 0x0}
	docShell = <value optimized out>
#34 0x42d38ac4 in nsWindowWatcher::URIfromURL (aURL=0x33cbc0 "chrome://messenger/content/", aParent=<value optimized out>, aURI=0xbe94d518) at nsWindowWatcher.cpp:1329
	domDoc = {mRawPtr = 0x0}
	baseWindow = {mRawPtr = 0x2e5000}
	baseURI = <value optimized out>
#35 0x42d392a4 in nsWindowWatcher::OpenWindowJSInternal (this=<value optimized out>, aParent=0x0, aUrl=0x33cbc0 "chrome://messenger/content/", aName=0x33cbf8 "_blank", aFeatures=0x33d160 "chrome,dialog=no,all", aDialog=1, argc=1, argv=0x3407a4, aCalledFromJS=0, _retval=0x3407a4) at nsWindowWatcher.cpp:577
	rv = <value optimized out>
	windowIsModal = 1411488
	uriToLoad = {mRawPtr = 0x0}
	parentTreeOwner = {mRawPtr = 0x0}
	chromeParent = {mRawPtr = 0x42d37420}
	newCV = {mRawPtr = 0x412365f4}
	isCallerChrome = <value optimized out>
	nameSpecified = 1676
	newDocShellItem = {mRawPtr = 0x0}
	queueGuard = {mService = {mRawPtr = 0x0}, mQueue = {mRawPtr = 0x0}, mAppShell = {mRawPtr = 0x0}}
	sizeSpec = {mLeft = -376302462, mTop = 0, mOuterWidth = 1121111330, mOuterHeight = 0, mInnerWidth = -1097542504, mInnerHeight = 1073781048, mLeftSpecified = 92 '\\', mTopSpecified = 212 '�', mOuterWidthSpecified = 148 '\224', mOuterHeightSpecified = 190 '�', mInnerWidthSpecified = 28 '\034', mInnerHeightSpecified = 88 'X', mUseDefaultWidth = 2 '\002', mUseDefaultHeight = 64 '@'}
	windowNeedsName = <value optimized out>
	cx = <value optimized out>
	featuresSpecified = <value optimized out>
	isNewToplevelWindow = 1075472356
	uriToLoadIsChrome = 0
	chromeFlags = <value optimized out>
	sm = {mRawPtr = 0xbe94d51c}
	newMuCV = {mRawPtr = 0x0}
	subjectPrincipal = {mRawPtr = 0x40025000}
	windowIsNew = 0
	name = {<nsFixedString> = {<nsString> = {<nsSubstring> = {<nsAString_internal> = {mVTable = 0x4022ac90, mData = 0xbe94d284, mLength = 0, mFlags = 65553}, <No data fields>}, <No data fields>}, mFixedCapacity = 63, mFixedBuf = 0xbe94d284}, mStorage = {0, 16404, 20, 0, 40248, 16402, 59192, 16385, 54012, 48788, 3382, 2674, 0, 0, 0, 0, 27280, 16675, 50956, 17106, 35232, 21, 20480, 16386, 45056, 17106, 26096, 16675, 37312, 6, 53964, 48788, 57156, 16384, 38912, 16384, 0, 0, 1, 0, 5, 0, 0, 0, 29632, 7, 26100, 16675, 0, 0, 40248, 16402, 0, 0, 3, 0, 51928, 51, 46832, 16418, 14728, 3, 54132, 48788}}
	features = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = {<nsACString_internal> = {mVTable = 0x4022ad80, mData = 0xbe94d374 "", mLength = 0, mFlags = 65553}, <No data fields>}, <No data fields>}, mFixedCapacity = 63, mFixedBuf = 0xbe94d374 ""}, mStorage = "\000�\"@\214�\224�\000\000\000\000\021\000\001\000?\000\000\000\214�\224�\000\000\000\000��\001@\"��Bx\225\002@L��B\001\000\000\000\005\000\000\000\\\213\025\000h�\224�\\�\224�"}
	callerContextGuard = {mService = {mRawPtr = 0x0}, mContext = 0x0}
	foundWindow = {mRawPtr = 0xbe94d50c}
	newDocShell = {mRawPtr = 0x40029368}
#36 0x42d3a914 in nsWindowWatcher::OpenWindow (this=0x159038, aParent=0x0, aUrl=0x33cbc0 "chrome://messenger/content/", aName=0x33cbf8 "_blank", aFeatures=0x33d160 "chrome,dialog=no,all", aArguments=0x401ca2f4, _retval=0xbe94d730) at nsWindowWatcher.cpp:478
	argv = (jsval *) 0x3407a4
	rv = 0
	argc = 3042992
	cx = (JSContext *) 0x0
	mark = (void *) 0xbe94d568
	kungFuDeathGrip = {mRawPtr = 0x0}
#37 0x401ca2f4 in XPTC_InvokeByIndex (that=<value optimized out>, methodIndex=0, paramCount=215984, params=0x1) at xptcinvoke_arm.cpp:217
	result = 3197425072
	my_params = {that = 0x33d160, Index = 3394264, Count = 3197425456, params = 0x159038, fn_count = 3, fn_copy = 6}
#38 0xbe94d784 in ?? ()
No symbol table info available.
Cannot access memory at address 0x0
(gdb) info registers
r0             0x0	0
r1             0x1	1
r2             0x3	3
r3             0x40a623a0	1084629920
r4             0x1	1
r5             0x0	0
r6             0xbe94c9b8	3197422008
r7             0xbe94c9c4	3197422020
r8             0x1	1
r9             0x0	0
r10            0x0	0
r11            0xbe94c288	3197420168
r12            0x1	1
sp             0xbe94c160	0xbe94c160
lr             0x40a64c10	1084640272
pc             0x40a643f8	0x40a643f8 <FcPatternObjectAddWithBinding+12>
fps            0x0	0
cpsr           0x60000010	1610612752
(gdb) thread apply all backtrace

Thread 4 (Thread 0x4479c430 (LWP 11381)):
#0  0x402a35d8 in pthread_cond_timedwait@@GLIBC_2.4 () from /lib/vfp/libpthread.so.0
#1  0x402782d4 in ?? () from /usr/lib/libnspr4.so
#2  0x40278dd8 in PR_WaitCondVar () from /usr/lib/libnspr4.so
#3  0x41976948 in nsIOThreadPool::ThreadFunc (arg=<value optimized out>) at nsIOThreadPool.cpp:254
#4  0x4027e58c in ?? () from /usr/lib/libnspr4.so
#5  0x4029e30c in start_thread () from /lib/vfp/libpthread.so.0
#6  0x40f29ec8 in clone () from /lib/vfp/libc.so.6
Backtrace stopped: frame did not save the PC

Thread 3 (Thread 0x435bf430 (LWP 11380)):
#0  0x402a35d8 in pthread_cond_timedwait@@GLIBC_2.4 () from /lib/vfp/libpthread.so.0
#1  0x402782d4 in ?? () from /usr/lib/libnspr4.so
#2  0x40278dd8 in PR_WaitCondVar () from /usr/lib/libnspr4.so
#3  0x401adab0 in TimerThread::Run (this=0x63518) at TimerThread.cpp:318
#4  0x401aaa88 in nsThread::Main (arg=<value optimized out>) at nsThread.cpp:118
#5  0x4027e58c in ?? () from /usr/lib/libnspr4.so
#6  0x4029e30c in start_thread () from /lib/vfp/libpthread.so.0
#7  0x40f29ec8 in clone () from /lib/vfp/libc.so.6
Backtrace stopped: frame did not save the PC

Thread 2 (Thread 0x42291430 (LWP 11378)):
#0  0x40f20664 in poll () from /lib/vfp/libc.so.6
#1  0x4027a94c in ?? () from /usr/lib/libnspr4.so
#2  0x419adc14 in nsSocketTransportService::Poll (this=<value optimized out>, interval=0x42290d5c) at nsSocketTransportService2.cpp:361
#3  0x419adf54 in nsSocketTransportService::Run (this=0xfde78) at nsSocketTransportService2.cpp:578
#4  0x401aaa88 in nsThread::Main (arg=<value optimized out>) at nsThread.cpp:118
#5  0x4027e58c in ?? () from /usr/lib/libnspr4.so
#6  0x4029e30c in start_thread () from /lib/vfp/libpthread.so.0
#7  0x40f29ec8 in clone () from /lib/vfp/libc.so.6
Backtrace stopped: frame did not save the PC

Thread 1 (Thread 0x412365f0 (LWP 11375)):
#0  FcPatternObjectAddWithBinding (p=0x0, object=1, value={type = 3448088, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 2.121995791459338e-314, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, binding=FcValueBindingStrong, append=1) at fcpat.c:476
#1  0x40a64c10 in FcPatternObjectAdd (p=0x0, object=1, value={type = 3448088, u = {s = 0x1 <Address 0x1 out of bounds>, i = 1, b = 1, d = 4.9406564584124654e-324, m = 0x1, c = 0x1, f = 0x1, l = 0x1}}, append=3) at fcpat.c:545
#2  0x40a64cf0 in FcPatternObjectAddString (p=0x0, object=1, s=<value optimized out>) at fcpat.c:664
#3  0x407bea04 in pango_fc_make_pattern (description=0x3446c0, language=0x34dfec, pixel_size=13653, dpi=96) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pangofc-fontmap.c:1470
#4  0x407bf0b8 in pango_fc_fontset_key_make_pattern (key=0xbe94c2dc) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pangofc-fontmap.c:1625
#5  0x407bf0ec in pango_fc_font_map_get_patterns (fontmap=0x601e8, key=0xbe94c2dc) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pangofc-fontmap.c:1639
#6  0x407bf404 in pango_fc_font_map_load_fontset (fontmap=0x601e8, context=0x2e4890, desc=0x344260, language=0x34dfec) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pangofc-fontmap.c:1742
#7  0x4098cea0 in pango_font_map_load_fontset (fontmap=0x601e8, context=0x2e4890, desc=0x344260, language=0x34dfec) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-fontmap.c:136
#8  0x40989ec4 in itemize_state_update_for_new_run (state=0xbe94c404) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-context.c:1289
#9  0x4098a004 in itemize_state_process_run (state=0xbe94c404) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-context.c:1328
#10 0x4098a528 in pango_itemize_with_base_dir (context=0x2e4890, base_dir=PANGO_DIRECTION_LTR, text=0x3498f8 "�\227\217", start_index=0, length=3, attrs=0x250f70, cached_iter=0x63340) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-context.c:1467
#11 0x4099961c in pango_layout_check_lines (layout=0x62aa0) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-layout.c:3830
#12 0x40994004 in pango_layout_get_unknown_glyphs_count (layout=0x62aa0) at /home/mcasadevall/src/debugging/pango1.0-1.24.3/pango/pango-layout.c:1212
#13 0x40370200 in find_invisible_char (widget=<value optimized out>) at /build/buildd/gtk+2.0-2.17.2/gtk/gtkentry.c:2201
#14 0x40377f94 in gtk_entry_init (entry=0x34e000) at /build/buildd/gtk+2.0-2.17.2/gtk/gtkentry.c:2228
#15 0x40ab2c04 in IA__g_type_create_instance (type=<value optimized out>) at /build/buildd/glib2.0-2.21.2/gobject/gtype.c:1674
#16 0x40a94518 in g_object_constructor (type=0, n_construct_properties=1, construct_params=0x3) at /build/buildd/glib2.0-2.21.2/gobject/gobject.c:1338
#17 0x40a94fc8 in IA__g_object_newv (object_type=<value optimized out>, n_parameters=0, parameters=<value optimized out>) at /build/buildd/glib2.0-2.21.2/gobject/gobject.c:1215
#18 0x40a95aec in IA__g_object_new_valist (object_type=<value optimized out>, first_property_name=<value optimized out>, var_args=<value optimized out>) at /build/buildd/glib2.0-2.21.2/gobject/gobject.c:1278
#19 0x40a95c5c in IA__g_object_new (object_type=3423952, first_property_name=0x43d63a88 "dom.popup_allowed_events") at /build/buildd/glib2.0-2.21.2/gobject/gobject.c:1060
#20 0x42b97cf8 in nsLookAndFeel::GetMetric (this=<value optimized out>, aID=nsILookAndFeel::eMetric_SelectTextfieldsOnKeyFocus, aMetric=@0xbe94cce0) at nsLookAndFeel.cpp:379
#21 0x43add5f8 in nsEventStateManager::Init (this=<value optimized out>) at nsEventStateManager.cpp:323
#22 0x4387f1ec in nsPresContext::Init (this=0x343f90, aDeviceContext=<value optimized out>) at nsPresContext.cpp:722
#23 0x4386b27c in DocumentViewerImpl::InitInternal (this=0x343b10, aParentWidget=0x250b58, aState=<value optimized out>, aDeviceContext=0x343d30, aBounds=@0xbe94cf54, aDoCreation=1, aInPrintPreview=0) at nsDocumentViewer.cpp:805
#24 0x4386bbbc in DocumentViewerImpl::Init (this=0x0, aParentWidget=0x0, aDeviceContext=0x4386bbbc, aBounds=<value optimized out>) at nsDocumentViewer.cpp:637
#25 0x424920d8 in nsDocShell::SetupNewViewer (this=0x262410, aNewViewer=<value optimized out>) at nsDocShell.cpp:6155
#26 0x4248afc4 in nsDocShell::Embed (this=0x262410, aContentViewer=0x343b10, aCommand=<value optimized out>, aExtraInfo=<value optimized out>) at nsDocShell.cpp:4660
#27 0x42494760 in nsDocShell::CreateAboutBlankContentViewer (this=0x262410) at nsDocShell.cpp:5065
#28 0x424950dc in nsDocShell::EnsureContentViewer (this=0x262410) at nsDocShell.cpp:4944
#29 0x4249d744 in nsDocShell::GetInterface (this=0x262410, aIID=@0x43d2f760, aSink=0xbe94d188) at nsDocShell.cpp:428
#30 0x401455b4 in nsGetInterface::operator() (this=0xbe94d1a4, aIID=@0x43d2f760, aInstancePtr=0xbe94d188) at nsIInterfaceRequestorUtils.cpp:53
#31 0x439c9320 in nsCOMPtr<nsIDOMDocument>::assign_from_helper (this=0xbe94d1b0, helper=<value optimized out>, aIID=<value optimized out>) at ../../../dist/include/xpcom/nsCOMPtr.h:1292
#32 0x439ca1b8 in nsCOMPtr (this=0xbe94d1b0, helper=@0xbe94d1a4) at ../../../dist/include/xpcom/nsCOMPtr.h:694
#33 0x43bd4bc8 in nsGlobalWindow::GetDocument (this=<value optimized out>, aDocument=0xbe94d1d4) at nsGlobalWindow.cpp:1970
#34 0x42d38ac4 in nsWindowWatcher::URIfromURL (aURL=0x33cbc0 "chrome://messenger/content/", aParent=<value optimized out>, aURI=0xbe94d518) at nsWindowWatcher.cpp:1329
#35 0x42d392a4 in nsWindowWatcher::OpenWindowJSInternal (this=<value optimized out>, aParent=0x0, aUrl=0x33cbc0 "chrome://messenger/content/", aName=0x33cbf8 "_blank", aFeatures=0x33d160 "chrome,dialog=no,all", aDialog=1, argc=1, argv=0x3407a4, aCalledFromJS=0, _retval=0x3407a4) at nsWindowWatcher.cpp:577
#36 0x42d3a914 in nsWindowWatcher::OpenWindow (this=0x159038, aParent=0x0, aUrl=0x33cbc0 "chrome://messenger/content/", aName=0x33cbf8 "_blank", aFeatures=0x33d160 "chrome,dialog=no,all", aArguments=0x401ca2f4, _retval=0xbe94d730) at nsWindowWatcher.cpp:478
#37 0x401ca2f4 in XPTC_InvokeByIndex (that=<value optimized out>, methodIndex=0, paramCount=215984, params=0x1) at xptcinvoke_arm.cpp:217
#38 0xbe94d784 in ?? ()
Cannot access memory at address 0x0

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-24:

#20

Download full text (12.7 KiB)

Debugging continues. I think we found either a memory corruption or race condition within fontconfig. When the following patch (http://paste.ubuntu.com/203007/) was applied to fontconfig in an attempt to try and find why FcPatternBuild was returning 0x0, the backtrace changed dramatically. Here's the new backtrace, but there is no telling if this segfault is valid if we have a possible memory corruption issue on fontconfig.

(gdb) r
Starting program: /home/mcasadevall/src/thunderbird-2.0.0.22+build1+nobinonly/build-tree/mozilla/dist/bin/thunderbird-bin
[Thread debugging using libthread_db enabled]
[New Thread 0x412365f0 (LWP 24364)]
Type Manifest File: /home/mcasadevall/.mozilla-thunderbird/am3ei364.default/xpti.dat
*** Registering Apprunner components (all right -- a generic module!)
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nsNativeComponentLoader: registering deferred (0)
pldhash: for the table at address 0xb45e0, the given entrySize of 44 probably favors chaining over double hashing.
[New Thread 0x42291430 (LWP 24365)]
[New Thread 0x435bf430 (LWP 24367)]
GFX: dpi=96 t2p=0.0666667 p2t=15 depth=24
++WEBSHELL == 1
[New Thread 0x4479c430 (LWP 24368)]
++DOMWINDOW == 1
Returning 3477808
++DOMWINDOW == 2
###!!! ASSERTION: id differs from id in atom table!: 'd_val == idval', file xpcwrappednativejsops.cpp, line 1046
Break: at file xpcwrappednativejsops.cpp, line 1046
###!!! ASSERTION: Can't get globalObject.Object.prototype: 'Error', file xpcwrappednativescope.cpp, line 200
Break: at file xpcwrappednativescope.cpp, line 200
###!!! ASSERTION: Can't get globalObject.Function.prototype: 'Error', file xpcwrappednativescope.cpp, line 212
Break: at file xpcwrappednativescope.cpp, line 212
###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file xpcwrappednativescope.cpp, line 574
Break: at file xpcwrappednativescope.cpp, line 574

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x412365f0 (LWP 24364)]
0x40033e04 in JS_GetClass (cx=0x2e6eb0, obj=0x0) at jsapi.c:2288
2288 JSVAL_TO_PRIVATE(GC_AWARE_GET_SLOT(cx, obj, JSSLOT_CLASS));
(gdb) bt full
#0 0x40033e04 in JS_GetClass (cx=0x2e6eb0, obj=0x0) at jsapi.c:2288
No locals.
#1 0x43c0a23c in nsDOMClassInfo::PostCreate (this=0x31ecc0, wrapper=0x45c550, cx=0x2e6eb0, obj=0x455508) at nsDOMClassInfo.cpp:3229
proto_proto = (JSObject *) 0x0
val = 4572496
sSupportsIID = (const nsIID *) 0x43d27f14
proto = (JSObject *) Cannot access memory at address 0xfffffff8
(gdb) bt
#0 0x40033e04 in JS_GetClass (cx=0x2e6eb0, obj=0x0) at jsapi.c:2288
#1 0x43c0a23c in nsDOMClassInfo::PostCreate (this=0x31ecc0, wrapper=0x45c550, cx=0x2e6eb0, obj=0x455508) at nsDOMClassInfo.cpp:3229
#2 0x418c7250 in XPCWrappedNative::Get...

Debugging continues. I think we found either a memory corruption or race condition within fontconfig. When the following patch (http://paste.ubuntu.com/203007/) was applied to fontconfig in an attempt to try and find why FcPatternBuild was returning 0x0, the backtrace changed dramatically. Here's the new backtrace, but there is no telling if this segfault is valid if we have a possible memory corruption issue on fontconfig.

(gdb) r
Starting program: /home/mcasadevall/src/thunderbird-2.0.0.22+build1+nobinonly/build-tree/mozilla/dist/bin/thunderbird-bin 
[Thread debugging using libthread_db enabled]
[New Thread 0x412365f0 (LWP 24364)]
Type Manifest File: /home/mcasadevall/.mozilla-thunderbird/am3ei364.default/xpti.dat
*** Registering Apprunner components (all right -- a generic module!)
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nsNativeComponentLoader: registering deferred (0)
pldhash: for the table at address 0xb45e0, the given entrySize of 44 probably favors chaining over double hashing.
[New Thread 0x42291430 (LWP 24365)]
[New Thread 0x435bf430 (LWP 24367)]
GFX: dpi=96 t2p=0.0666667 p2t=15 depth=24
++WEBSHELL == 1
[New Thread 0x4479c430 (LWP 24368)]
++DOMWINDOW == 1
Returning 3477808
++DOMWINDOW == 2
###!!! ASSERTION: id differs from id in atom table!: 'd_val == idval', file xpcwrappednativejsops.cpp, line 1046
Break: at file xpcwrappednativejsops.cpp, line 1046
###!!! ASSERTION: Can't get globalObject.Object.prototype: 'Error', file xpcwrappednativescope.cpp, line 200
Break: at file xpcwrappednativescope.cpp, line 200
###!!! ASSERTION: Can't get globalObject.Function.prototype: 'Error', file xpcwrappednativescope.cpp, line 212
Break: at file xpcwrappednativescope.cpp, line 212
###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file xpcwrappednativescope.cpp, line 574
Break: at file xpcwrappednativescope.cpp, line 574

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x412365f0 (LWP 24364)]
0x40033e04 in JS_GetClass (cx=0x2e6eb0, obj=0x0) at jsapi.c:2288
2288	        JSVAL_TO_PRIVATE(GC_AWARE_GET_SLOT(cx, obj, JSSLOT_CLASS));
(gdb) bt full
#0  0x40033e04 in JS_GetClass (cx=0x2e6eb0, obj=0x0) at jsapi.c:2288
No locals.
#1  0x43c0a23c in nsDOMClassInfo::PostCreate (this=0x31ecc0, wrapper=0x45c550, cx=0x2e6eb0, obj=0x455508) at nsDOMClassInfo.cpp:3229
	proto_proto = (JSObject *) 0x0
	val = 4572496
	sSupportsIID = (const nsIID *) 0x43d27f14
	proto = (JSObject *) Cannot access memory at address 0xfffffff8
(gdb) bt
#0  0x40033e04 in JS_GetClass (cx=0x2e6eb0, obj=0x0) at jsapi.c:2288
#1  0x43c0a23c in nsDOMClassInfo::PostCreate (this=0x31ecc0, wrapper=0x45c550, cx=0x2e6eb0, obj=0x455508) at nsDOMClassInfo.cpp:3229
#2  0x418c7250 in XPCWrappedNative::GetNewOrUsed (ccx=<value optimized out>, Object=<value optimized out>, Scope=<value optimized out>, Interface=0x16c510, isGlobal=4533528, resultWrapper=0xbeeabac8) at xpcwrappednative.cpp:466
#3  0x418a6d74 in XPCConvert::NativeInterface2JSObject (ccx=@0xbeeabb20, dest=0xbeeabbc8, src=0x452e0c, iid=0x43d27f14, scope=0xbeeabbb4, allowNativeWrapper=0, isGlobal=1, pErr=0xbeeabbc4) at xpcconvert.cpp:1078
#4  0x4188d720 in nsXPConnect::InitClassesWithNewWrappedGlobal (this=<value optimized out>, aJSContext=0x2e6eb0, aCOMObj=0x452e0c, aIID=<value optimized out>, aFlags=3203054828, _retval=0x43bec6d4) at nsXPConnect.cpp:534
#5  0x43bec6d4 in nsGlobalWindow::SetNewDocument (this=0x2e6200, aDocument=0x33d2b0, aState=0x0, aRemoveEventListeners=<value optimized out>, aClearScopeHint=1, aIsInternalCall=1136576800) at nsGlobalWindow.cpp:1199
#6  0x43bec920 in nsGlobalWindow::SetNewDocument (this=0x2e6eb0, aDocument=0x0, aState=0x4, aRemoveEventListeners=4575348, aClearScopeHint=1) at nsGlobalWindow.cpp:918
#7  0x4386b38c in DocumentViewerImpl::InitInternal (this=0x343b10, aParentWidget=<value optimized out>, aState=<value optimized out>, aDeviceContext=<value optimized out>, aBounds=@0xbeeabf54, aDoCreation=1, aInPrintPreview=-1091911852) at nsDocumentViewer.cpp:854
#8  0x4386bbbc in DocumentViewerImpl::Init (this=0x2e6eb0, aParentWidget=0x0, aDeviceContext=0x4386bbbc, aBounds=<value optimized out>) at nsDocumentViewer.cpp:637
#9  0x424920d8 in nsDocShell::SetupNewViewer (this=0x2624a0, aNewViewer=<value optimized out>) at nsDocShell.cpp:6155
#10 0x4248afc4 in nsDocShell::Embed (this=0x2624a0, aContentViewer=0x343b10, aCommand=<value optimized out>, aExtraInfo=<value optimized out>) at nsDocShell.cpp:4660
#11 0x42494760 in nsDocShell::CreateAboutBlankContentViewer (this=0x2624a0) at nsDocShell.cpp:5065
#12 0x424950dc in nsDocShell::EnsureContentViewer (this=0x2624a0) at nsDocShell.cpp:4944
#13 0x4249d744 in nsDocShell::GetInterface (this=0x2624a0, aIID=@0x43d2f760, aSink=0xbeeac188) at nsDocShell.cpp:428
#14 0x401455b4 in nsGetInterface::operator() (this=0xbeeac1a4, aIID=@0x43d2f760, aInstancePtr=0xbeeac188) at nsIInterfaceRequestorUtils.cpp:53
#15 0x439c9320 in nsCOMPtr<nsIDOMDocument>::assign_from_helper (this=0xbeeac1b0, helper=<value optimized out>, aIID=<value optimized out>) at ../../../dist/include/xpcom/nsCOMPtr.h:1292
#16 0x439ca1b8 in nsCOMPtr (this=0xbeeac1b0, helper=@0xbeeac1a4) at ../../../dist/include/xpcom/nsCOMPtr.h:694
#17 0x43bd4bc8 in nsGlobalWindow::GetDocument (this=<value optimized out>, aDocument=0xbeeac1d4) at nsGlobalWindow.cpp:1970
#18 0x42d38ac4 in nsWindowWatcher::URIfromURL (aURL=0x33cbc0 "chrome://messenger/content/", aParent=<value optimized out>, aURI=0xbeeac518) at nsWindowWatcher.cpp:1329
#19 0x42d392a4 in nsWindowWatcher::OpenWindowJSInternal (this=<value optimized out>, aParent=0x0, aUrl=0x33cbc0 "chrome://messenger/content/", aName=0x33cbf8 "_blank", aFeatures=0x33d160 "chrome,dialog=no,all", aDialog=1, argc=1, argv=0x3407a4, aCalledFromJS=0, _retval=0x3407a4) at nsWindowWatcher.cpp:577
#20 0x42d3a914 in nsWindowWatcher::OpenWindow (this=0x159038, aParent=0x0, aUrl=0x33cbc0 "chrome://messenger/content/", aName=0x33cbf8 "_blank", aFeatures=0x33d160 "chrome,dialog=no,all", aArguments=0x401ca2f4, _retval=0xbeeac730) at nsWindowWatcher.cpp:478
#21 0x401ca2f4 in XPTC_InvokeByIndex (that=<value optimized out>, methodIndex=0, paramCount=4, params=0x45d074) at xptcinvoke_arm.cpp:217
#22 0xbeeac784 in ?? ()
Cannot access memory at address 0x0
(gdb) thread apply all bt

Thread 4 (Thread 0x4479c430 (LWP 24368)):
#0  0x402a35d8 in pthread_cond_timedwait@@GLIBC_2.4 () from /lib/vfp/libpthread.so.0
#1  0x402782d4 in ?? () from /usr/lib/libnspr4.so
#2  0x40278dd8 in PR_WaitCondVar () from /usr/lib/libnspr4.so
#3  0x41976948 in nsIOThreadPool::ThreadFunc (arg=<value optimized out>) at nsIOThreadPool.cpp:254
#4  0x4027e58c in ?? () from /usr/lib/libnspr4.so
#5  0x4029e30c in start_thread () from /lib/vfp/libpthread.so.0
#6  0x40f29ec8 in clone () from /lib/vfp/libc.so.6
Backtrace stopped: frame did not save the PC

Thread 3 (Thread 0x435bf430 (LWP 24367)):
#0  0x402a35d8 in pthread_cond_timedwait@@GLIBC_2.4 () from /lib/vfp/libpthread.so.0
#1  0x402782d4 in ?? () from /usr/lib/libnspr4.so
#2  0x40278dd8 in PR_WaitCondVar () from /usr/lib/libnspr4.so
#3  0x401adab0 in TimerThread::Run (this=0x63570) at TimerThread.cpp:318
#4  0x401aaa88 in nsThread::Main (arg=<value optimized out>) at nsThread.cpp:118
#5  0x4027e58c in ?? () from /usr/lib/libnspr4.so
#6  0x4029e30c in start_thread () from /lib/vfp/libpthread.so.0
#7  0x40f29ec8 in clone () from /lib/vfp/libc.so.6
Backtrace stopped: frame did not save the PC

Thread 2 (Thread 0x42291430 (LWP 24365)):
#0  0x40f20664 in poll () from /lib/vfp/libc.so.6
#1  0x4027a94c in ?? () from /usr/lib/libnspr4.so
#2  0x419adc14 in nsSocketTransportService::Poll (this=<value optimized out>, interval=0x42290d5c) at nsSocketTransportService2.cpp:361
#3  0x419adf54 in nsSocketTransportService::Run (this=0xfde98) at nsSocketTransportService2.cpp:578
#4  0x401aaa88 in nsThread::Main (arg=<value optimized out>) at nsThread.cpp:118
#5  0x4027e58c in ?? () from /usr/lib/libnspr4.so
#6  0x4029e30c in start_thread () from /lib/vfp/libpthread.so.0
#7  0x40f29ec8 in clone () from /lib/vfp/libc.so.6
Backtrace stopped: frame did not save the PC

Thread 1 (Thread 0x412365f0 (LWP 24364)):
#0  0x40033e04 in JS_GetClass (cx=0x2e6eb0, obj=0x0) at jsapi.c:2288
#1  0x43c0a23c in nsDOMClassInfo::PostCreate (this=0x31ecc0, wrapper=0x45c550, cx=0x2e6eb0, obj=0x455508) at nsDOMClassInfo.cpp:3229
#2  0x418c7250 in XPCWrappedNative::GetNewOrUsed (ccx=<value optimized out>, Object=<value optimized out>, Scope=<value optimized out>, Interface=0x16c510, isGlobal=4533528, resultWrapper=0xbeeabac8) at xpcwrappednative.cpp:466
#3  0x418a6d74 in XPCConvert::NativeInterface2JSObject (ccx=@0xbeeabb20, dest=0xbeeabbc8, src=0x452e0c, iid=0x43d27f14, scope=0xbeeabbb4, allowNativeWrapper=0, isGlobal=1, pErr=0xbeeabbc4) at xpcconvert.cpp:1078
#4  0x4188d720 in nsXPConnect::InitClassesWithNewWrappedGlobal (this=<value optimized out>, aJSContext=0x2e6eb0, aCOMObj=0x452e0c, aIID=<value optimized out>, aFlags=3203054828, _retval=0x43bec6d4) at nsXPConnect.cpp:534
#5  0x43bec6d4 in nsGlobalWindow::SetNewDocument (this=0x2e6200, aDocument=0x33d2b0, aState=0x0, aRemoveEventListeners=<value optimized out>, aClearScopeHint=1, aIsInternalCall=1136576800) at nsGlobalWindow.cpp:1199
#6  0x43bec920 in nsGlobalWindow::SetNewDocument (this=0x2e6eb0, aDocument=0x0, aState=0x4, aRemoveEventListeners=4575348, aClearScopeHint=1) at nsGlobalWindow.cpp:918
#7  0x4386b38c in DocumentViewerImpl::InitInternal (this=0x343b10, aParentWidget=<value optimized out>, aState=<value optimized out>, aDeviceContext=<value optimized out>, aBounds=@0xbeeabf54, aDoCreation=1, aInPrintPreview=-1091911852) at nsDocumentViewer.cpp:854
#8  0x4386bbbc in DocumentViewerImpl::Init (this=0x2e6eb0, aParentWidget=0x0, aDeviceContext=0x4386bbbc, aBounds=<value optimized out>) at nsDocumentViewer.cpp:637
#9  0x424920d8 in nsDocShell::SetupNewViewer (this=0x2624a0, aNewViewer=<value optimized out>) at nsDocShell.cpp:6155
#10 0x4248afc4 in nsDocShell::Embed (this=0x2624a0, aContentViewer=0x343b10, aCommand=<value optimized out>, aExtraInfo=<value optimized out>) at nsDocShell.cpp:4660
#11 0x42494760 in nsDocShell::CreateAboutBlankContentViewer (this=0x2624a0) at nsDocShell.cpp:5065
#12 0x424950dc in nsDocShell::EnsureContentViewer (this=0x2624a0) at nsDocShell.cpp:4944
#13 0x4249d744 in nsDocShell::GetInterface (this=0x2624a0, aIID=@0x43d2f760, aSink=0xbeeac188) at nsDocShell.cpp:428
#14 0x401455b4 in nsGetInterface::operator() (this=0xbeeac1a4, aIID=@0x43d2f760, aInstancePtr=0xbeeac188) at nsIInterfaceRequestorUtils.cpp:53
#15 0x439c9320 in nsCOMPtr<nsIDOMDocument>::assign_from_helper (this=0xbeeac1b0, helper=<value optimized out>, aIID=<value optimized out>) at ../../../dist/include/xpcom/nsCOMPtr.h:1292
#16 0x439ca1b8 in nsCOMPtr (this=0xbeeac1b0, helper=@0xbeeac1a4) at ../../../dist/include/xpcom/nsCOMPtr.h:694
#17 0x43bd4bc8 in nsGlobalWindow::GetDocument (this=<value optimized out>, aDocument=0xbeeac1d4) at nsGlobalWindow.cpp:1970
#18 0x42d38ac4 in nsWindowWatcher::URIfromURL (aURL=0x33cbc0 "chrome://messenger/content/", aParent=<value optimized out>, aURI=0xbeeac518) at nsWindowWatcher.cpp:1329
#19 0x42d392a4 in nsWindowWatcher::OpenWindowJSInternal (this=<value optimized out>, aParent=0x0, aUrl=0x33cbc0 "chrome://messenger/content/", aName=0x33cbf8 "_blank", aFeatures=0x33d160 "chrome,dialog=no,all", aDialog=1, argc=1, argv=0x3407a4, aCalledFromJS=0, _retval=0x3407a4) at nsWindowWatcher.cpp:577
#20 0x42d3a914 in nsWindowWatcher::OpenWindow (this=0x159038, aParent=0x0, aUrl=0x33cbc0 "chrome://messenger/content/", aName=0x33cbf8 "_blank", aFeatures=0x33d160 "chrome,dialog=no,all", aArguments=0x401ca2f4, _retval=0xbeeac730) at nsWindowWatcher.cpp:478
#21 0x401ca2f4 in XPTC_InvokeByIndex (that=<value optimized out>, methodIndex=0, paramCount=4, params=0x45d074) at xptcinvoke_arm.cpp:217
#22 0xbeeac784 in ?? ()
Cannot access memory at address 0x0
(gdb) info registers
r0             0x2e6eb0	3042992
r1             0x0	0
r2             0x4	4
r3             0x45d074	4575348
r4             0xde1e8	909800
r5             0x43f5d8a0	1140185248
r6             0xbeeab998	3203053976
r7             0x31ecc0	3271872
r8             0x45c550	4572496
r9             0x455508	4543752
r10            0x2e6eb0	3042992
r11            0x16c510	1492240
r12            0x43f533a4	1140143012
sp             0xbeeab93c	0xbeeab93c
lr             0x43c0a23c	1136697916
pc             0x40033e04	0x40033e04 <JS_GetClass+8>
fps            0x0	0
cpsr           0x60000010	1610612752
(gdb)

Revision history for this message

Michael Casadevall (mcasadevall) wrote on 2009-06-25:

#21

Download full text (7.2 KiB)

Based on advice from #ubuntu-mozillateam, I found and ran the test suite; here's the output

Running TestVersionComparator tests
All comparisons OK
../../dist/bin/run-mozilla.sh ../../dist/bin/test_all.sh ../../dist/bin/test_xpcom
../../dist/bin/test_xpcom/test_storagestream.js: PASS

../../dist/bin/run-mozilla.sh ../../dist/bin/necko_unit_tests/test_all.sh
../../dist/bin/necko_unit_tests/test_bug331825.js: FAIL (see ../../dist/bin/necko_unit_tests/test_bug331825.js.log)
../../dist/bin/necko_unit_tests/test_bug336501.js: PASS
../../dist/bin/necko_unit_tests/test_content_sniffer.js: FAIL (see ../../dist/bin/necko_unit_tests/test_content_sniffer.js.log)
../../dist/bin/necko_unit_tests/test_cookie_header.js: FAIL (see ../../dist/bin/necko_unit_tests/test_cookie_header.js.log)
../../dist/bin/necko_unit_tests/test_event_sink.js: FAIL (see ../../dist/bin/necko_unit_tests/test_event_sink.js.log)
../../dist/bin/necko_unit_tests/test_http_headers.js: FAIL (see ../../dist/bin/necko_unit_tests/test_http_headers.js.log)
../../dist/bin/necko_unit_tests/test_parse_content_type.js: PASS
../../dist/bin/necko_unit_tests/test_protocolproxyservice.js: FAIL (see ../../dist/bin/necko_unit_tests/test_protocolproxyservice.js.log)

Oh no! ../../dist/bin/necko_unit_tests/test_all.sh just dumped a core file.

Here're the log files:
mcasadevall@dawn:~/src/thunderbird-2.0.0.22+build1+nobinonly/build-tree/mozilla/dist/bin/necko_unit_tests$ cat *.log
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nsNativeComponentLoader: registering deferred (0)
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file nsStringBundle.cpp, line 273
pldhash: for the table at address 0xf7588, the given entrySize of 44 probably favors chaining over double hashing.
###!!! ASSERTION: no native to utf-16 converter: 'gNativeToUnicode != INVALID_ICONV_T', file nsNativeCharsetUtils.cpp, line 374
Break: at file nsNativeCharsetUtils.cpp, line 374
###!!! ASSERTION: no utf-16 to native converter: 'gUnicodeToNative != INVALID_ICONV_T', file nsNativeCharsetUtils.cpp, line 375
Break: at file nsNativeCharsetUtils.cpp, line 375
Segmentation fault (core dumped)
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nsNativeComponentLoader: registering deferred (0)
WARNING: nsExceptionService ignoring thread destruction after shutdown, file nsExceptionService.cpp, line 191
WARNING: No event queue listener?, file nsEventQueue.cpp, line 79
Type Manifest File: /home/mcasadevall/src/thunderbird-2.0.0.22+build1+nobinonly/build-tree/mozilla/dist/bin/components/xpti.dat
*** test pending
*** test finished
*** exiting
*** PASS ***
nsStringStats
=> mAllocCount: 1406
=> mReallocCount: 977
=> mFreeCount: 1406
=> mShareCount: 1706
=> mAdoptCount: 181
=> mAdoptFreeCount: 180 -- LEAKED 1 !!!
nsNativeComponentLoader: autoregistering begins.
nsNativeComponentLoader: autoregistering succeeded
nsNativeComponentLoader: registering deferred (0)
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file nsStringBundle.cpp, line 273
pldhash: for the table at address 0xfe2c8, ...

	Status	Importance	Assigned to	Milestone
lightning-sunbird (Ubuntu)	Fix Released	Undecided	Unassigned
Jaunty	Won't Fix	Undecided	Unassigned
Karmic	Fix Released	Undecided	Unassigned
thunderbird (Ubuntu)	Fix Released	High	Michael Casadevall	Ubuntu ubuntu-9.10-beta
Jaunty	Won't Fix	Medium	Michael Casadevall	Ubuntu jaunty-updates
Karmic	Fix Released	High	Michael Casadevall	Ubuntu ubuntu-9.10-beta

Ubuntu
thunderbird package

[armel] thunderbird-bin crashed with SIGSEGVI

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Patches

Bug attachments

Remote bug watches

Changed in thunderbird (Ubuntu Karmic):
milestone:	karmic-alpha-3 → ubuntu-9.10-beta

Changed in thunderbird (Ubuntu Karmic):
status:	Confirmed → Fix Committed

Changed in thunderbird (Ubuntu Karmic):
status:	Fix Committed → Fix Released

Changed in thunderbird (Ubuntu Karmic):
status:	Fix Released → Fix Committed

Changed in thunderbird (Ubuntu Karmic):
importance:	Medium → High

Changed in lightning-sunbird (Ubuntu Karmic):
status:	New → Triaged
Changed in lightning-sunbird (Ubuntu Jaunty):
status:	New → Confirmed

Changed in lightning-sunbird (Ubuntu Karmic):
status:	Triaged → Fix Released

Changed in thunderbird (Ubuntu Jaunty):
status:	Confirmed → Won't Fix
Changed in lightning-sunbird (Ubuntu Jaunty):
status:	Confirmed → Won't Fix

Ubuntuthunderbird package

[armel] thunderbird-bin crashed with SIGSEGVI

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Patches

Bug attachments

Remote bug watches

Ubuntu
thunderbird package