Bug 1677225 - thunderbird-60.5.0-4.fc29 segmentation faults involving gfxPlatform::UsesOffMainThreadCompositing when another thunderbird process was running
Summary: thunderbird-60.5.0-4.fc29 segmentation faults involving gfxPlatform::UsesOffM...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: thunderbird
Version: 29
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Martin Stransky
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-02-14 10:08 UTC by Matt Fagnani
Modified: 2019-06-19 03:24 UTC (History)
14 users (show)

Fixed In Version: thunderbird-60.7.0-1.fc30
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-19 03:24:54 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)
gdb full trace of all threads for the segmentation faults when thunderbird was started a second time right after the first (295.87 KB, text/plain)
2019-02-14 10:18 UTC, Matt Fagnani 		no flags Details
gdb full trace of all threads for the segmentation fault when thunderbird was started again right after closing the first thunderbird window (297.73 KB, text/plain)
2019-02-14 10:25 UTC, Matt Fagnani 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Mozilla Foundation 1528443 0 None None None 2019-06-19 03:06:16 UTC

Description Matt Fagnani 2019-02-14 10:08:34 UTC 
Description of problem:

I noticed many segmentation faults in thunderbird-60.5.0-4.fc29 in coredumpctl which weren't shown in coredumpctl or the journal when using thunderbird-60.5.0-1.fc29 for a few days from koji or any previous versions. The first way in which these crashes occurred was when thunderbird was started and then another thunderbird process was started before the first thunderbird window appeared as in the following.

$ thunderbird &
[1] 2745
$ thunderbird &
[2] 2756
[1]-  Segmentation fault      (core dumped) thunderbird

In this case the first thunderbird process had a segmentation fault, though I've seen it happen to the second thunderbird process. The segmentation fault using coredumpctl debug / gdb was shown with the trace of the crashing thread as:

Core was generated by `/usr/lib/thunderbird/thunderbird'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xb00b5a11 in gfxPlatform::UsesOffMainThreadCompositing ()
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/StaticPtr.h:67
67        T* operator->() const {
[Current thread is 1 (Thread 0xb7ad3940 (LWP 2311))]

(gdb) bt
#0  0xb00b5a11 in gfxPlatform::UsesOffMainThreadCompositing() ()
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/StaticPtr.h:67
#1  0xb151cd56 in nsBaseWidget::ShouldUseOffMainThreadCompositing()
    (this=0xb784a200)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/nsBaseWidget.cpp:1346
#2  0xb151cd56 in nsBaseWidget::GetLayerManager(mozilla::layers::PLayerTransactionChild*, mozilla::layers::LayersBackend, nsIWidget::LayerManagerPersistence) (
    this=0xb784a200, 
    aShadowManager=0x0, aBackendHint=mozilla::layers::LayersBackend::LAYERS_NONE, aPersistence=nsIWidget::LAYER_MANAGER_CURRENT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/nsBaseWidget.cpp:1358
#3  0xb1567cbc in nsWindow::GetLayerManager(mozilla::layers::PLayerTransactionChild*, mozilla::layers::LayersBackend, nsIWidget::LayerManagerPersistence)
    (aPersistence=nsIWidget::LAYER_MANAGER_CURRENT, aBackendHint=mozilla::layers::LayersBackend::LAYERS_NONE, aShadowManager=0x0, this=0xb784a200)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/gtk/nsWindow.cpp:5966
#4  0xb1567cbc in nsWindow::SetCompositorHint(nsWindow::WindowComposeRequest)
    (this=0xb784a200, aState=nsWindow::GTK_WIDGET_COMPOSIDED_ENABLED)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/gtk/nsWindow.cpp:6539
#5  0xb1568cc3 in nsWindow::Create(nsIWidget*, void*, mozilla::gfx::IntRectTyped<mozilla::LayoutDevicePixel> const&, nsWidgetInitData*)
    (this=0xb784a200, aParent=0x0, aNativeParent=0x0, aRect=..., aInitData=0xbf9565fc) at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/gtk/nsWindow.cpp:3747
#6  0xb2227187 in nsIWidget::Create(nsIWidget*, void*, mozilla::gfx::IntRectTyped<mozilla::DesktopPixel> const&, nsWidgetInitData*)
    (aInitData=<optimized out>, aRect=..., aNativeParent=0x0, aParent=<optimized ou--Type <RET> for more, q to quit, c to continue without paging--
t>, this=0xb784a200)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsIWidget.h:441
#7  0xb2227187 in nsWebShellWindow::Initialize(nsIXULWindow*, nsIXULWindow*, nsIURI*, int, int, bool, nsITabParent*, mozIDOMWindowProxy*, nsWidgetInitData&)
    (this=<optimized out>, aParent=<optimized out>, aOpener=<optimized out>, aUrl=<optimized out>, aInitialWidth=<optimized out>, aInitialHeight=<optimized out>, aIsHiddenWindow=<optimized out>, aOpeningTab=<optimized out>, aOpenerWindow=<optimized out>, widgetInitData=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/xpfe/appshell/nsWebShellWindow.cpp:170
#8  0xb22297bb in nsAppShellService::JustCreateTopWindow(nsIXULWindow*, nsIURI*, unsigned int, int, int, bool, nsITabParent*, mozIDOMWindowProxy*, nsWebShellWindow**) (this=0xa692f340, aParent=0x0, aUrl=0x0, aChromeMask=4160750598, aInitialWidth=1, aInitialHeight=1, aIsHiddenWindow=false, aOpeningTab=0x0, 
    aOpenerWindow=0x0, aResult=0xbf956684)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:696
#9  0xb2229feb in nsAppShellService::CreateTopLevelWindow(nsIXULWindow*, nsIURI*, unsigned int, int, int, nsITabParent*, mozIDOMWindowProxy*, nsIXULWindow**)
    (this=0xa692f340, aParent=0x0, aUrl=0x0, aChromeMask=4160750598, aInitialWidth=-1, aInitialHeight=-1, aOpeningTab=0x0, aOpenerWindow=0x0, aResult=0xbf956708)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/RefPtr.h:424
#10 0xb246e63a in nsAppStartup::CreateChromeWindow2(nsIWebBrowserChrome*, unsigned int, nsITabParent*, mozIDOMWindowProxy*, unsigned long long, bool*, nsIWebBrowserChrome**)
--Type <RET> for more, q to quit, c to continue without paging--
    (this=0xaab9a2e0, aParent=0x0, aChromeFlags=4160750598, aOpeningTab=0x0, aOpener=0x0, aNextTabParentId=0, aCancel=0xbf956783, _retval=0xbf956788)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:1190
#11 0xb24daece in nsWindowWatcher::CreateChromeWindow(nsTSubstring<char> const&, nsIWebBrowserChrome*, unsigned int, nsITabParent*, mozIDOMWindowProxy*, unsigned long long, nsIWebBrowserChrome**)
    (this=0xa690b100, aFeatures=..., aParentChrome=0x0, aChromeFlags=4160750598, aOpeningTabParent=0x0, aOpener=0x0, aNextTabParentId=0, aResult=0xbf95686c)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:1190
#12 0xb24df54e in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsIDocShellLoadInfo*, mozIDOMWindowProxy**)
    (this=0xa690b100, aParent=0x0, aUrl=0xa6910460 "chrome://global/content/commonDialog.xul", aName=0xaabdbd60 "_blank", aFeatures=0xa69104c0 "centerscreen,chrome,modal,titlebar", aCalledFromJS=false, aDialog=true, aNavigate=true, aArgv=0xa6914140, aIsPopupSpam=false, aForceNoOpener=false, aLoadInfo=0x0, aResult=0xbf956bd8)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:696
#13 0xb24e0546 in nsWindowWatcher::OpenWindow(mozIDOMWindowProxy*, char const*, char const*, char const*, nsISupports*, mozIDOMWindowProxy**)
    (this=0xa690b100, aParent=0x0, aUrl=0xa6910460 "chrome://global/content/commonDialog.xul", aName=0xaabdbd60 "_blank", aFeatures=0xa69104c0 "centerscreen,chrome,modal,titlebar", aArguments=0xa6927520, aResult=0xbf956bd8)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/components/windowwatcher/nsWindowWatcher.cpp:319
--Type <RET> for more, q to quit, c to continue without paging--
#14 0xaf509798 in NS_InvokeByIndex ()
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/xpcom/threads/nsTimerImpl.h:209
#15 0xafc484b3 in CallMethodHelper::Invoke() (this=0xbf956b58)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/xpconnect/src/XPCWrappedNative.cpp:1801
#16 0xafc484b3 in CallMethodHelper::Call() (this=0xbf956b58)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/xpconnect/src/XPCWrappedNative.cpp:1173
#17 0xafc484b3 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) (ccx=..., mode=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/xpconnect/src/XPCWrappedNative.cpp:1145
#18 0xafc4d0f1 in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)
    (cx=0xaac0c800, argc=5, vp=0xa88eb1e0)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:793
#19 0xb25eeeec in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)
    (args=..., native=0xafc4cf00 <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, cx=0xaac0c800)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/js/CallArgs.h:270
#20 0xb25eeeec in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0xaac0c800, args=..., construct=js::NO_CONSTRUCT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:435
#21 0xb25ef1e5 in InternalCall(JSContext*, js::AnyInvokeArgs const&)
--Type <RET> for more, q to quit, c to continue without paging--
    (cx=0xaac0c800, args=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:484
#22 0xb25e388b in js::CallFromStack(JSContext*, JS::CallArgs const&)
    (args=..., cx=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#23 0xb25e388b in Interpret(JSContext*, js::RunState&) (cx=0x0, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#24 0xb25eeaea in js::RunScript(JSContext*, js::RunState&)
    (cx=<optimized out>, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:385
#25 0xb25ef03e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0xaac0c800, args=..., construct=js::NO_CONSTRUCT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:457
#26 0xb25ef1e5 in InternalCall(JSContext*, js::AnyInvokeArgs const&)
    (cx=0xaac0c800, args=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:484
#27 0xb25e388b in js::CallFromStack(JSContext*, JS::CallArgs const&)
    (args=..., cx=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#28 0xb25e388b in Interpret(JSContext*, js::RunState&) (cx=0x0, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#29 0xb25eeaea in js::RunScript(JSContext*, js::RunState&)
    (cx=<optimized out>, state=...)
--Type <RET> for more, q to quit, c to continue without paging--
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:385
#30 0xb25ef03e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0xaac0c800, args=..., construct=js::NO_CONSTRUCT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:457
#31 0xb25ef1e5 in InternalCall(JSContext*, js::AnyInvokeArgs const&)
    (cx=0xaac0c800, args=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:484
#32 0xb25e388b in js::CallFromStack(JSContext*, JS::CallArgs const&)
    (args=..., cx=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#33 0xb25e388b in Interpret(JSContext*, js::RunState&) (cx=0x0, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#34 0xb25eeaea in js::RunScript(JSContext*, js::RunState&)
    (cx=<optimized out>, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:385
#35 0xb25ef03e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0xaac0c800, args=..., construct=js::NO_CONSTRUCT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:457
#36 0xb25ef1e5 in InternalCall(JSContext*, js::AnyInvokeArgs const&)
    (cx=cx@entry=0xaac0c800, args=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:484
#37 0xb25ef2c8 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)
    (cx=0xaac0c800, fval=..., thisv=..., args=..., rval=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:500
--Type <RET> for more, q to quit, c to continue without paging--
#38 0xb28c2328 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)
    (cx=0xaac0c800, obj=..., fval=..., args=..., rval=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/js/RootingAPI.h:1090
#39 0xafc4b625 in nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*)
    (this=0xa6907dc0, wrapper=0xa690b2c0, methodIndex=3, info=0xa991cd70, nativeParams=0xbf957f68)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/js/RootingAPI.h:1090
#40 0xafc4c076 in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*)
    (this=0xa690b2c0, methodIndex=3, info=0xa991cd70, params=0xbf957f68)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/RefPtr.h:253
#41 0xaf50a2ac in PrepareAndDispatch(uint32_t, nsXPTCStubBase*, uint32_t*)
    (methodIndex=<optimized out>, self=<optimized out>, args=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/xpcom/reflect/xptcall/md/unix/xptcstubs_gcc_x86_unix.cpp:60
#42 0xb2508a7a in ProfileLockedDialog(nsIFile*, nsIFile*, nsIProfileUnlocker*, nsINativeAppSupport*, nsIProfileLock**) (
    aProfileDir=0xb7847d00, aProfileLocalDir=0xb7847d00, aUnlocker=0x0, 
    aNative=0xb78c02a0, aResult=0xbf958520)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:1924
#43 0xb2508bbe in ProfileLockedDialog(nsIToolkitProfile*, nsIProfileUnlocker*, nsIN--Type <RET> for more, q to quit, c to continue without paging--
ativeAppSupport*, nsIProfileLock**) (aProfile=
    0xb78c4160, aUnlocker=0x0, aNative=aNative@entry=0xb78c02a0, aResult=0xbf958520)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:696
#44 0xb250ae8d in SelectProfile
    (aProfileName=0xbf958584, aStartOffline=0xbf958624, aNative=0xb78c02a0, aProfileSvc=<optimized out>, aResult=0xbf958520)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:696
#45 0xb250ae8d in XREMain::XRE_mainStartup(bool*)
    (this=0xbf958510, aExitFlag=0xbf9584a4)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:4125
#46 0xb250d1c1 in XREMain::XRE_mainStartup(bool*)
    (aExitFlag=0xbf9584a4, this=0xbf958510)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:4783
#47 0xb250d1c1 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)
    (this=<optimized out>, argc=<optimized out>, argv=<optimized out>, aConfig=...) at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:4783
#48 0xb250d751 in XRE_main(int, char**, mozilla::BootstrapConfig const&)
    (argc=1, argv=0xbf9597a4, aConfig=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:4881
#49 0x0044cb1c in do_main(int, char**, char**)
    (argc=1, argv=0xbf9597a4, envp=<optimized out>)
--Type <RET> for more, q to quit, c to continue without paging--
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/UniquePtr.h:307
#50 0x0044c2ff in main(int, char**, char**)
    (argc=1, argv=0xbf9597a4, envp=0xbf9597ac)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/comm/mail/app/nsMailApp.cpp:306

The second type of crashes occurred when I started thunderbird and then closed it, then I started thunderbird again before the first thunderbird process had stopped. These crashes may have involved a race condition since they depend on how long it took the first thunderbird process to finish. The second thunderbird process had a segmentation fault with the following output from coredumpctl debug / gdb

Core was generated by `/usr/lib/thunderbird/thunderbird'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xb7f5fa61 in __kernel_vsyscall ()
[Current thread is 1 (Thread 0xb7acf940 (LWP 2651))]

(gdb) bt
#0  0xb7f5fa61 in __kernel_vsyscall ()
#1  0xb7f192f6 in __libc_signal_restore_set (set=0xbfe0548c)
    at ../sysdeps/unix/sysv/linux/internal-signals.h:84
#2  0xb7f192f6 in raise (sig=<optimized out>)
    at ../sysdeps/unix/sysv/linux/raise.c:48
#3  0xb24fb3ea in nsProfileLock::FatalSignalHandler(int, siginfo_t*, void*)
    (signo=11, info=0xbfe0570c, context=0xbfe0578c)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/profile/nsProfileLock.cpp:165
#4  0xb2ae7c03 in WasmFaultHandler
    (context=0xbfe0578c, info=0xbfe0570c, signum=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/wasm/WasmSignalHandlers.cpp:1520
#5  0xb2ae7c03 in WasmFaultHandler(int, siginfo_t*, void*)
    (signum=11, info=0xbfe0570c, context=0xbfe0578c)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/wasm/WasmSignalHandlers.cpp:1490
#6  0xb7f5fa78 in <signal handler called> ()
#7  0xb00b0a11 in gfxPlatform::UsesOffMainThreadCompositing() ()
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/StaticPtr.h:67
#8  0xb1517d56 in nsBaseWidget::ShouldUseOffMainThreadCompositing()
    (this=0xb784a200)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/nsBaseWidget.cpp:1346
#9  0xb1517d56 in nsBaseWidget::GetLayerManager(mozilla::layers::PLayerTransactionChild*, mozilla::layers::LayersBackend, nsIWidget::LayerManagerPersistence) (
    this=0xb784a200, 
--Type <RET> for more, q to quit, c to continue without paging--
    aShadowManager=0x0, aBackendHint=mozilla::layers::LayersBackend::LAYERS_NONE, aPersistence=nsIWidget::LAYER_MANAGER_CURRENT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/nsBaseWidget.cpp:1358
#10 0xb1562cbc in nsWindow::GetLayerManager(mozilla::layers::PLayerTransactionChild*, mozilla::layers::LayersBackend, nsIWidget::LayerManagerPersistence)
    (aPersistence=nsIWidget::LAYER_MANAGER_CURRENT, aBackendHint=mozilla::layers::LayersBackend::LAYERS_NONE, aShadowManager=0x0, this=0xb784a200)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/gtk/nsWindow.cpp:5966
#11 0xb1562cbc in nsWindow::SetCompositorHint(nsWindow::WindowComposeRequest)
    (this=0xb784a200, aState=nsWindow::GTK_WIDGET_COMPOSIDED_ENABLED)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/gtk/nsWindow.cpp:6539
#12 0xb1563cc3 in nsWindow::Create(nsIWidget*, void*, mozilla::gfx::IntRectTyped<mozilla::LayoutDevicePixel> const&, nsWidgetInitData*)
    (this=0xb784a200, aParent=0x0, aNativeParent=0x0, aRect=..., aInitData=0xbfe05d6c) at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/gtk/nsWindow.cpp:3747
#13 0xb2222187 in nsIWidget::Create(nsIWidget*, void*, mozilla::gfx::IntRectTyped<mozilla::DesktopPixel> const&, nsWidgetInitData*)
    (aInitData=<optimized out>, aRect=..., aNativeParent=0x0, aParent=<optimized out>, this=0xb784a200)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsIWidget.h:441
#14 0xb2222187 in nsWebShellWindow::Initialize(nsIXULWindow*, nsIXULWindow*, nsIURI*, int, int, bool, nsITabParent*, mozIDOMWindowProxy*, nsWidgetInitData&)
    (this=<optimized out>, aParent=<optimized out>, aOpener=<optimized out>, aUrl=<optimized out>, aInitialWidth=<optimized out>, aInitialHeight=<optimized out>, aIsHiddenWindow=<optimized out>, aOpeningTab=<optimized out>, aOpenerWindow=<optimized out>, widgetInitData=...)
--Type <RET> for more, q to quit, c to continue without paging--
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/xpfe/appshell/nsWebShellWindow.cpp:170
#15 0xb22247bb in nsAppShellService::JustCreateTopWindow(nsIXULWindow*, nsIURI*, unsigned int, int, int, bool, nsITabParent*, mozIDOMWindowProxy*, nsWebShellWindow**) (this=0xa6943780, aParent=0x0, aUrl=0x0, aChromeMask=4160750598, aInitialWidth=1, aInitialHeight=1, aIsHiddenWindow=false, aOpeningTab=0x0, 
    aOpenerWindow=0x0, aResult=0xbfe05df4)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:696
#16 0xb2224feb in nsAppShellService::CreateTopLevelWindow(nsIXULWindow*, nsIURI*, unsigned int, int, int, nsITabParent*, mozIDOMWindowProxy*, nsIXULWindow**)
    (this=0xa6943780, aParent=0x0, aUrl=0x0, aChromeMask=4160750598, aInitialWidth=-1, aInitialHeight=-1, aOpeningTab=0x0, aOpenerWindow=0x0, aResult=0xbfe05e78)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/RefPtr.h:424
#17 0xb246963a in nsAppStartup::CreateChromeWindow2(nsIWebBrowserChrome*, unsigned int, nsITabParent*, mozIDOMWindowProxy*, unsigned long long, bool*, nsIWebBrowserChrome**)
    (this=0xaabad1c0, aParent=0x0, aChromeFlags=4160750598, aOpeningTab=0x0, aOpener=0x0, aNextTabParentId=0, aCancel=0xbfe05ef3, _retval=0xbfe05ef8)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:1190
#18 0xb24d5ece in nsWindowWatcher::CreateChromeWindow(nsTSubstring<char> const&, nsIWebBrowserChrome*, unsigned int, nsITabParent*, mozIDOMWindowProxy*, unsigned long long, nsIWebBrowserChrome**)
    (this=0xa6906240, aFeatures=..., aParentChrome=0x0, aChromeFlags=4160750598, aOpeningTabParent=0x0, aOpener=0x0, aNextTabParentId=0, aResult=0xbfe05fdc)
--Type <RET> for more, q to quit, c to continue without paging--
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:1190
#19 0xb24da54e in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsIDocShellLoadInfo*, mozIDOMWindowProxy**)
    (this=0xa6906240, aParent=0x0, aUrl=0xa6915370 "chrome://global/content/commonDialog.xul", aName=0xaabefee0 "_blank", aFeatures=0xa69153a0 "centerscreen,chrome,modal,titlebar", aCalledFromJS=false, aDialog=true, aNavigate=true, aArgv=0xa6942740, aIsPopupSpam=false, aForceNoOpener=false, aLoadInfo=0x0, aResult=0xbfe06348)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:696
#20 0xb24db546 in nsWindowWatcher::OpenWindow(mozIDOMWindowProxy*, char const*, char const*, char const*, nsISupports*, mozIDOMWindowProxy**)
    (this=0xa6906240, aParent=0x0, aUrl=0xa6915370 "chrome://global/content/commonDialog.xul", aName=0xaabefee0 "_blank", aFeatures=0xa69153a0 "centerscreen,chrome,modal,titlebar", aArguments=0xa69436c0, aResult=0xbfe06348)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/components/windowwatcher/nsWindowWatcher.cpp:319
#21 0xaf504798 in NS_InvokeByIndex ()
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/xpcom/threads/nsTimerImpl.h:209
#22 0xafc434b3 in CallMethodHelper::Invoke() (this=0xbfe062c8)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/xpconnect/src/XPCWrappedNative.cpp:1801
#23 0xafc434b3 in CallMethodHelper::Call() (this=0xbfe062c8)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/xpconnect/src/XPCWrappedNative.cpp:1173
--Type <RET> for more, q to quit, c to continue without paging--
#24 0xafc434b3 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) (ccx=..., mode=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/xpconnect/src/XPCWrappedNative.cpp:1145
#25 0xafc480f1 in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)
    (cx=0xaac0c800, argc=5, vp=0xa88eb1e0)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:793
#26 0xb25e9eec in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)
    (args=..., native=0xafc47f00 <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, cx=0xaac0c800)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/js/CallArgs.h:270
#27 0xb25e9eec in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0xaac0c800, args=..., construct=js::NO_CONSTRUCT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:435
#28 0xb25ea1e5 in InternalCall(JSContext*, js::AnyInvokeArgs const&)
    (cx=0xaac0c800, args=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:484
#29 0xb25de88b in js::CallFromStack(JSContext*, JS::CallArgs const&)
    (args=..., cx=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#30 0xb25de88b in Interpret(JSContext*, js::RunState&) (cx=0x0, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
--Type <RET> for more, q to quit, c to continue without paging--
#31 0xb25e9aea in js::RunScript(JSContext*, js::RunState&)
    (cx=<optimized out>, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:385
#32 0xb25ea03e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0xaac0c800, args=..., construct=js::NO_CONSTRUCT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:457
#33 0xb25ea1e5 in InternalCall(JSContext*, js::AnyInvokeArgs const&)
    (cx=0xaac0c800, args=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:484
#34 0xb25de88b in js::CallFromStack(JSContext*, JS::CallArgs const&)
    (args=..., cx=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#35 0xb25de88b in Interpret(JSContext*, js::RunState&) (cx=0x0, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#36 0xb25e9aea in js::RunScript(JSContext*, js::RunState&)
    (cx=<optimized out>, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:385
#37 0xb25ea03e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0xaac0c800, args=..., construct=js::NO_CONSTRUCT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:457
#38 0xb25ea1e5 in InternalCall(JSContext*, js::AnyInvokeArgs const&)
    (cx=0xaac0c800, args=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:484
#39 0xb25de88b in js::CallFromStack(JSContext*, JS::CallArgs const&)
    (args=..., cx=<optimized out>)
--Type <RET> for more, q to quit, c to continue without paging--
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#40 0xb25de88b in Interpret(JSContext*, js::RunState&) (cx=0x0, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:2873
#41 0xb25e9aea in js::RunScript(JSContext*, js::RunState&)
    (cx=<optimized out>, state=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:385
#42 0xb25ea03e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0xaac0c800, args=..., construct=js::NO_CONSTRUCT)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:457
#43 0xb25ea1e5 in InternalCall(JSContext*, js::AnyInvokeArgs const&)
    (cx=cx@entry=0xaac0c800, args=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:484
#44 0xb25ea2c8 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)
    (cx=0xaac0c800, fval=..., thisv=..., args=..., rval=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/js/src/vm/Interpreter.cpp:500
#45 0xb28bd328 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)
    (cx=0xaac0c800, obj=..., fval=..., args=..., rval=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/js/RootingAPI.h:1090
#46 0xafc46625 in nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*)
    (this=0xa690dd60, wrapper=0xa6906440, methodIndex=3, info=0xa992ed70, nativeParams=0xbfe076d8)
--Type <RET> for more, q to quit, c to continue without paging--
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/js/RootingAPI.h:1090
#47 0xafc47076 in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*)
    (this=0xa6906440, methodIndex=3, info=0xa992ed70, params=0xbfe076d8)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/RefPtr.h:253
#48 0xaf5052ac in PrepareAndDispatch(uint32_t, nsXPTCStubBase*, uint32_t*)
    (methodIndex=<optimized out>, self=<optimized out>, args=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/xpcom/reflect/xptcall/md/unix/xptcstubs_gcc_x86_unix.cpp:60
#49 0xb2503a7a in ProfileLockedDialog(nsIFile*, nsIFile*, nsIProfileUnlocker*, nsINativeAppSupport*, nsIProfileLock**) (
    aProfileDir=0xb7847e00, aProfileLocalDir=0xb7847e00, aUnlocker=0x0, 
    aNative=0xb78bf3c0, aResult=0xbfe07c90)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:1924
#50 0xb2503bbe in ProfileLockedDialog(nsIToolkitProfile*, nsIProfileUnlocker*, nsINativeAppSupport*, nsIProfileLock**)
    (aProfile=0xb78c6040, aUnlocker=0x0, aNative=aNative@entry=0xb78bf3c0, aResult=0xbfe07c90)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h:696
#51 0xb2505e8d in SelectProfile
    (aProfileName=0xbfe07cf4, aStartOffline=0xbfe07d94, aNative=0xb78bf3c0, aProfileSvc=<optimized out>, aResult=0xbfe07c90)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/nsCOMPtr.h--Type <RET> for more, q to quit, c to continue without paging--
:696
#52 0xb2505e8d in XREMain::XRE_mainStartup(bool*)
    (this=0xbfe07c80, aExitFlag=0xbfe07c14)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:4125
#53 0xb25081c1 in XREMain::XRE_mainStartup(bool*)
    (aExitFlag=0xbfe07c14, this=0xbfe07c80)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:4783
#54 0xb25081c1 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)
    (this=<optimized out>, argc=<optimized out>, argv=<optimized out>, aConfig=...) at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:4783
#55 0xb2508751 in XRE_main(int, char**, mozilla::BootstrapConfig const&)
    (argc=1, argv=0xbfe08f14, aConfig=...)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/toolkit/xre/nsAppRunner.cpp:4881
#56 0x0047ab1c in do_main(int, char**, char**)
    (argc=1, argv=0xbfe08f14, envp=<optimized out>)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/UniquePtr.h:307
#57 0x0047a2ff in main(int, char**, char**)
    (argc=1, argv=0xbfe08f14, envp=0xbfe08f1c)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/comm/mail/app/nsMailApp.cpp:306

These crashes had gfxPlatform::UsesOffMainThreadCompositing() () at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/objdir/dist/include/mozilla/StaticPtr.h:67 at #7, while the signal handler was triggered and run in #6 to #1 and then the segmentation fault occurred or stopped in a kernel system call in #0. The first group of crashes had the segmentation fault occurring in gfxPlatform::UsesOffMainThreadCompositing() so there's likely some relation between the types of crashes. I'll attach the full traces of all threads.

I'm using Plasma 5.14.4 on X 1.20.3 first using the Mesa 17.2.8 and now 17.3.3 llvmpipe software-based rendering driver. Since the function UsesOffMainThreadCompositing appears to involve whether thunderbird can use off main thread compositing, my system's use of the llvmpipe driver might be involved. The option in thunderbird's Preferences > Advanced > Use hardware acceleration when available is not selected.

Version-Release number of selected component (if applicable):
thunderbird-0:60.5.0-4.fc29.i686
plasma-desktop-0:5.14.4-2.fc29.i686
xorg-x11-server-Xorg-0:1.20.3-3.fc29.i686
mesa-libGL-0:18.3.3-1.fc29.i686

How reproducible:
The crashes when starting a second thunderbird process right after starting the first one have happened about 14 times and occurred most of the time. The crashes when starting a second thunderbird process right after closing the first one have happened about 5 times and happened a lower proportion of the times I tried to reproduce them.

Steps to Reproduce:
1. thunderbird & (in konsole in Plasma on X)
2. thunderbird & (right after 1.)
or
3. thunderbird &
4. close thunderbird
5. start thunderbird before the first thunderbird process stops
6. coredumpctl

Actual results:
thunderbird segmentation faulted when another thunderbird process was running.

Expected results:
no segmentation faults.

Additional info:

Firefox sometimes showed an error message when I tried to start it and another firefox process was running. A similar error message might be appropriate for thunderbird which might be used to prevent these crashes.
Comment 1 Matt Fagnani 2019-02-14 10:18:41 UTC 
Created attachment 1534729 [details]
gdb full trace of all threads for the segmentation faults when thunderbird was started a second time right after the first

This attachment has the coredumpctl debug gdb output of thread apply all bt full for the first type of segmentation fault I described.
Comment 2 Matt Fagnani 2019-02-14 10:25:55 UTC 
Created attachment 1534731 [details]
gdb full trace of all threads for the segmentation fault when thunderbird was started again right after closing the first thunderbird window

This attachment is the output of coredumpctl debug gdb thread apply all bt full for the second type of crash I described.
Comment 3 Matt Fagnani 2019-02-16 03:09:51 UTC 
I reported these crashes at https://bugzilla.mozilla.org/show_bug.cgi?id=1528443
Comment 4 Antony 2019-02-17 16:23:22 UTC 
I have the same stacktrace, except for me no previous instances of thunderbird are running and the crash happens immediately on startup, on both of my machines using different graphics hardware (one uses nvidia drivers, the other an intel chipset).
Comment 5 Martin Stransky 2019-02-18 13:11:27 UTC 
Can you try mozilla TB binaries from https://www.thunderbird.net/en-US/? It's possible that Fedora specific bug. Thanks.
Comment 6 Matt Fagnani 2019-02-19 01:57:56 UTC 
I haven't seen the segmentation faults using 60.5.1 from thunderbird.net.  When I tried to start the second thunderbird 60.5.1 process right after starting the first:
1. about 4 times, there was an error message "Close Thunderbird
Thunderbird is already running, but is not responding. To open a new window, you must first close the existing Thunderbird process, or restart your system."
2. about 4 times, the second thunderbird process stopped without a segmentation fault
3. once two thunderbird windows opened

When I tried to start the second thunderbird 60.5.1 process right after closing the first, the second thunderbird window opened normally in most cases, otherwise the second thunderbird process stopped normally. 

In the Troubleshooting information section of 60.5.0-4.fc29, the Graphics section showed errors with WebGL and the information about the Mesa llvmpipe driver was missing as follows.

Graphics

      Features
      Compositing: Basic
      Asynchronous Pan/Zoom: none
      WebGL 1 Driver WSI Info: -
      WebGL 1 Driver Renderer: WebGL creation failed:
* Refused to create native OpenGL context because of blacklist entry:
* Exhausted GL driver options.
      WebGL 1 Driver Version: -
      WebGL 1 Driver Extensions: -
      WebGL 1 Extensions: -
      WebGL 2 Driver WSI Info: -
      WebGL 2 Driver Renderer: WebGL creation failed:
* Refused to create WebGL2 context because of blacklist entry:
      WebGL 2 Driver Version: -
      WebGL 2 Driver Extensions: -
      WebGL 2 Extensions: -

    GPU #1

    GPU #2

      Diagnostics
      AzureCanvasAccelerated: 0
      AzureCanvasBackend: skia
      AzureContentBackend: skia
      AzureFallbackCanvasBackend: none
      CairoUseXRender: 0

      Decision Log
      HW_COMPOSITING: blocked by default: Acceleration blocked by platform
      OPENGL_COMPOSITING: unavailable by default: Hardware compositing is disabled
      WEBRENDER: opt-in by default: WebRender is an opt-in featureunavailable by runtime: Build doesn't include WebRender
      OMTP: disabled by default: Disabled by default

    Crash Guard Disabled Features

    Workarounds

    Failure Log

Those errors weren't shown in 60.5.1 from thunderbird.net and the normal information about the Mesa llvmpipe driver was shown.

  Graphics

      Features
      Compositing: Basic
      Asynchronous Pan/Zoom: none
      WebGL 1 Driver WSI Info: GLX 1.4
GLX_VENDOR(client): Mesa Project and SGI
GLX_VENDOR(server): SGI
Extensions: GLX_ARB_context_flush_control GLX_ARB_create_context GLX_ARB_create_context_profile GLX_ARB_fbconfig_float GLX_ARB_framebuffer_sRGB GLX_ARB_get_proc_address GLX_ARB_multisample GLX_EXT_create_context_es2_profile GLX_EXT_create_context_es_profile GLX_EXT_fbconfig_packed_float GLX_EXT_framebuffer_sRGB GLX_EXT_import_context GLX_EXT_texture_from_pixmap GLX_EXT_visual_info GLX_EXT_visual_rating GLX_MESA_copy_sub_buffer GLX_MESA_query_renderer GLX_OML_swap_method GLX_SGIS_multisample GLX_SGIX_fbconfig GLX_SGIX_pbuffer GLX_SGIX_visual_select_group GLX_SGI_make_current_read
      WebGL 1 Driver Renderer: VMware, Inc. -- llvmpipe (LLVM 7.0, 128 bits)
      WebGL 1 Driver Version: 3.1 Mesa 18.3.3
      WebGL 1 Driver Extensions: GL_ARB_multisample GL_EXT_abgr GL_EXT_bgra GL_EXT_blend_color GL_EXT_blend_minmax GL_EXT_blend_subtract GL_EXT_copy_texture GL_EXT_subtexture GL_EXT_texture_object GL_EXT_vertex_array GL_EXT_compiled_vertex_array GL_EXT_texture GL_EXT_texture3D GL_IBM_rasterpos_clip GL_ARB_point_parameters GL_EXT_draw_range_elements GL_EXT_packed_pixels GL_EXT_point_parameters GL_EXT_rescale_normal GL_EXT_separate_specular_color GL_EXT_texture_edge_clamp GL_SGIS_generate_mipmap GL_SGIS_texture_border_clamp GL_SGIS_texture_edge_clamp GL_SGIS_texture_lod GL_ARB_framebuffer_sRGB GL_ARB_multitexture GL_EXT_framebuffer_sRGB GL_IBM_multimode_draw_arrays GL_IBM_texture_mirrored_repeat GL_ARB_texture_cube_map GL_ARB_texture_env_add GL_ARB_transpose_matrix GL_EXT_blend_func_separate GL_EXT_fog_coord GL_EXT_multi_draw_arrays GL_EXT_secondary_color GL_EXT_texture_env_add GL_EXT_texture_lod_bias GL_INGR_blend_func_separate GL_NV_blend_square GL_NV_light_max_exponent GL_NV_texgen_reflection GL_NV_texture_env_combine4 GL_S3_s3tc GL_SUN_multi_draw_arrays GL_ARB_texture_border_clamp GL_ARB_texture_compression GL_EXT_framebuffer_object GL_EXT_texture_compression_s3tc GL_EXT_texture_env_combine GL_EXT_texture_env_dot3 GL_MESA_window_pos GL_NV_packed_depth_stencil GL_NV_texture_rectangle GL_ARB_depth_texture GL_ARB_occlusion_query GL_ARB_shadow GL_ARB_texture_env_combine GL_ARB_texture_env_crossbar GL_ARB_texture_env_dot3 GL_ARB_texture_mirrored_repeat GL_ARB_window_pos GL_ATI_fragment_shader GL_EXT_stencil_two_side GL_EXT_texture_cube_map GL_NV_depth_clamp GL_NV_fog_distance GL_APPLE_packed_pixels GL_ARB_draw_buffers GL_ARB_fragment_program GL_ARB_fragment_shader GL_ARB_shader_objects GL_ARB_vertex_program GL_ARB_vertex_shader GL_ATI_draw_buffers GL_ATI_texture_env_combine3 GL_ATI_texture_float GL_EXT_shadow_funcs GL_EXT_stencil_wrap GL_MESA_pack_invert GL_MESA_ycbcr_texture GL_NV_primitive_restart GL_ARB_depth_clamp GL_ARB_fragment_program_shadow GL_ARB_half_float_pixel GL_ARB_occlusion_query2 GL_ARB_point_sprite GL_ARB_shading_language_100 GL_ARB_sync GL_ARB_texture_non_power_of_two GL_ARB_vertex_buffer_object GL_ATI_blend_equation_separate GL_EXT_blend_equation_separate GL_OES_read_format GL_ARB_color_buffer_float GL_ARB_pixel_buffer_object GL_ARB_texture_compression_rgtc GL_ARB_texture_float GL_ARB_texture_rectangle GL_ATI_texture_compression_3dc GL_EXT_packed_float GL_EXT_pixel_buffer_object GL_EXT_texture_compression_dxt1 GL_EXT_texture_compression_rgtc GL_EXT_texture_mirror_clamp GL_EXT_texture_rectangle GL_EXT_texture_sRGB GL_EXT_texture_shared_exponent GL_ARB_framebuffer_object GL_EXT_framebuffer_blit GL_EXT_framebuffer_multisample GL_EXT_packed_depth_stencil GL_ARB_vertex_array_object GL_ATI_separate_stencil GL_ATI_texture_mirror_once GL_EXT_draw_buffers2 GL_EXT_draw_instanced GL_EXT_gpu_program_parameters GL_EXT_texture_array GL_EXT_texture_compression_latc GL_EXT_texture_integer GL_EXT_texture_sRGB_decode GL_EXT_timer_query GL_OES_EGL_image GL_ARB_copy_buffer GL_ARB_depth_buffer_float GL_ARB_draw_instanced GL_ARB_half_float_vertex GL_ARB_instanced_arrays GL_ARB_map_buffer_range GL_ARB_texture_buffer_object GL_ARB_texture_rg GL_ARB_texture_swizzle GL_ARB_vertex_array_bgra GL_EXT_texture_swizzle GL_EXT_vertex_array_bgra GL_NV_conditional_render GL_AMD_conservative_depth GL_AMD_draw_buffers_blend GL_AMD_seamless_cubemap_per_texture GL_AMD_shader_stencil_export GL_ARB_ES2_compatibility GL_ARB_blend_func_extended GL_ARB_compatibility GL_ARB_debug_output GL_ARB_draw_buffers_blend GL_ARB_draw_elements_base_vertex GL_ARB_explicit_attrib_location GL_ARB_fragment_coord_conventions GL_ARB_provoking_vertex GL_ARB_sampler_objects GL_ARB_seamless_cube_map GL_ARB_shader_stencil_export GL_ARB_shader_texture_lod GL_ARB_texture_buffer_object_rgb32 GL_ARB_texture_cube_map_array GL_ARB_texture_gather GL_ARB_texture_multisample GL_ARB_texture_query_lod GL_ARB_texture_rgb10_a2ui GL_ARB_uniform_buffer_object GL_ARB_vertex_type_2_10_10_10_rev GL_EXT_provoking_vertex GL_EXT_texture_snorm GL_MESA_texture_signed_rgba GL_ARB_draw_
indirect GL_ARB_get_program_binary GL_ARB_robustness GL_ARB_separate_shader_objects GL_ARB_shader_bit_encoding GL_ARB_shader_subroutine GL_ARB_texture_compression_bptc GL_ARB_timer_query GL_ARB_transform_feedback2 GL_ARB_transform_feedback3 GL_ARB_viewport_array GL_AMD_multi_draw_indirect GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_ARB_base_instance GL_ARB_compressed_texture_pixel_storage GL_ARB_conservative_depth GL_ARB_internalformat_query GL_ARB_map_buffer_alignment GL_ARB_shading_language_420pack GL_ARB_shading_language_packing GL_ARB_texture_storage GL_ARB_transform_feedback_instanced GL_EXT_framebuffer_multisample_blit_scaled GL_EXT_transform_feedback GL_AMD_shader_trinary_minmax GL_ARB_ES3_compatibility GL_ARB_arrays_of_arrays GL_ARB_clear_buffer_object GL_ARB_copy_image GL_ARB_explicit_uniform_location GL_ARB_fragment_layer_viewport GL_ARB_invalidate_subdata GL_ARB_multi_draw_indirect GL_ARB_program_interface_query GL_ARB_stencil_texturing GL_ARB_texture_buffer_range GL_ARB_texture_query_levels GL_ARB_texture_storage_multisample GL_ARB_texture_view GL_ARB_vertex_attrib_binding GL_KHR_debug GL_KHR_texture_compression_astc_ldr GL_ARB_buffer_storage GL_ARB_clear_texture GL_ARB_enhanced_layouts GL_ARB_internalformat_query2 GL_ARB_multi_bind GL_ARB_seamless_cubemap_per_texture GL_ARB_texture_mirror_clamp_to_edge GL_ARB_texture_stencil8 GL_ARB_vertex_type_10f_11f_11f_rev GL_EXT_shader_integer_mix GL_ARB_clip_control GL_ARB_conditional_render_inverted GL_ARB_cull_distance GL_ARB_direct_state_access GL_ARB_get_texture_sub_image GL_ARB_pipeline_statistics_query GL_ARB_transform_feedback_overflow_query GL_EXT_polygon_offset_clamp GL_KHR_context_flush_control GL_KHR_no_error GL_KHR_texture_compression_astc_sliced_3d GL_MESA_shader_integer_functions GL_ARB_polygon_offset_clamp
      WebGL 1 Extensions: ANGLE_instanced_arrays EXT_blend_minmax EXT_color_buffer_half_float EXT_frag_depth EXT_sRGB EXT_shader_texture_lod EXT_disjoint_timer_query OES_element_index_uint OES_standard_derivatives OES_texture_float OES_texture_float_linear OES_texture_half_float OES_texture_half_float_linear OES_vertex_array_object WEBGL_color_buffer_float WEBGL_compressed_texture_astc WEBGL_compressed_texture_etc WEBGL_compressed_texture_s3tc WEBGL_compressed_texture_s3tc_srgb WEBGL_debug_renderer_info WEBGL_debug_shaders WEBGL_depth_texture WEBGL_draw_buffers WEBGL_lose_context
      WebGL 2 Driver WSI Info: GLX 1.4
GLX_VENDOR(client): Mesa Project and SGI
GLX_VENDOR(server): SGI
Extensions: GLX_ARB_context_flush_control GLX_ARB_create_context GLX_ARB_create_context_profile GLX_ARB_fbconfig_float GLX_ARB_framebuffer_sRGB GLX_ARB_get_proc_address GLX_ARB_multisample GLX_EXT_create_context_es2_profile GLX_EXT_create_context_es_profile GLX_EXT_fbconfig_packed_float GLX_EXT_framebuffer_sRGB GLX_EXT_import_context GLX_EXT_texture_from_pixmap GLX_EXT_visual_info GLX_EXT_visual_rating GLX_MESA_copy_sub_buffer GLX_MESA_query_renderer GLX_OML_swap_method GLX_SGIS_multisample GLX_SGIX_fbconfig GLX_SGIX_pbuffer GLX_SGIX_visual_select_group GLX_SGI_make_current_read
      WebGL 2 Driver Renderer: VMware, Inc. -- llvmpipe (LLVM 7.0, 128 bits)
      WebGL 2 Driver Version: 3.3 (Core Profile) Mesa 18.3.3
      WebGL 2 Driver Extensions: GL_AMD_conservative_depth GL_AMD_draw_buffers_blend GL_AMD_gpu_shader_int64 GL_AMD_multi_draw_indirect GL_AMD_seamless_cubemap_per_texture GL_AMD_shader_stencil_export GL_AMD_shader_trinary_minmax GL_AMD_vertex_shader_layer GL_AMD_vertex_shader_viewport_index GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_ARB_ES2_compatibility GL_ARB_ES3_compatibility GL_ARB_arrays_of_arrays GL_ARB_base_instance GL_ARB_blend_func_extended GL_ARB_buffer_storage GL_ARB_clear_buffer_object GL_ARB_clear_texture GL_ARB_clip_control GL_ARB_compressed_texture_pixel_storage GL_ARB_conditional_render_inverted GL_ARB_conservative_depth GL_ARB_copy_buffer GL_ARB_copy_image GL_ARB_cull_distance GL_ARB_debug_output GL_ARB_depth_buffer_float GL_ARB_depth_clamp GL_ARB_direct_state_access GL_ARB_draw_buffers GL_ARB_draw_buffers_blend GL_ARB_draw_elements_base_vertex GL_ARB_draw_indirect GL_ARB_draw_instanced GL_ARB_enhanced_layouts GL_ARB_explicit_attrib_location GL_ARB_explicit_uniform_location GL_ARB_fragment_coord_conventions GL_ARB_fragment_layer_viewport GL_ARB_fragment_shader GL_ARB_framebuffer_object GL_ARB_framebuffer_sRGB GL_ARB_get_program_binary GL_ARB_get_texture_sub_image GL_ARB_gpu_shader_fp64 GL_ARB_gpu_shader_int64 GL_ARB_half_float_pixel GL_ARB_half_float_vertex GL_ARB_instanced_arrays GL_ARB_internalformat_query GL_ARB_internalformat_query2 GL_ARB_invalidate_subdata GL_ARB_map_buffer_alignment GL_ARB_map_buffer_range GL_ARB_multi_bind GL_ARB_multi_draw_indirect GL_ARB_occlusion_query2 GL_ARB_pipeline_statistics_query GL_ARB_pixel_buffer_object GL_ARB_point_sprite GL_ARB_polygon_offset_clamp GL_ARB_program_interface_query GL_ARB_provoking_vertex GL_ARB_robustness GL_ARB_sampler_objects GL_ARB_seamless_cube_map GL_ARB_seamless_cubemap_per_texture GL_ARB_separate_shader_objects GL_ARB_shader_bit_encoding GL_ARB_shader_objects GL_ARB_shader_stencil_export GL_ARB_shader_subroutine GL_ARB_shader_texture_lod GL_ARB_shading_language_420pack GL_ARB_shading_language_packing GL_ARB_stencil_texturing GL_ARB_sync GL_ARB_texture_buffer_object GL_ARB_texture_buffer_object_rgb32 GL_ARB_texture_buffer_range GL_ARB_texture_compression_bptc GL_ARB_texture_compression_rgtc GL_ARB_texture_cube_map_array GL_ARB_texture_float GL_ARB_texture_gather GL_ARB_texture_mirror_clamp_to_edge GL_ARB_texture_multisample GL_ARB_texture_non_power_of_two GL_ARB_texture_query_levels GL_ARB_texture_query_lod GL_ARB_texture_rectangle GL_ARB_texture_rg GL_ARB_texture_rgb10_a2ui GL_ARB_texture_stencil8 GL_ARB_texture_storage GL_ARB_texture_storage_multisample GL_ARB_texture_swizzle GL_ARB_texture_view GL_ARB_timer_query GL_ARB_transform_feedback2 GL_ARB_transform_feedback3 GL_ARB_transform_feedback_instanced GL_ARB_transform_feedback_overflow_query GL_ARB_uniform_buffer_object GL_ARB_vertex_array_bgra GL_ARB_vertex_array_object GL_ARB_vertex_attrib_64bit GL_ARB_vertex_attrib_binding GL_ARB_vertex_buffer_object GL_ARB_vertex_shader GL_ARB_vertex_type_10f_11f_11f_rev GL_ARB_vertex_type_2_10_10_10_rev GL_ARB_viewport_array GL_ATI_blend_equation_separate GL_ATI_texture_float GL_ATI_texture_mirror_once GL_EXT_abgr GL_EXT_blend_equation_separate GL_EXT_draw_buffers2 GL_EXT_draw_instanced GL_EXT_framebuffer_blit GL_EXT_framebuffer_multisample GL_EXT_framebuffer_multisample_blit_scaled GL_EXT_framebuffer_object GL_EXT_framebuffer_sRGB GL_EXT_packed_depth_stencil GL_EXT_packed_float GL_EXT_pixel_buffer_object GL_EXT_polygon_offset_clamp GL_EXT_provoking_vertex GL_EXT_shader_integer_mix GL_EXT_texture_array GL_EXT_texture_compression_dxt1 GL_EXT_texture_compression_rgtc GL_EXT_texture_compression_s3tc GL_EXT_texture_integer GL_EXT_texture_mirror_clamp GL_EXT_texture_sRGB GL_EXT_texture_sRGB_decode GL_EXT_texture_shared_exponent GL_EXT_texture_snorm GL_EXT_texture_swizzle GL_EXT_timer_query GL_EXT_transform_feedback GL_EXT_vertex_array_bgra GL_EXT_vertex_attrib_64bit GL_IBM_multimode_draw_arrays GL_KHR_context_flush_control GL_KHR_debug GL_KHR_no_error GL_KHR_texture_compression_astc_ldr GL_KHR_texture_compression_astc_sliced_3d 
GL_MESA_pack_invert GL_MESA_shader_integer_functions GL_MESA_texture_signed_rgba GL_MESA_ycbcr_texture GL_NV_conditional_render GL_NV_depth_clamp GL_NV_packed_depth_stencil GL_OES_EGL_image GL_S3_s3tc
      WebGL 2 Extensions: EXT_color_buffer_float EXT_disjoint_timer_query OES_texture_float_linear WEBGL_compressed_texture_astc WEBGL_compressed_texture_etc WEBGL_compressed_texture_s3tc WEBGL_compressed_texture_s3tc_srgb WEBGL_debug_renderer_info WEBGL_debug_shaders WEBGL_lose_context

      GPU #1
      Active: Yes
      Description: VMware, Inc. -- llvmpipe (LLVM 7.0, 128 bits)
      Vendor ID: VMware, Inc.
      Device ID: llvmpipe (LLVM 7.0, 128 bits)
      Driver Version: 3.1 Mesa 18.3.3

    GPU #2

      Diagnostics
      AzureCanvasAccelerated: 0
      AzureCanvasBackend: skia
      AzureContentBackend: skia
      AzureFallbackCanvasBackend: none
      CairoUseXRender: 0

      Decision Log
      HW_COMPOSITING: blocked by default: Acceleration blocked by platform
      OPENGL_COMPOSITING: unavailable by default: Hardware compositing is disabled
      WEBRENDER: opt-in by default: WebRender is an opt-in featureunavailable by runtime: Build doesn't include WebRender
      OMTP: disabled by default: Disabled by default

    Crash Guard Disabled Features

    Workarounds

    Failure Log

So 60.5.0-4 might have some errors detecting the graphics drivers. I didn't see any segmentation faults using 60.5.0-1.fc29 for a few days from koji or any previous versions in coredumpctl or the journal as I mentioned. Some change between 60.5.0-2 and 60.5.0-4 might be related to the crashes. The changes between 60.5.0-2 and 60.5.0-4 looked to involve Wayland mostly, and I'm using X. Since Antony saw crashes with the same traces with Nvidia and intel GPUs, the crashes aren't likely due to the specific driver used, but they might be related to the detection of the GPU driver in general. I did see two segmentation faults today when I started 60.5.0-4 once at a time. Both crashes had the same trace as the second group of crashes with the segmentation fault in __kernel_vsyscall (). Thanks.
Comment 7 Matt Fagnani 2019-02-28 02:43:51 UTC 
I saw 2 of the same crashes with thunderbird-60.5.0-3.fc29 from Koji. I think that a change made in 60.5.0-3.fc29 is the most likely reason for these crashes, since I've seen no such crashes with 60.5.0-1.fc29 and 60.5.0-2 was assigned to the F30 mass rebuild. The commit 7b002e Wayland patches update has the most changes for 60.5.0-3.fc29 so it is the one I suspect as being involved.
https://src.fedoraproject.org/rpms/thunderbird/c/7b002e873e9e45f7aef355670f346621a7bfa9a4?branch=f29

I might be able to build the packages removing/adding back each changed patch. I haven't compiled thunderbird before. Using git bisect might speed things up, but most of the changes in 60.5.0-3 were made in one commit so they might need to be separated. I'm open to advice on how the change involved could be identified.

I've seen these crashes about 50 times with 60.5.1-1.fc29. All of the segmentation faults I've checked were in gfxPlatform::UsesOffMainThreadCompositing() with the same traces as above using coredumpctl debug / gdb. Segmentation faults in 2-3 thunderbird processes were often shown with times within 10 seconds of each other using coredumpctl. I haven't seen any such crashes with 60.5.1 or 60.5.2 from thunderbird.net. Thanks.
Comment 8 Martin Stransky 2019-02-28 11:39:14 UTC 
This looks like Fedora specific issue then.
Comment 9 Sam Tuke 2019-03-07 14:04:10 UTC 
I also have segfault with the official fedora packages and not from the binaries downloaded from Mozilla directly.
Comment 10 Jim Minter 2019-03-11 05:07:21 UTC 
I also saw this in thunderbird-60.5.1-1.fc29.x86_64, rolling back to thunderbird-60.5.0-1.fc29.x86_64 worked around.
Comment 11 Al Stone 2019-03-26 15:08:03 UTC 
I'm also seeing segfaults with thunderbird-60.6.0-1.fc29.x86_64.  Had to downgrade to thunderbird-52.8.0-1.fc29.x86_64.
Comment 12 Matt Fagnani 2019-06-19 03:24:54 UTC 
I haven't seen any of these crashes in thunderbird-60.7.0-1.fc30 over the last month. I think that this issue was fixed in 60.6.1-5 based on the changelog entry
* Wed May 15 2019 Martin Stransky <stransky> - 60.6.1-5 - Fixed startup crashes (rhbz#1709373, rhbz#1685276, rhbz#1708611)

The commit 95a956 Fixed startup crashes (rhbz#1709373, rhbz#1685276, rhbz#1708611) changed firefox-wayland.patch in part by commenting out two lines
// SetCompositorHint(GTK_WIDGET_COMPOSIDED_ENABLED);
https://src.fedoraproject.org/rpms/thunderbird/c/95a956f30d6c3a909cd5ba5552b0ed661909598c?branch=f30

The first trace I reported had
#4  0xb1567cbc in nsWindow::SetCompositorHint(nsWindow::WindowComposeRequest)
    (this=0xb784a200, aState=nsWindow::GTK_WIDGET_COMPOSIDED_ENABLED)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/gtk/nsWindow.cpp:6539

The second trace had
#11 0xb1562cbc in nsWindow::SetCompositorHint(nsWindow::WindowComposeRequest)
    (this=0xb784a200, aState=nsWindow::GTK_WIDGET_COMPOSIDED_ENABLED)
    at /usr/src/debug/thunderbird-60.5.0-4.fc29.i386/widget/gtk/nsWindow.cpp:6539

The use of the SetCompositorHint function might have led to the crashes. firefox-wayland.patch was added in in 60.5.0-3.fc29 in the commit 7b002e Wayland patches update which I think was most likely related to these crashes starting. Thanks for the fix, Martin.
Note You need to log in before you can comment on or make changes to this bug.