106646 - crash opening chatzilla, mail compose, addressbook, etc - Trunk [@ nsXULDocument::ContentRemoved] [@ nsXULDocument::ContentReplaced]

Status: VERIFIED FIXED

(Core :: XUL, defect, P1)

Description

[Simon Montagu :smontagu]

In a build from a freshly updated tree, I launch chatzilla using the URL above.
It opens as normal, opens the channel and gets as far as displaying the topic,
and then crashes with the following message:

The instruction at "0x01b55009" referenced memory at "0x00000000". The memory
could not be "read".

Hopefully more details will follow after I finish building debug.

Comment 1

[Markus Gerstel]

Confirmed 2001102503 linux. Today _is_ crash day =(
Preparing gdb backtrace...

Comment 2

[Markus Gerstel]

Attachment: gdb backtrace 2001102504 linux

Comment 3

[Markus Gerstel]

probably related to 106645, has also nsXULDocument::ContentRemoved

Comment 4

[Simon Montagu :smontagu]

Bugzilla won't let me make an attachment right now, but my stack trace is much
the same as Markus'.

The crash is in this line in nsXULDocument::ContentRemoved

    PRInt32 count = mObservers.Count();
    for (PRInt32 i = 0; i < count; i++) {
        nsIDocumentObserver*  observer = (nsIDocumentObserver*)mObservers[i];
--->    observer->ContentRemoved(this, aContainer,
                                 aChild, aIndexInContainer);
    }

with count==7; i==6; observer==0

Comment 5

[timeless]

.

Comment 6

[timeless]

*** Bug 106645 has been marked as a duplicate of this bug. ***

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

Nothing obviously wrong about that code, UNLESS an observer might remove itself
inside ::ContentRemoved, in which case I have a fix we can use.

Comment 8

[Markus Gerstel]

*** Bug 106685 has been marked as a duplicate of this bug. ***

Comment 9

[Robert Ginda]

why dom extensions?

Comment 10

[Randell Jesup [:jesup] (needinfo me)]

IF this is a "observer->ContentRemoved() code removes an observer" bug, then
code I've written to handle similar issues in timer_gtk will be useful.  This is
from the bug 96108 patch for nsTimerGtk.cpp.

Something like this:

        // we have a kungfu deathgrip on timer...

        // We must see if the array changed out from under us - FireTimeout
        // can delete any number of timers.  If so, regenerate index.
        PRInt32 count = array->Count();
        if (count == 0)
          i = 0;  // This causes us to break out of the loop
        else if (i >= count || timer != (nsTimerGtk*)array->ElementAt(i))
        {
          i = array->IndexOf(timer);
          // in case it was removed on us
          if (i < 0)
            i = 0; // break out
        }

Comment 11

[Markus Gerstel]

Hah

cvs co -r 1.448 mozilla/content/xul/document/src/nsXULDocument.cpp

And neither Address Book nor New Message nor Clear in 3pane-Search crashed any
more. (But some other problems appear - Mails show up incorrectly)

CCing hyatt because it was the patch for Bug 106212.

Comment 12

[Markus Gerstel]

*** Bug 106654 has been marked as a duplicate of this bug. ***

Comment 13

[Markus Gerstel]

Transferring status from 106654

Comment 14

[Tracy Walker [:tracy]]

Is this the same crasher as seen in bookmark manager and mail compose window 
crasher??

Comment 15

[Ben Ruppel]

Should probably change the summary so a lot of dupes don't happen.  This
probably also covers reply-messages, which are crashing for me.

Comment 16

[Chris McAfee]

better summary

Comment 17

[Alec Flett]

it's not all startup, it's just opening certain windows

Comment 18

[Chris McAfee]

tinderbox bloat test is crashing on the ftp URL:
  ftp://ftp.mozilla.org/welcome.msg

Comment 19

[David Hyatt]

Hah, I guess this explains why we counted backwards before.  How cheesy.

Comment 20

[David Hyatt]

Attachment: Patch to handle an observer removing itself during its own notification. Sigh.

Comment 21

[(not reading, please use [e-mail] instead)]

*** Bug 106737 has been marked as a duplicate of this bug. ***

Comment 22

[David Hyatt]

Can you guys take that patch for a spin and see if it fixes the problem?  If so,
check it in!  (I have other changes in the file.)

Comment 23

[(not reading, please use [e-mail] instead)]

testing now...

Comment 24

[(not reading, please use [e-mail] instead)]

the patch fixes the crash, but it can also be fixed if we go from count -1 to 0 
instead of 0 to count-1.

I'll attach that patch.

Comment 25

[(not reading, please use [e-mail] instead)]

Attachment: patch

Comment 26

[(not reading, please use [e-mail] instead)]

Attachment: patch

Comment 27

[Alec Flett]

so hyatt's patch looks funny.. because we're modifying "count" in the first
line, then using that modified value in the 2nd line. Let me wrap my brain
around it a few times, see what I can come up with

Comment 28

[Alec Flett]

Comment on attachment 55092 [details] [diff] [review]
Patch to handle an observer removing itself during its own notification. Sigh.

>? diff.txt
>Index: document/src/nsXULDocument.cpp
>===================================================================
>RCS file: /cvsroot/mozilla/content/xul/document/src/nsXULDocument.cpp,v
>retrieving revision 1.449
>diff -u -r1.449 nsXULDocument.cpp
>--- nsXULDocument.cpp	2001/10/25 07:27:01	1.449
>+++ nsXULDocument.cpp	2001/10/25 17:42:40
>@@ -2138,6 +2139,14 @@
>         nsIDocumentObserver*  observer = (nsIDocumentObserver*)mObservers[i];
>         observer->ContentRemoved(this, aContainer,
>                                  aChild, aIndexInContainer);
>+
>+        // XXXdwh hack to avoid crash, since an observer removes itself
>+        // during ContentRemoved.
>+        PRInt32 newCount = mObservers.Count();
>+        if (newCount < count) {
>+          count -= (count - newCount);
>+          i -= (count - newCount);

Seems like this should be:
+           PRInt32 diff = (count - newCount);
+           count -= diff;
+           i -= diff;


>+        }
>     }
>     return NS_OK;
> }

Comment 29

[(not reading, please use [e-mail] instead)]

tested and landed alecf's version of hyatt's patch.

I'll attach what I landed.

Comment 30

[(not reading, please use [e-mail] instead)]

Attachment: patch that landed,

Comment 31

[(not reading, please use [e-mail] instead)]

my patch was no good, as alecf pointed out that reason hyatt changed it from 
count-1,0 to 0,count-1 was for bug #106212.

Comment 32

[Matthias Versen [:Matti]]

*** Bug 106726 has been marked as a duplicate of this bug. ***

Comment 33

[Randell Jesup [:jesup] (needinfo me)]

BTW, if you want to be REALLY paranoid about this, an observer could remove
itself, and another observer, and even add still other observers to the list. 
That was why I wrote that code from nsTimerGtk.cpp the way I did - it guarantees
we'll find the right place again in the array.

Unless you can guarantee that _only_ the current observer will change during the
observer notification (and perhaps you can guarantee that), you have to use
something like I did to verify/rebuild the iterator index.

Comment 34

[Markus Gerstel]

New Mail Message still crashes for me (cvs pull _after_ checkin)

Comment 35

[Markus Gerstel]

And that's how :

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 12060)]
0x40b504dc in nsXULDocument::ContentReplaced (this=0x885ae18,
aContainer=0x8911758, aOldChild=0x897c438,
    aNewChild=0x8a901d8, aIndexInContainer=1) at nsXULDocument.cpp:2119
2119                                      aIndexInContainer);
(gdb) bt
#0  0x40b504dc in nsXULDocument::ContentReplaced (this=0x885ae18,
aContainer=0x8911758, aOldChild=0x897c438,
    aNewChild=0x8a901d8, aIndexInContainer=1) at nsXULDocument.cpp:2119
#1  0x40b292e2 in nsXULElement::ReplaceChildAt (this=0x8911758, aKid=0x8a901d8,
aIndex=1, aNotify=1,
    aDeepSetDocument=1) at nsXULElement.cpp:2322
#2  0x40b24670 in nsXULElement::ReplaceChild (this=0x8911758,
aNewChild=0x8a901dc, aOldChild=0x897c43c,
    aReturn=0xbfffc60c) at nsXULElement.cpp:1130
#3  0x402088e0 in XPTC_InvokeByIndex (that=0x891175c, methodIndex=16,
paramCount=3, params=0xbfffc5ec)
    at xptcinvoke_unixish_x86.cpp:153
....

Comment 36

[Håkan Waara]

*** Bug 106755 has been marked as a duplicate of this bug. ***

Comment 37

[Håkan Waara]

*** Bug 106761 has been marked as a duplicate of this bug. ***

Comment 38

[Aleksander Adamowski]

Here are some of my talkbacks for your analysis:

Windows 2000 (Build 2001102503)
TB37185855W When opening message composition window
TB37185887Z When opening Addressbook
TB37185947G When entering a channel in Chatzilla and maximizing the window

Linux (Build 2001102508)
TB37184931W When opening message composition window
TB37185450W When opening Addressbook
TB37185731Z When entering a channel in Chatzilla

Comment 39

[lohphat]

related to bug 106307?

Comment 40

[Francisco León]

TB37183214Y on today's linux trunk when hitting the "reply" button in mail

Comment 41

[(not reading, please use [e-mail] instead)]

hyatt's fix needs to be applied another place.

patch coming up.

Comment 42

[(not reading, please use [e-mail] instead)]

Attachment: supplimental patch

Comment 43

[David Hyatt]

yeah, check it in. thanks, seth! sr=hyatt

Comment 44

[(not reading, please use [e-mail] instead)]

that fixes the crash, but there's a problem with the compose window.

I'll attach a screen shot.

it asserts here's when coming up:

NTDLL! 77f9f9df()
nsDebug::Assertion(const char * 0x03188c60, const char * 0x03188bf8, const char 
* 0x03188bbc, int 2660) line 290 + 13 bytes
UndisplayedMap::AppendNodeFor(UndisplayedNode * 0x019fcd00, nsIContent * 
0x058f9ab0) line 2660 + 60 bytes
UndisplayedMap::AddNodeFor(nsIContent * 0x058f9ab0, nsIContent * 0x0590d500, 
nsIStyleContext * 0x037b0524) line 2682
FrameManager::SetUndisplayedContent(FrameManager * const 0x057fcc30, nsIContent 
* 0x0590d500, nsIStyleContext * 0x037b0524) line 740 + 23 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x0590d500, nsIFrame * 0x0376c46c, nsIAtom * 0x019d6270, int 7, nsIStyleContext 
* 0x037b0524, nsFrameItems & {...}, int 0) line 7023
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x05802a60, nsIPresContext 
* 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 0x0590d500, 
nsIFrame * 0x0376c46c, nsFrameItems & {...}) line 6945 + 56 bytes
nsCSSFrameConstructor::ProcessChildren(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x058f9ab0, nsIFrame * 0x0376c46c, int 0, nsFrameItems & {...}, int 0, 
nsTableCreator * 0x00000000) line 11530 + 66 bytes
nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x058f9ab0, nsIFrame * 0x0376c388, nsIAtom * 0x019d6270, int 7, nsIStyleContext 
* 0x037d1b20, nsFrameItems & {...}, int 0, int & 0) line 5626 + 44 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x058f9ab0, nsIFrame * 0x0376c388, nsIAtom * 0x019d6270, int 7, nsIStyleContext 
* 0x037d1b20, nsFrameItems & {...}, int 0) line 7040 + 57 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x05802a60, nsIPresContext 
* 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 0x058f9ab0, 
nsIFrame * 0x0376c388, nsFrameItems & {...}) line 6945 + 56 bytes
nsCSSFrameConstructor::ProcessChildren(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x0589c430, nsIFrame * 0x0376c388, int 0, nsFrameItems & {...}, int 0, 
nsTableCreator * 0x00000000) line 11530 + 66 bytes
nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x0589c430, nsIFrame * 0x0376c2f4, nsIAtom * 0x019ce080, int 7, nsIStyleContext 
* 0x037b07bc, nsFrameItems & {...}, int 1, int & 0) line 5626 + 44 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x0589c430, nsIFrame * 0x0376c2f4, nsIAtom * 0x019ce080, int 7, nsIStyleContext 
* 0x037b07bc, nsFrameItems & {...}, int 1) line 7040 + 57 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x0589c430, nsIFrame * 0x0376c2f4, nsIAtom * 0x019d8d00, int 7, nsIStyleContext 
* 0x037b07bc, nsFrameItems & {...}, int 0) line 7007 + 56 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x05802a60, nsIPresContext 
* 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 0x0589c430, 
nsIFrame * 0x0376c2f4, nsFrameItems & {...}) line 6945 + 56 bytes
nsCSSFrameConstructor::ProcessChildren(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x0589c4a0, nsIFrame * 0x0376c2f4, int 0, nsFrameItems & {...}, int 0, 
nsTableCreator * 0x00000000) line 11530 + 66 bytes
nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x0589c4a0, nsIFrame * 0x0376bfb0, nsIAtom * 0x019d5880, int 7, nsIStyleContext 
* 0x037afcb4, nsFrameItems & {...}, int 0, int & 0) line 5626 + 44 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x0589c4a0, nsIFrame * 0x0376bfb0, nsIAtom * 0x019d5880, int 7, nsIStyleContext 
* 0x037afcb4, nsFrameItems & {...}, int 0) line 7040 + 57 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x05802a60, nsIPresContext 
* 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 0x0589c4a0, 
nsIFrame * 0x0376bfb0, nsFrameItems & {...}) line 6945 + 56 bytes
nsCSSFrameConstructor::ProcessChildren(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x05858460, nsIFrame * 0x0376bfb0, int 0, nsFrameItems & {...}, int 0, 
nsTableCreator * 0x00000000) line 11530 + 66 bytes
nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x05858460, nsIFrame * 0x0376bee0, nsIAtom * 0x019d5920, int 7, nsIStyleContext 
* 0x037afa80, nsFrameItems & {...}, int 0, int & 0) line 5626 + 44 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x05802a60, 
nsIPresContext * 0x0581dd40, nsFrameConstructorState & {...}, nsIContent * 
0x05858460, nsIFrame * 0x0376bee0, nsIAtom * 0x019d5920, int 7, nsIStyleContext 
* 0x037afa80, nsFrameItems & {...}, int 0) line 7040 + 57 bytes
nsCSSFrameConstructor::CreateTreeWidgetContent(nsCSSFrameConstructor * const 
0x057f9210, nsIPresContext * 0x0581dd40, nsIFrame * 0x0376bee0, nsIFrame * 
0x00000000, nsIContent * 0x05858460, nsIFrame * * 0x0376bf7c, int 1, int 0, 
nsILayoutHistoryState * 0x00000000) line 12554 + 76 bytes
nsXULTreeGroupFrame::GetFirstTreeBox(int * 0x0012c798) line 326
nsTreeLayout::LazyRowCreator(nsTreeLayout * const 0x05464730, nsBoxLayoutState 
& {...}, nsXULTreeGroupFrame * 0x0376bee0) line 377 + 12 bytes
nsTreeLayout::LazyRowCreator(nsTreeLayout * const 0x05464730, nsBoxLayoutState 
& {...}, nsXULTreeGroupFrame * 0x036f4868) line 386
nsXULTreeOuterGroupFrame::ReflowFinished(nsXULTreeOuterGroupFrame * const 
0x036f4928, nsIPresShell * 0x05802a60, int * 0x0012c88c) line 1358
PresShell::HandlePostedReflowCallbacks() line 4896
PresShell::ProcessReflowCommands(int 0) line 6126
PresShell::FlushPendingNotifications(PresShell * const 0x05802a60, int 0) line 
4990
nsBoxObject::GetOffsetRect(nsRect & {...}) line 176
nsBoxObject::GetHeight(nsBoxObject * const 0x055842f0, int * 0x0012cb80) line 
370
XPTC_InvokeByIndex(nsISupports * 0x055842f0, unsigned int 12, unsigned int 1, 
nsXPTCVariant * 0x0012cb80) line 154
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
CALL_GETTER) line 1951 + 42 bytes
XPCWrappedNative::GetAttribute(XPCCallContext & {...}) line 1818 + 14 bytes
XPC_WN_GetterSetter(JSContext * 0x02739770, JSObject * 0x03534500, unsigned int 
0, long * 0x037582dc, long * 0x0012cdcc) line 1298 + 12 bytes
js_Invoke(JSContext * 0x02739770, unsigned int 0, unsigned int 2) line 809 + 23 
bytes
js_InternalInvoke(JSContext * 0x02739770, JSObject * 0x03534500, long 55788832, 
unsigned int 0, unsigned int 0, long * 0x00000000, long * 0x0012db80) line 901 
+ 20 bytes
js_GetProperty(JSContext * 0x02739770, JSObject * 0x03534500, long 41691072, 
long * 0x0012db80) line 2439 + 45 bytes
js_Interpret(JSContext * 0x02739770, long * 0x0012dd2c) line 2600 + 1998 bytes
js_Invoke(JSContext * 0x02739770, unsigned int 0, unsigned int 0) line 826 + 13 
bytes
js_Interpret(JSContext * 0x02739770, long * 0x0012eac4) line 2768 + 15 bytes
js_Invoke(JSContext * 0x02739770, unsigned int 0, unsigned int 2) line 826 + 13 
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x051221c0, 
nsXPCWrappedJS * 0x05122160, unsigned short 3, const nsXPTMethodInfo * 
0x03532d88, nsXPTCMiniVariant * 0x0012f014) line 1022 + 21 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x05122160, unsigned short 3, 
const nsXPTMethodInfo * 0x03532d88, nsXPTCMiniVariant * 0x0012f014) line 430
PrepareAndDispatch(nsXPTCStubBase * 0x05122160, unsigned int 3, unsigned int * 
0x0012f0c4, unsigned int * 0x0012f0b4) line 115 + 31 bytes
SharedStub() line 139
nsMsgCompose::NotifyStateListeners(nsMsgCompose * const 0x0592ada0, 
TStateListenerNotification eComposeFieldsReady, unsigned int 0) line 2912
nsMsgDocumentStateListener::NotifyDocumentCreated(nsMsgDocumentStateListener * 
const 0x050d3bf0) line 2514
nsEditor::NotifyDocumentListeners(nsEditor * const 0x0581d2b0, 
nsEditor::TDocumentListenerNotification eDocumentCreated) line 2545 + 23 bytes
nsEditor::PostCreate(nsEditor * const 0x0581d2b0) line 363
nsHTMLEditor::PostCreate(nsHTMLEditor * const 0x0581d2b0) line 320 + 9 bytes
nsEditorShell::PrepareDocumentForEditing(nsIDOMWindow * 0x055a2e14, nsIURI * 
0x050d3990) line 615 + 32 bytes
nsEditorShell::EndPageLoad(nsIDOMWindow * 0x055a2e14, nsIChannel * 0x050d3640, 
unsigned int 0) line 5232 + 27 bytes
nsEditorShell::OnStateChange(nsEditorShell * const 0x053d8708, nsIWebProgress * 
0x053ff544, nsIRequest * 0x050d3640, int 786448, unsigned int 0) line 5010
nsDocLoaderImpl::FireOnStateChange(nsIWebProgress * 0x053ff544, nsIRequest * 
0x050d3640, int 786448, unsigned int 0) line 1110
nsDocLoaderImpl::doStopDocumentLoad(nsIRequest * 0x050d3640, unsigned int 0) 
line 750
nsDocLoaderImpl::DocLoaderIsEmpty() line 647
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x053ff534, nsIRequest * 
0x0560dda0, nsISupports * 0x053bd4e0, unsigned int 0) line 578
nsLoadGroup::RemoveRequest(nsLoadGroup * const 0x053ff4c0, nsIRequest * 
0x0560dda0, nsISupports * 0x053bd4e0, unsigned int 0) line 525 + 44 bytes
imgRequestProxy::OnStopRequest(nsIRequest * 0x055fad10, nsISupports * 
0x00000000, unsigned int 0) line 369
imgRequest::OnStopRequest(imgRequest * const 0x055fabc8, nsIRequest * 
0x055fad10, nsISupports * 0x00000000, unsigned int 0) line 610
ProxyListener::OnStopRequest(ProxyListener * const 0x055fab40, nsIRequest * 
0x055fad10, nsISupports * 0x00000000, unsigned int 0) line 502
nsJARChannel::OnStopRequest(nsJARChannel * const 0x055fad14, nsIRequest * 
0x055dc194, nsISupports * 0x00000000, unsigned int 0) line 611 + 49 bytes
nsOnStopRequestEvent::HandleEvent() line 177
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x05608e64) line 80
PL_HandleEvent(PLEvent * 0x05608e64) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x004ffdf0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00100582, unsigned int 49456, unsigned int 0, 
long 5242352) line 1071 + 9 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x0196dfb0) line 303
main1(int 4, char * * 0x00485e20, nsISupports * 0x00000000) line 1285 + 32 bytes
main(int 4, char * * 0x00485e20) line 1607 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e879

Comment 45

[(not reading, please use [e-mail] instead)]

Attachment: screen shot

Comment 46

[Jon Granrose]

this is not giving me a warm fuzzy.  has anyone looked into what it would take
to back this out?

Comment 47

[David Hyatt]

We have a partial backout coming that fixes the problem.

Comment 48

[(not reading, please use [e-mail] instead)]

Attachment: fixes crashers, and the wacky compose problem.

Comment 49

[(not reading, please use [e-mail] instead)]

Attachment: updated patch, cleaned up the comments.

Comment 50

[(not reading, please use [e-mail] instead)]

ok, the last patch is in.  fixes the crasher and the wacky compose problem.

Comment 51

[Matthias Versen [:Matti]]

*** Bug 106750 has been marked as a duplicate of this bug. ***

Comment 52

[Markus Gerstel]

verified fixed 2001102514 linux. Thx =)

Comment 53

[Matthias Versen [:Matti]]

*** Bug 106784 has been marked as a duplicate of this bug. ***

Comment 54

[lohphat]

For all us l00z3r5, will there be a later win32 build?

Comment 55

[lpham]

All the platforms are respinned now.  Linux is completed.  Can someone in this 
bug to verify the build?

ftp://sweetlou.mcom.com/products/client/seamonkey/unix/linux/2.2/x86/2001-10-25-
14-trunk

Thanks,
Loan

Comment 56

[Matthias Versen [:Matti]]

*** Bug 106798 has been marked as a duplicate of this bug. ***

Comment 57

[lchiang]

I'll go ahead and download the commercial builds to verify.  Asa, can you verify
Chatzilla in the mozilla builds?

Comment 58

[lchiang]

I've verified this in the builds which Loan provided in the comments above.

Verified:

3pane mail
html compose (new, reply, reply all)
plain text compose (new, reply, reply all)
bookmark manager
IM buddy list window
IM compose
composer
address book
the ftp.mozilla.org link which mcafee references above
account wizard
address book card
help window

I think that should cover it.  I make sure the windows came up properly and was
able to do some minimal functions in each window.

Once Asa verifies for chatzilla, then this bug can be marked verified.

Comment 59

[lchiang]

If this is all platforms, pls provide builds for the other platforms.  Thanks. 

Comment 60

[lpham]

Mac OS 9
ftp://sweetlou/products/client/seamonkey/macos/8.x/ppc/2001-10-25-14-trunk

Mac OS X
ftp://sweetlou/products/client/seamonkey/macos/10.x/ppc/2001-10-25-14-trunk

Win32 is still building.
Lisa, have you heard anything from asa?  I'm not sure he receives the message.
Thanks.

Comment 61

[Patty Mac]

Lisa, if I click on bookmark manager, it crashes on all platforms.

Comment 62

[sairuh (rarely reading bugmail)]

i tested using the 2001.10.25.16-trunk comm verif bits on winNT, accessing the
items Lisa listed in her 2001-10-25 16:11. was able to access 'em, no crashes.

will test mac os 10.1 soon...

Comment 63

[lohphat]

The new win32 build (2001102503 16:39) still crashes on opening a mail compose
window.  Talkback data sent.  This is still broken.

Comment 64

[Ben Ruppel]

try the one from 17:11 (in the 10-25-16-trunk dir)

Comment 65

[lohphat]

Several things:

1) The trunk build works.  What is the difference between the "latest" and the
"trunk" builds.

2) Careful about refering to internal machines in bugzilla, us heathens can't
access them.  I lost access in Oct 98.

Comment 66

[sairuh (rarely reading bugmail)]

just finished tested using the 2001.10.25.14-trunk comm verif bits on Mac 10.1,
again accessing the items Lisa listed in her 2001-10-25 16:11 comments. access
was fine: no crashes.

now, onto Mac 9.1...

Comment 67

[Francisco León]

build 2001102514 linux does not even let me read mail. crashestalkback: TB3719754Y

Comment 68

[sairuh (rarely reading bugmail)]

...and tested using the 2001.10.25.14-trunk comm verif bits on Mac 9.1 [classic
emulation over X], again accessing the items Lisa listed in her 2001-10-25 16:11
comments. access was fine: no crashes.

francisco, i looked at the talkback report you mentioned, but it was empty. :( 
however, could you perchance be encountering bug 106650?

verifying this one...

Comment 69

[Matthias Versen [:Matti]]

*** Bug 106786 has been marked as a duplicate of this bug. ***

Comment 70

[sairuh (rarely reading bugmail)]

*** Bug 106704 has been marked as a duplicate of this bug. ***

Comment 71

[Matthias Versen [:Matti]]

*** Bug 106670 has been marked as a duplicate of this bug. ***

Comment 72

[Matthias Versen [:Matti]]

*** Bug 106829 has been marked as a duplicate of this bug. ***

Comment 73

[Matthias Versen [:Matti]]

*** Bug 106854 has been marked as a duplicate of this bug. ***

Comment 74

[R.K.Aa.]

*** Bug 106830 has been marked as a duplicate of this bug. ***

Comment 75

[scottputterman]

*** Bug 107039 has been marked as a duplicate of this bug. ***

Comment 76

[Jay Patel [:jay]]

Adding  topcrash keyword and [@ nsXULDocument::ContentReplaced] to summary for
future reference, sorry for the spam.