226604 - crash closing message compose window (with UI button)/message filter dialog

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Daniel Kies]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6b) Gecko/20031123
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6b) Gecko/20031123

Running the 2003112308 win32 build on win98se, Mozilla mail/news will crash
consistently if I close the a new message composition window by clicking on the
standard 'X' (Close) button (in the upper right corner of the window) of the
Windows user interface.

It does not crash (and closes normally) if I use the Crtl+W shortcut or the File
> Close methods.

Reproducible: Always

Steps to Reproduce:
1. Open a new message composition window in 20031123
2. Close the window by click the Windows UI Close button
3. Crash

Actual Results:  
Crashes with this stack dump (sorry, no talkback info):

MOZILLA caused an invalid page fault in
module KERNEL32.DLL at 0167:bff7b992.
Registers:
EAX=0000001c CS=0167 EIP=bff7b992 EFLGS=00010202
EBX=00000000 SS=016f ESP=0066f21c EBP=0066f258
ECX=0000000c DS=016f ESI=0000001c FS=3c47
EDX=81757b4c ES=016f EDI=00000000 GS=0000
Bytes at CS:EIP:
80 3e 04 74 0f 33 c0 50 50 50 68 05 00 00 c0 e8 
Stack dump:
00791e20 30014557 0000001c 100411e2 007a85d0 0172b8bd 00000000 007a8630 007a85d0
00000000 10044b30 00000000 0066f250 80004003 007a8630 0066f2d0 

Expected Results:  
Close the window

Comment 1

[WD]

WFM 
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6b) Gecko/20031123

Comment 2

[Charles Fenwick]

Attachment: stacktrace

Comment 3

[Charles Fenwick]

I'm getting this on my Linux build.
Backing out 1.401 nsWebShellWindow.cpp fixed it.

Comment 4

[Charles Fenwick]

Attachment: stacktrace

um... this is the one

Comment 5

[timeless]

Attachment: supplemental patch

this patch is needed for an edge case (|PR_NewLock()| fails) so it is a correct
change.

But the fact that we crash would seem to imply that nsWebShellWindow::Destroy
is being called twice on linux in this instance, which would be a bug which
should be fixed.

Comment 6

[timeless]

Attachment: supplemental patch -uw30

Comment 7

[Charles Fenwick]

Was so focused on troubleshooting/debugging that I paid little attention to the
bug details.

Confirming
Moving to XP Toolkit/Widgets
Tweaking summary

The file in question was revised for bug 223736

Comment 8

[Charles Fenwick]

Reassining to timeless, although with him traveling, someone may need to pick
this up for him.

Comment 9

[Charles Fenwick]

*** Bug 226645 has been marked as a duplicate of this bug. ***

Comment 10

[Scott MacGregor]

this should block 1.6b

Comment 11

[Stefan Borggraefe]

I see the following: On Windows XP SP1, 2000 SP4 and Linux Mozilla crashes
always when the "Message Filters" dialog is closed.

On Linux I also see the crash when the Compose window is closed. This doesn't
happen on Windows XP SP1 for me (I can't test the crash when closing the Compose
window on Windows 2000SP4 until tomorrow).

timeless' patch fixes the bug for me (tested on Linux).

Comment 12

[Scott MacGregor]

Comment on attachment 136218 [details] [diff] [review]
supplemental patch -uw30

sr=mscott

Comment 13

[Stefan Borggraefe]

*** Bug 226655 has been marked as a duplicate of this bug. ***

Comment 14

[Asa Dotzler [:asa]]

Comment on attachment 136218 [details] [diff] [review]
supplemental patch -uw30

a=asa (on behalf of drivers) for checkin to 1.6beta

Comment 15

[Scott MacGregor]

I just checked this in. 

Comment 16

[Christian :Biesinger (don't email me, ping me on IRC)]

nsWebShellWindow::Destroy is indeed called twice. 
Here's the stack of the first caller: 
#0  nsWebShellWindow::Destroy() (this=0x876e3b0) at /home/chb/mozilla/xpfe/
appshell/src/nsWebShellWindow.cpp:1641 
#1  0x41b00d84 in nsChromeTreeOwner::Destroy() (this=0x876e3b0) 
    at /home/chb/mozilla/xpfe/appshell/src/nsChromeTreeOwner.cpp:293 
#2  0x435906af in nsMsgCompose::CloseWindow(int) (this=0x8b81da8, recycleIt=1) 
    at /home/chb/mozilla/mailnews/compose/src/nsMsgCompose.cpp:1289 
#3  0x40b723e5 in XPTC_InvokeByIndex () at nsAString.h:125 
#4  0x4122c84f in XPCWrappedNative::CallMethod(XPCCallContext&, 
XPCWrappedNative::CallMode) (ccx=@0xbfffdf90, 
    mode=CALL_METHOD) at /home/chb/mozilla/js/src/xpconnect/src/
xpcwrappednative.cpp:2021 
#5  0x41233855 in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*, 
long*) (cx=0x876f230, obj=0x876e3b0, 
    argc=142009264, argv=0x41b1daa8, vp=0x876e3b0) at /home/chb/mozilla/js/src/
xpconnect/src/xpcwrappednativejsops.cpp:1272 
#6  0x40051936 in js_Invoke (cx=0x876f230, argc=1, flags=0) at /home/chb/
mozilla/js/src/jsinterp.c:932 
#7  0x4005b7a5 in js_Interpret (cx=0x876f230, result=0xbfffe44c) at /home/chb/
mozilla/js/src/jsinterp.c:2953 
#8  0x40051a07 in js_Invoke (cx=0x876f230, argc=1, flags=2) at /home/chb/
mozilla/js/src/jsinterp.c:949 
#9  0x40051ce3 in js_InternalInvoke (cx=0x876f230, obj=0x876e3b0, 
fval=142009264, flags=2, argc=1, argv=0xbfffe6ec, 
    rval=0x876e3b0) at /home/chb/mozilla/js/src/jsinterp.c:1026 
#10 0x4002d95b in JS_CallFunctionValue (cx=0x876f230, obj=0x876e3b0, 
fval=142009264, argc=142009264, argv=0x876e3b0, 
    rval=0x876e3b0) at /home/chb/mozilla/js/src/jsapi.c:3572 
[...] 
 
I'll try to get the JS Stack next. 

Comment 17

[Christian :Biesinger (don't email me, ping me on IRC)]

js stack: 
0 [native frame] 
1 MsgComposeCloseWindow(recycleIt = true) ["chrome://messenger/content/
messengercompose/MsgComposeCommands.js":2080] 
    this = [object ChromeWindow] 
2 DoCommandClose() ["chrome://messenger/content/messengercompose/
MsgComposeCommands.js":999] 
    retVal = true 
    externalListener = null 
    this = [object ChromeWindow] 
3 onclose(event = [object Event]) ["<unknown>":0] 
    this = [object ChromeWindow] 
4 [native frame] 
 

Comment 18

[Christian :Biesinger (don't email me, ping me on IRC)]

turns out the js stack wasn't relevant... 
so nsMsgCompose.cpp has this line: 
1289     rv = aWindow->Destroy(); 
it is the first caller of nsWebShellWindow::Destroy. 
 
the second caller is: 
#1  0x41b14cc1 in nsWebShellWindow::Close() (this=0x1) at /home/chb/mozilla/
xpfe/appshell/src/nsWebShellWindow.cpp:373 
#2  0x41b14dcd in nsWebShellWindow::HandleEvent(nsGUIEvent*) 
(aEvent=0xbfffee00) 
     at /home/chb/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp:486