Closed Bug 240720 Opened 20 years ago Closed 20 years ago

crash in nsSupportsHashtable::ReleaseElement()

Categories

(MailNews Core :: Composition, defect)

Product:
MailNews Core
Component:
Composition
Platform:
x86
Windows 2000
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: mscott, Assigned: mscott)

References

Details

(Keywords: crash)

Attachments

(2 files)

possible fix
1.62 KB, patch
dbaron
: superreview+
Details | Diff | Splinter Review
How about this instead? This makes sure we invalidate the listbox's box object when the listbox's body frame is destroyed.
2.66 KB, patch
Bienvenu
: review+
dbaron
: superreview+
Details | Diff | Splinter Review 
nsSupportsHashtable::ReleaseElement(nsHashKey * 0x0495e210, void * 0x046be5f8,
void * 0x00000000) line 796 + 15 bytes
hashEnumerate(PLDHashTable * 0x0495e050, PLDHashEntryHdr * 0x0495e134, unsigned
int 0, void * 0x0012880c) line 115 + 26 bytes
PL_DHashTableEnumerate(PLDHashTable * 0x0495e050, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x10014760 hashEnumerate(PLDHashTable
*, PLDHashEntryHdr *, unsigned int, void *), void * 0x0012880c) line 619 + 34 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x10015ba0
nsSupportsHashtable::ReleaseElement(nsHashKey *, void *, void *), void *
0x00000000) line 303 + 21 bytes
nsSupportsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x10015ba0
nsSupportsHashtable::ReleaseElement(nsHashKey *, void *, void *), void *
0x00000000) line 206
nsSupportsHashtable::~nsSupportsHashtable() line 803
nsSupportsHashtable::`scalar deleting destructor'(unsigned int 1) + 16 bytes
nsPresState::~nsPresState() line 93 + 33 bytes
nsPresState::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsPresState::Release(nsPresState * const 0x0495dff0) line 83 + 209 bytes
nsCOMPtr<nsIPresState>::assign_assuming_AddRef(nsIPresState * 0x00000000) line 495
nsCOMPtr<nsIPresState>::assign_with_AddRef(nsISupports * 0x00000000) line 1023
nsCOMPtr<nsIPresState>::operator=(nsIPresState * 0x00000000) line 608
nsBoxObject::SetDocument(nsBoxObject * const 0x04807cac, nsIDocument *
0x00000000) line 146
nsDocument::SetBoxObjectFor(nsDocument * const 0x043f3dec, nsIDOMElement *
0x041e96cc, nsIBoxObject * 0x00000000) line 2799
nsXULElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 1601
nsXULElement::RemoveChildAt(unsigned int 1, int 1) line 1939
nsGenericElement::doReplaceChild(nsIContent * 0x04519470, nsIDOMNode *
0x04d38e1c, nsIDOMNode * 0x041e96cc, nsIDOMNode * * 0x00128d58) line 2988 + 17 bytes
nsXULElement::ReplaceChild(nsXULElement * const 0x0451947c, nsIDOMNode *
0x04d38e1c, nsIDOMNode * 0x041e96cc, nsIDOMNode * * 0x00128d58) line 850 + 24 bytes
XPTC_InvokeByIndex(nsISupports * 0x0451947c, unsigned int 16, unsigned int 3,
nsXPTCVariant * 0x00128d38) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2027 + 43 bytes
XPC_WN_CallMethod(JSContext * 0x0496c620, JSObject * 0x0460c3a0, unsigned int 2,
long * 0x04c7d1cc, long * 0x00129000) line 1287 + 14 bytes
js_Invoke(JSContext * 0x0496c620, unsigned int 2, unsigned int 0) line 1281 + 23
bytes
js_Interpret(JSContext * 0x0496c620, long * 0x00129a34) line 3366 + 15 bytes
js_Invoke(JSContext * 0x0496c620, unsigned int 1, unsigned int 0) line 1301 + 13
bytes
js_Interpret(JSContext * 0x0496c620, long * 0x0012a418) line 3366 + 15 bytes
js_Invoke(JSContext * 0x0496c620, unsigned int 1, unsigned int 2) line 1301 + 13
bytes
js_InternalInvoke(JSContext * 0x0496c620, JSObject * 0x0475eaf0, long 80093824,
unsigned int 0, unsigned int 1, long * 0x0012a67c, long * 0x0012a678) line 1378
+ 20 bytes
JS_CallFunctionValue(JSContext * 0x0496c620, JSObject * 0x0475eaf0, long
80093824, unsigned int 1, long * 0x0012a67c, long * 0x0012a678) line 3601 + 31 bytes
nsJSContext::CallEventHandler(JSObject * 0x0475eaf0, JSObject * 0x04c62280,
unsigned int 1, long * 0x0012a67c, long * 0x0012a678) line 1293 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x04a400f0, nsIDOMEvent
* 0x04c09540) line 175 + 51 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x04a401d0,
nsIDOMEvent * 0x04c09540, nsIDOMEventTarget * 0x04c08de0, unsigned int 8,
unsigned int 7) line 1435 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x04a40088,
nsIPresContext * 0x049f6410, nsEvent * 0x0012ad28, nsIDOMEvent * * 0x0012acbc,
nsIDOMEventTarget * 0x04c08de0, unsigned int 7, nsEventStatus * 0x0012ad74) line
1530
nsXULElement::HandleDOMEvent(nsIPresContext * 0x049f6410, nsEvent * 0x0012ad28,
nsIDOMEvent * * 0x0012acbc, unsigned int 7, nsEventStatus * 0x0012ad74) line 2801
PresShell::HandleDOMEventWithTarget(PresShell * const 0x049f7f68, nsIContent *
0x04a40010, nsEvent * 0x0012ad28, nsEventStatus * 0x0012ad74) line 6095
nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x049f6410, nsGUIEvent *
0x0012af4c) line 178
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x04ad25cc,
nsIPresContext * 0x049f6410, nsGUIEvent * 0x0012af4c, nsEventStatus *
0x0012b260) line 150
PresShell::HandleEventInternal(nsEvent * 0x0012af4c, nsIView * 0x00000000,
unsigned int 1, nsEventStatus * 0x0012b260) line 6059 + 39 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x049f7f68, nsEvent *
0x0012af4c, nsIFrame * 0x04ad25cc, nsIContent * 0x04a40010, unsigned int 1,
nsEventStatus * 0x0012b260) line 5970 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsIPresContext * 0x049f6410,
nsMouseEvent * 0x0012b480, nsEventStatus * 0x0012b260) line 2933 + 66 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x049f6ba8,
nsIPresContext * 0x049f6410, nsEvent * 0x0012b480, nsIFrame * 0x04ad25cc,
nsEventStatus * 0x0012b260, nsIView * 0x049f77b8) line 1944 + 23 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012b480, nsIView * 0x049f77b8,
unsigned int 1, nsEventStatus * 0x0012b260) line 6067 + 52 bytes
PresShell::HandleEvent(PresShell * const 0x049f7fdc, nsIView * 0x049f77b8,
nsGUIEvent * 0x0012b480, nsEventStatus * 0x0012b260, int 1, int & 1) line 5908 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x049f77b8, nsGUIEvent * 0x0012b480, int 1)
line 2238
nsViewManager::DispatchEvent(nsViewManager * const 0x049f75e8, nsGUIEvent *
0x0012b480, nsEventStatus * 0x0012b358) line 1978 + 20 bytes
HandleEvent(nsGUIEvent * 0x0012b480) line 79
nsWindow::DispatchEvent(nsWindow * const 0x049f7854, nsGUIEvent * 0x0012b480,
nsEventStatus & nsEventStatus_eIgnore) line 1067 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012b480) line 1088
nsWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5259 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5514
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 22741406, long *
0x0012b930) line 4045 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x000a08cc, unsigned int 514, unsigned int 0, long
22741406) line 1349 + 27 bytes
USER32! 77e3a2d0()
USER32! 77e145e5()
USER32! 77e1a816()
nsXULWindow::ShowModal(nsXULWindow * const 0x04872d00) line 368
nsWebShellWindow::ShowModal(nsWebShellWindow * const 0x04872d00) line 1104
nsContentTreeOwner::ShowAsModal(nsContentTreeOwner * const 0x04876af4) line 449
nsWindowWatcher::OpenWindowJS(nsWindowWatcher * const 0x00f73664, nsIDOMWindow *
0x03680f84, const char * 0x0486dc40, const char * 0x00000000, const char *
0x0012bf64, int 1, unsigned int 1, long * 0x049839dc, nsIDOMWindow * *
0x0012bfbc) line 784
GlobalWindowImpl::OpenInternal(GlobalWindowImpl * const 0x03680f80, const
nsAString & {...}, const nsAString & {...}, const nsAString & {...}, int 1, long
* 0x049839d0, unsigned int 4, nsISupports * 0x00000000, nsIDOMWindow * *
0x0012c37c) line 4779 + 140 bytes
GlobalWindowImpl::OpenDialog(GlobalWindowImpl * const 0x03680f88, nsIDOMWindow *
* 0x0012c37c) line 3474 + 59 bytes
XPTC_InvokeByIndex(nsISupports * 0x03680f88, unsigned int 16, unsigned int 1,
nsXPTCVariant * 0x0012c37c) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2027 + 43 bytes
XPC_WN_CallMethod(JSContext * 0x04327210, JSObject * 0x025380a0, unsigned int 4,
long * 0x049839d0, long * 0x0012c644) line 1287 + 14 bytes
js_Invoke(JSContext * 0x04327210, unsigned int 4, unsigned int 0) line 1281 + 23
bytes
js_Interpret(JSContext * 0x04327210, long * 0x0012d078) line 3366 + 15 bytes
js_Invoke(JSContext * 0x04327210, unsigned int 1, unsigned int 2) line 1301 + 13
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x02d125a8,
nsXPCWrappedJS * 0x04743a18, unsigned short 5, const nsXPTMethodInfo *
0x0244c218, nsXPTCMiniVariant * 0x0012d3b8) line 1336 + 22 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x04743a18, unsigned short 5,
const nsXPTMethodInfo * 0x0244c218, nsXPTCMiniVariant * 0x0012d3b8) line 450
PrepareAndDispatch(nsXPTCStubBase * 0x04743a18, unsigned int 5, unsigned int *
0x0012d468, unsigned int * 0x0012d458) line 117 + 31 bytes
SharedStub() line 147
XPTC_InvokeByIndex(nsISupports * 0x04743a18, unsigned int 5, unsigned int 1,
nsXPTCVariant * 0x0012d5d8) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2027 + 43 bytes
XPC_WN_CallMethod(JSContext * 0x04327210, JSObject * 0x024f6cd0, unsigned int 1,
long * 0x049838f8, long * 0x0012d8a0) line 1287 + 14 bytes
js_Invoke(JSContext * 0x04327210, unsigned int 1, unsigned int 0) line 1281 + 23
bytes
js_Interpret(JSContext * 0x04327210, long * 0x0012e2d4) line 3366 + 15 bytes
js_Invoke(JSContext * 0x04327210, unsigned int 1, unsigned int 2) line 1301 + 13
bytes
js_InternalInvoke(JSContext * 0x04327210, JSObject * 0x041a4398, long 68830216,
unsigned int 0, unsigned int 1, long * 0x0012e538, long * 0x0012e534) line 1378
+ 20 bytes
JS_CallFunctionValue(JSContext * 0x04327210, JSObject * 0x041a4398, long
68830216, unsigned int 1, long * 0x0012e538, long * 0x0012e534) line 3601 + 31 bytes
nsJSContext::CallEventHandler(JSObject * 0x041a4398, JSObject * 0x041a4408,
unsigned int 1, long * 0x0012e538, long * 0x0012e534) line 1293 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x0450ba98, nsIDOMEvent
* 0x049e57e8) line 175 + 51 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0450bb78,
nsIDOMEvent * 0x049e57e8, nsIDOMEventTarget * 0x048a2348, unsigned int 8,
unsigned int 7) line 1435 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x0450ba30,
nsIPresContext * 0x0442a218, nsEvent * 0x0012f020, nsIDOMEvent * * 0x0012eb78,
nsIDOMEventTarget * 0x048a2348, unsigned int 7, nsEventStatus * 0x0012f06c) line
1530
nsXULElement::HandleDOMEvent(nsIPresContext * 0x0442a218, nsEvent * 0x0012f020,
nsIDOMEvent * * 0x0012eb78, unsigned int 7, nsEventStatus * 0x0012f06c) line 2801
nsXULElement::HandleDOMEvent(nsIPresContext * 0x0442a218, nsEvent * 0x0012f020,
nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus * 0x0012f06c) line
2633 + 50 bytes
PresShell::HandleDOMEventWithTarget(PresShell * const 0x043fc728, nsIContent *
0x04517780, nsEvent * 0x0012f020, nsEventStatus * 0x0012f06c) line 6095
nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x0442a218, nsGUIEvent *
0x0012f244) line 178
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x04695db0,
nsIPresContext * 0x0442a218, nsGUIEvent * 0x0012f244, nsEventStatus *
0x0012f558) line 150
PresShell::HandleEventInternal(nsEvent * 0x0012f244, nsIView * 0x00000000,
unsigned int 1, nsEventStatus * 0x0012f558) line 6059 + 39 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x043fc728, nsEvent *
0x0012f244, nsIFrame * 0x04695db0, nsIContent * 0x04517780, unsigned int 1,
nsEventStatus * 0x0012f558) line 5970 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsIPresContext * 0x0442a218,
nsMouseEvent * 0x0012f778, nsEventStatus * 0x0012f558) line 2933 + 66 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x0442a830,
nsIPresContext * 0x0442a218, nsEvent * 0x0012f778, nsIFrame * 0x04695db0,
nsEventStatus * 0x0012f558, nsIView * 0x043fbe10) line 1944 + 23 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f778, nsIView * 0x043fbe10,
unsigned int 1, nsEventStatus * 0x0012f558) line 6067 + 52 bytes
PresShell::HandleEvent(PresShell * const 0x043fc79c, nsIView * 0x043fbe10,
nsGUIEvent * 0x0012f778, nsEventStatus * 0x0012f558, int 1, int & 1) line 5908 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x043fbe10, nsGUIEvent * 0x0012f778, int 1)
line 2238
nsViewManager::DispatchEvent(nsViewManager * const 0x043fbc40, nsGUIEvent *
0x0012f778, nsEventStatus * 0x0012f650) line 1978 + 20 bytes
HandleEvent(nsGUIEvent * 0x0012f778) line 79
nsWindow::DispatchEvent(nsWindow * const 0x043fbeac, nsGUIEvent * 0x0012f778,
nsEventStatus & nsEventStatus_eIgnore) line 1067 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f778) line 1088
nsWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5259 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5514
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 2687071, long *
0x0012fc28) line 4045 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x001e058e, unsigned int 514, unsigned int 0, long
2687071) line 1349 + 27 bytes
USER32! 77e3a2d0()
USER32! 77e145e5()
USER32! 77e1a816()
nsAppShellService::Run(nsAppShellService * const 0x00f74e50) line 524
main1(int 1, char * * 0x00262508, nsISupports * 0x00eb2330) line 1303 + 32 bytes
main(int 1, char * * 0x00262508) line 1780 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 7c5987e7()
sorry, submitted too early.

to reproduce this crash:

1) go to mail compose window
2) use the "select addresses" dialog
3) select lots of addresses (say 50?)
4) add them using the To button
5) hit ok

I crash every time.  element is already deleted (0xdddddddd)
 
Why me?  Need a bit more debugging love, ideally some purify.  This is not a
PLDHashTable bug, I can unboldly predict.

/be
Assignee: brendan → mscott
I'll run Purify on this.
Purify seems to have lost track of when that object was deleted, or
PL_DHashTable has defeated it easily :-) but fwiw, I'm pretty sure Brendan is
right, and this problem is specific to layout, or the addressing widget. I've
only seen this crash replying to existing messages, or as described in this bug
report.
Severity: normal → critical
Keywords: crash
I've also see this when bring up the compose window for a new message.

I'll try to get a stack trace for that.

I agree with david that it might be the addressing widget tickling a bug in layout.

fear the addressing widget.
here's a similar stack for a crash when I do new compose window.

nsSupportsHashtable::ReleaseElement(nsHashKey * 0x04b00b40, void * 0x04847a30,
void * 0x00000000) line 812 + 15 bytes
hashEnumerate(PLDHashTable * 0x04b00980, PLDHashEntryHdr * 0x04b00a64, unsigned
int 0, void * 0x0012a1f0) line 131 + 26 bytes
PL_DHashTableEnumerate(PLDHashTable * 0x04b00980, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x10014760 hashEnumerate(PLDHashTable
*, PLDHashEntryHdr *, unsigned int, void *), void * 0x0012a1f0) line 619 + 34 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x10015ba0
nsSupportsHashtable::ReleaseElement(nsHashKey *, void *, void *), void *
0x00000000) line 319 + 21 bytes
nsSupportsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x10015ba0
nsSupportsHashtable::ReleaseElement(nsHashKey *, void *, void *), void *
0x00000000) line 222
nsSupportsHashtable::~nsSupportsHashtable() line 819
nsSupportsHashtable::`scalar deleting destructor'(unsigned int 1) + 16 bytes
nsPresState::~nsPresState() line 93 + 33 bytes
nsPresState::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsPresState::Release(nsPresState * const 0x04b00920) line 83 + 209 bytes
nsCOMPtr<nsIPresState>::assign_assuming_AddRef(nsIPresState * 0x00000000) line 495
nsCOMPtr<nsIPresState>::assign_with_AddRef(nsISupports * 0x00000000) line 1023
nsCOMPtr<nsIPresState>::operator=(nsIPresState * 0x00000000) line 608
nsBoxObject::SetDocument(nsBoxObject * const 0x04ae0314, nsIDocument *
0x00000000) line 146
nsDocument::SetBoxObjectFor(nsDocument * const 0x03c0dbac, nsIDOMElement *
0x04669a4c, nsIBoxObject * 0x00000000) line 2790
nsXULElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 1590
nsXULElement::RemoveChildAt(unsigned int 1, int 1) line 1928
nsGenericElement::doReplaceChild(nsIContent * 0x045981b0, nsIDOMNode *
0x04b3a254, nsIDOMNode * 0x04669a4c, nsIDOMNode * * 0x0012a73c) line 2987 + 17 bytes
nsXULElement::ReplaceChild(nsXULElement * const 0x045981bc, nsIDOMNode *
0x04b3a254, nsIDOMNode * 0x04669a4c, nsIDOMNode * * 0x0012a73c) line 846 + 24 bytes
XPTC_InvokeByIndex(nsISupports * 0x045981bc, unsigned int 16, unsigned int 3,
nsXPTCVariant * 0x0012a71c) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2027 + 43 bytes
XPC_WN_CallMethod(JSContext * 0x024e9c98, JSObject * 0x0492d6b0, unsigned int 2,
long * 0x04b453a8, long * 0x0012a9e4) line 1287 + 14 bytes
js_Invoke(JSContext * 0x024e9c98, unsigned int 2, unsigned int 0) line 1281 + 23
bytes
js_Interpret(JSContext * 0x024e9c98, long * 0x0012b418) line 3366 + 15 bytes
js_Invoke(JSContext * 0x024e9c98, unsigned int 0, unsigned int 0) line 1301 + 13
bytes
js_Interpret(JSContext * 0x024e9c98, long * 0x0012bdfc) line 3366 + 15 bytes
js_Invoke(JSContext * 0x024e9c98, unsigned int 0, unsigned int 2) line 1301 + 13
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x049c29e0,
nsXPCWrappedJS * 0x04a688e8, unsigned short 3, const nsXPTMethodInfo *
0x03b91b18, nsXPTCMiniVariant * 0x0012c13c) line 1336 + 22 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x04a688e8, unsigned short 3,
const nsXPTMethodInfo * 0x03b91b18, nsXPTCMiniVariant * 0x0012c13c) line 450
PrepareAndDispatch(nsXPTCStubBase * 0x04a688e8, unsigned int 3, unsigned int *
0x0012c1ec, unsigned int * 0x0012c1dc) line 117 + 31 bytes
SharedStub() line 147
nsMsgCompose::NotifyStateListeners(nsMsgCompose * const 0x049deeb0,
TStateListenerNotification eComposeFieldsReady, unsigned int 0) line 3581
nsMsgCompose::InitEditor(nsMsgCompose * const 0x049deeb0, nsIEditor *
0x04a264b8, nsIDOMWindow * 0x0497f37c) line 1355
XPTC_InvokeByIndex(nsISupports * 0x049deeb0, unsigned int 27, unsigned int 2,
nsXPTCVariant * 0x0012c414) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2027 + 43 bytes
XPC_WN_CallMethod(JSContext * 0x024e9c98, JSObject * 0x045b7550, unsigned int 2,
long * 0x04b45294, long * 0x0012c6dc) line 1287 + 14 bytes
js_Invoke(JSContext * 0x024e9c98, unsigned int 2, unsigned int 0) line 1281 + 23
bytes
js_Interpret(JSContext * 0x024e9c98, long * 0x0012d110) line 3366 + 15 bytes
js_Invoke(JSContext * 0x024e9c98, unsigned int 1, unsigned int 2) line 1301 + 13
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x049deeb0,
nsXPCWrappedJS * 0x049def60, unsigned short 4, const nsXPTMethodInfo *
0x03c5a580, nsXPTCMiniVariant * 0x0012d450) line 1336 + 22 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x049def60, unsigned short 4,
const nsXPTMethodInfo * 0x03c5a580, nsXPTCMiniVariant * 0x0012d450) line 450
PrepareAndDispatch(nsXPTCStubBase * 0x049def60, unsigned int 4, unsigned int *
0x0012d500, unsigned int * 0x0012d4f0) line 117 + 31 bytes
SharedStub() line 147
nsMsgComposeService::OpenWindow(const char * 0x00000000, nsIMsgComposeParams *
0x04a9f150) line 272
nsMsgComposeService::OpenComposeWindow(nsMsgComposeService * const 0x02558e90,
const char * 0x00000000, const char * 0x04ab26c8, int 5, int 0, nsIMsgIdentity *
0x03c5f880, nsIMsgWindow * 0x03b87dd0) line 478 + 21 bytes
XPTC_InvokeByIndex(nsISupports * 0x02558e90, unsigned int 3, unsigned int 6,
nsXPTCVariant * 0x0012da1c) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2027 + 43 bytes
XPC_WN_CallMethod(JSContext * 0x024e9c98, JSObject * 0x03bcb1f0, unsigned int 6,
long * 0x04b4516c, long * 0x0012dce4) line 1287 + 14 bytes
js_Invoke(JSContext * 0x024e9c98, unsigned int 6, unsigned int 0) line 1281 + 23
bytes
js_Interpret(JSContext * 0x024e9c98, long * 0x0012e718) line 3366 + 15 bytes
js_Invoke(JSContext * 0x024e9c98, unsigned int 1, unsigned int 2) line 1301 + 13
bytes
js_InternalInvoke(JSContext * 0x024e9c98, JSObject * 0x0388a2b8, long 69368328,
unsigned int 0, unsigned int 1, long * 0x0012e97c, long * 0x0012e978) line 1378
+ 20 bytes
JS_CallFunctionValue(JSContext * 0x024e9c98, JSObject * 0x0388a2b8, long
69368328, unsigned int 1, long * 0x0012e97c, long * 0x0012e978) line 3618 + 31 bytes
nsJSContext::CallEventHandler(JSObject * 0x0388a2b8, JSObject * 0x04227a08,
unsigned int 1, long * 0x0012e97c, long * 0x0012e978) line 1292 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x03671638, nsIDOMEvent
* 0x04aa1000) line 174 + 51 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x036716a0,
nsIDOMEvent * 0x04aa1000, nsIDOMEventTarget * 0x04a8e1d8, unsigned int 8,
unsigned int 7) line 1434 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x036715d0,
nsIPresContext * 0x02c3bba8, nsEvent * 0x0012f028, nsIDOMEvent * * 0x0012efbc,
nsIDOMEventTarget * 0x04a8e1d8, unsigned int 7, nsEventStatus * 0x0012f074) line
1529
nsXULElement::HandleDOMEvent(nsIPresContext * 0x02c3bba8, nsEvent * 0x0012f028,
nsIDOMEvent * * 0x0012efbc, unsigned int 7, nsEventStatus * 0x0012f074) line 2790
PresShell::HandleDOMEventWithTarget(PresShell * const 0x02c646e0, nsIContent *
0x03673858, nsEvent * 0x0012f028, nsEventStatus * 0x0012f074) line 6108
nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x02c3bba8, nsGUIEvent *
0x0012f24c) line 178
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x0395c500,
nsIPresContext * 0x02c3bba8, nsGUIEvent * 0x0012f24c, nsEventStatus *
0x0012f560) line 150
PresShell::HandleEventInternal(nsEvent * 0x0012f24c, nsIView * 0x00000000,
unsigned int 1, nsEventStatus * 0x0012f560) line 6072 + 39 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x02c646e0, nsEvent *
0x0012f24c, nsIFrame * 0x0395c500, nsIContent * 0x03673858, unsigned int 1,
nsEventStatus * 0x0012f560) line 5983 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsIPresContext * 0x02c3bba8,
nsMouseEvent * 0x0012f780, nsEventStatus * 0x0012f560) line 2933 + 66 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x02c946f8,
nsIPresContext * 0x02c3bba8, nsEvent * 0x0012f780, nsIFrame * 0x0395c500,
nsEventStatus * 0x0012f560, nsIView * 0x02c64118) line 1944 + 23 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f780, nsIView * 0x02c64118,
unsigned int 1, nsEventStatus * 0x0012f560) line 6080 + 52 bytes
PresShell::HandleEvent(PresShell * const 0x02c64754, nsIView * 0x02c64118,
nsGUIEvent * 0x0012f780, nsEventStatus * 0x0012f560, int 1, int & 1) line 5921 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x02c64118, nsGUIEvent * 0x0012f780, int 1)
line 2236
nsViewManager::DispatchEvent(nsViewManager * const 0x02c94f88, nsGUIEvent *
0x0012f780, nsEventStatus * 0x0012f658) line 1976 + 20 bytes
HandleEvent(nsGUIEvent * 0x0012f780) line 79
nsWindow::DispatchEvent(nsWindow * const 0x02c641b4, nsGUIEvent * 0x0012f780,
nsEventStatus & nsEventStatus_eIgnore) line 1067 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f780) line 1088
nsWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5189 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5444
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 3735673, long *
0x0012fc28) line 3975 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x0037074a, unsigned int 514, unsigned int 0, long
3735673) line 1349 + 27 bytes
USER32! 77e3a2d0()
USER32! 77e145e5()
USER32! 77e1a816()
nsAppShellService::Run(nsAppShellService * const 0x00f75308) line 524
main1(int 1, char * * 0x00264f70, nsISupports * 0x00eb32b0) line 1302 + 32 bytes
main(int 1, char * * 0x00264f70) line 1779 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 7c5987e7()

This looks a lot like we're over-releasing the presstate. Anyone want to run a
refcnt-balance log on nsPresState?
Looks more like over-releasing one of the objects in the hashtable to me,
especially if this is Windows DEBUG where (I think) deleted objects are marked
with 0xdddddddd.
yes, the object has been deleted. It's odd that Purify doesn't point out where
the error is...
Probably it's an arena-allocated object, most likely an nsIFrame implementation
(which really shouldn't be put in an nsSupportsHashtable).
(If you change the |memset| in FrameArena::FreeFrame in nsPresShell.cpp, does it
end up with something other than 0xdddddddd?)
Don't nsIFrame impls assert in AddRef and Release?

/be
nsFrame::AddRef and nsFrame::Release have NS_WARNING("not supported for
frames"), which is almost an assertion, but some other frame classes override:
http://lxr.mozilla.org/seamonkey/search?string=Frame%3A%3AAddRef
http://lxr.mozilla.org/seamonkey/search?string=Frame%3A%3ARelease

(The ones that return NS_OK are especially clever.)
(In reply to comment #11)
> (If you change the |memset| in FrameArena::FreeFrame in nsPresShell.cpp, does it
> end up with something other than 0xdddddddd?)

yes, it does.  I'll try disabling the frame arena and running purify again.
Yes, here are the error, allocation, and free stacks.

[E] FMR: Free memory read in nsSupportsHashtable::ReleaseElement(nsHashKey
*,void *,void *) {1 occurrence}
        Reading 4 bytes from 0x170074e0 (4 bytes at 0x170074e0 illegal)
        Address 0x170074e0 is 136 bytes into a 232 byte block at 0x17007458
        Address 0x170074e0 points to a malloc'd block in heap 0x02420000
        Thread ID: 0x944
        Error location
            nsSupportsHashtable::ReleaseElement(nsHashKey *,void *,void *)
[nsHashtable.cpp:796]
            hashEnumerate  [nsHashtable.cpp:115]
            PL_DHashTableEnumerate [pldhash.c:619]
            nsHashtable::Enumerate((*)(nsHashKey *,void *,void *),void *)
[nsHashtable.cpp:303]
            nsSupportsHashtable::Enumerate((*)(nsHashKey *,void *,void *),void
*) [nsHashtable.h:205]
            nsSupportsHashtable::~nsSupportsHashtable(void) [nsHashtable.cpp:802]
            nsSupportsHashtable::`vector deleting destructor'(UINT) [gklayout.dll]
            nsPresState::~nsPresState(void) [nsPresState.cpp:93]
            nsPresState::`scalar deleting destructor'(UINT) [gklayout.dll]
            nsPresState::Release(void) [nsPresState.cpp:83]


        Allocation location
            malloc         [dbgheap.c:129]
            PR_Malloc      [prmem.c:474]
            FrameArena::AllocateFrame(UINT) [nsPresShell.cpp:618]
            PresShell::AllocateFrame(UINT) [nsPresShell.cpp:1969]
            nsFrame::new(UINT,nsIPresShell *) [nsFrame.cpp:436]
            NS_NewListBoxBodyFrame(nsIPresShell *,nsIFrame * *,int,nsIBoxLayout
*) [nsListBoxBodyFrame.cpp:1510]
            nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell
*,nsIPresContext *,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsIAtom
*,int,nsStyleContext *,nsFrameItems&,int,int&) [nsCSSFrameConstructor.cpp:5454]
            nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell
*,nsIPresContext *,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsIAtom
*,int,nsStyleContext *,nsFrameItems&,int) [nsCSSFrameConstructor.cpp:7133]
            nsCSSFrameConstructor::ConstructFrame(nsIPresShell *,nsIPresContext
*,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsFrameItems&)
[nsCSSFrameConstructor.cpp:7026]
            nsCSSFrameConstructor::ProcessChildren(nsIPresShell *,nsIPresContext
*,nsFrameConstructorState&,nsIContent *,nsIFrame
*,int,nsFrameItems&,int,nsTableCreator *) [nsCSSFrameConstructor.cpp:11464]
            nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell
*,nsIPresContext *,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsIAtom
*,int,nsStyleContext *,nsFrameItems&,int,int&) [nsCSSFrameConstructor.cpp:5667]
            nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell
*,nsIPresContext *,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsIAtom
*,int,nsStyleContext *,nsFrameItems&,int) [nsCSSFrameConstructor.cpp:7133]
            nsCSSFrameConstructor::ConstructFrame(nsIPresShell *,nsIPresContext
*,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsFrameItems&)
[nsCSSFrameConstructor.cpp:7026]
            nsCSSFrameConstructor::ProcessChildren(nsIPresShell *,nsIPresContext
*,nsFrameConstructorState&,nsIContent *,nsIFrame
*,int,nsFrameItems&,int,nsTableCreator *) [nsCSSFrameConstructor.cpp:11464]
            nsCSSFrameConstructor::ConstructXULFrame(nsIPresShell
*,nsIPresContext *,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsIAtom
*,int,nsStyleContext *,nsFrameItems&,int,int&) [nsCSSFrameConstructor.cpp:5667]
            nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell
*,nsIPresContext *,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsIAtom
*,int,nsStyleContext *,nsFrameItems&,int) [nsCSSFrameConstructor.cpp:7133]
            nsCSSFrameConstructor::ConstructFrame(nsIPresShell *,nsIPresContext
*,nsFrameConstructorState&,nsIContent *,nsIFrame *,nsFrameItems&)
[nsCSSFrameConstructor.cpp:7026]
            nsCSSFrameConstructor::ContentInserted(nsIPresContext *,nsIContent
*,nsIFrame *,nsIContent *,int,nsILayoutHistoryState *,int)
[nsCSSFrameConstructor.cpp:8917]
 

       Free location
            free           [dbgheap.c:955]
            PR_Free        [prmem.c:502]
            FrameArena::FreeFrame(UINT,void *) [nsPresShell.cpp:655]
            PresShell::FreeFrame(UINT,void *) [nsPresShell.cpp:1963]
            nsFrame::Destroy(nsIPresContext *) [nsFrame.cpp:654]
            nsSplittableFrame::Destroy(nsIPresContext *) [nsSplittableFrame.cpp:71]
            nsContainerFrame::Destroy(nsIPresContext *) [nsContainerFrame.cpp:141]
            nsBoxFrame::Destroy(nsIPresContext *) [nsBoxFrame.cpp:1065]
            nsListBoxBodyFrame::Destroy(nsIPresContext *)
[nsListBoxBodyFrame.cpp:278]
            nsFrameList::DestroyFrames(nsIPresContext *) [nsFrameList.cpp:129]
            nsContainerFrame::Destroy(nsIPresContext *) [nsContainerFrame.cpp:134]
            nsBoxFrame::Destroy(nsIPresContext *) [nsBoxFrame.cpp:1065]
            nsFrameList::DestroyFrames(nsIPresContext *) [nsFrameList.cpp:129]
            nsContainerFrame::Destroy(nsIPresContext *) [nsContainerFrame.cpp:134]
            nsBoxFrame::Destroy(nsIPresContext *) [nsBoxFrame.cpp:1065]
            nsGfxScrollFrame::Destroy(nsIPresContext *) [nsGfxScrollFrame.cpp:427]
            nsFrameList::DestroyFrames(nsIPresContext *) [nsFrameList.cpp:129]
            nsContainerFrame::Destroy(nsIPresContext *) [nsContainerFrame.cpp:134]

NS_IMETHODIMP_(nsrefcnt) 
nsListBoxBodyFrame::AddRef(void)
{
  return 2;
}

NS_IMETHODIMP_(nsrefcnt)
nsListBoxBodyFrame::Release(void)
{
  return 1;
}


Argh, what a mess. Are there bugs on file to fix all these broken AddRef and
Release overrides?  Why are they overriding the base class?

/be
Here's the stack trace where the pres state gets deleted:

nsPresState::~nsPresState() line 93
nsPresState::`scalar deleting destructor'(unsigned int 0x00000001) + 15 bytes
nsPresState::Release(nsPresState * const 0x07c776e8) line 83 + 209 bytes
nsCOMPtr<nsIPresState>::assign_assuming_AddRef(nsIPresState * 0x00000000) line 495
nsCOMPtr<nsIPresState>::assign_with_AddRef(nsISupports * 0x00000000) line 1023
nsCOMPtr<nsIPresState>::operator=(nsIPresState * 0x00000000) line 608
nsBoxObject::SetDocument(nsBoxObject * const 0x079fd834, nsIDocument *
0x00000000) line 146
nsDocument::SetBoxObjectFor(nsDocument * const 0x054f6844, nsIDOMElement *
0x0788bec4, nsIBoxObject * 0x00000000) line 2799
nsXULElement::SetDocument(nsIDocument * 0x00000000, int 0x00000001, int
0x00000001) line 1574
nsXULElement::RemoveChildAt(unsigned int 0x00000001, int 0x00000001) line 1912
nsGenericElement::doReplaceChild(nsIContent * 0x0538ed48, nsIDOMNode *
0x07edf684, nsIDOMNode * 0x0788bec4, nsIDOMNode * * 0x00128c4c) line 2988 + 17 bytes
nsXULElement::ReplaceChild(nsXULElement * const 0x0538ed54, nsIDOMNode *
0x07edf684, nsIDOMNode * 0x0788bec4, nsIDOMNode * * 0x00128c4c) line 830 + 24 bytes
XPTC_InvokeByIndex(nsISupports * 0x0538ed54, unsigned int 0x00000010, unsigned
int 0x00000003, nsXPTCVariant * 0x00128c2c) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2027 + 43 bytes
XPC_WN_CallMethod(JSContext * 0x07c5d190, JSObject * 0x07708d68, unsigned int
0x00000002, long * 0x07edbf04, long * 0x00128efc) line 1287 + 14 bytes

 - this is called from the addressing widget js, probably here:

function awAppendNewRow(setFocus)
{
  var listbox = document.getElementById('addressingWidget');
  var listitem1 = awGetListItem(1);

  if ( listbox && listitem1 )
  {
    var lastRecipientType =
awGetPopupElement(top.MAX_RECIPIENTS).selectedItem.getAttribute("value");

    var nextDummy = awGetNextDummyRow();
    var newNode = listitem1.cloneNode(true);
    if (nextDummy)
      listbox.replaceChild(newNode, nextDummy);
    else
      listbox.appendChild(newNode);


bienvenu: you're asking or answering the wrong question.

don't ask where it got killed.

ask why in the world it was put in the array in the first place.

frames have a very specific ownership model and someone blew it.
I understand that's the fundamental problem that has to be fixed...if that's
going to be the quickest fix, that's fine, but if there's some other quick fix
that will stop the trunk from crashing, I think that's worth investigating too -
I'm not sure how hard it is to fix the fundamental problem.
http://lxr.mozilla.org/seamonkey/source/layout/xul/base/src/nsListBoxObject.cpp#237

nsIListBoxObject*
nsListBoxObject::GetListBoxBody()

  // It's a frame. Refcounts are irrelevant.
  nsCOMPtr<nsIListBoxObject> body;
  yeahBaby->QueryInterface(NS_GET_IID(nsIListBoxObject), getter_AddRefs(body));
  SetPropertyAsSupports(listboxbody.get(), body);
  return body;

This code has been doing this for a long time...the object is both an
nsIListBoxObject and an nsIFrame. I wonder if a call to
nsListBoxObject::InvalidatePresentationStuff before the frame is destroyed would
paper over the crash.
i'm willing to write a debug only check on nsSupportsHashtable and similar xpcom
creatures which QIs to nsIFrame and asserts at insertion time. That'd be the
fast way to find your critter today and probably the best way to avoid this
problem tomorrow.
thx, I've already found where it's happening...see
http://bugzilla.mozilla.org/show_bug.cgi?id=240720#c21
Attached patch possible fix — — Splinter Review 
cache a non-refcounted pointer
Comment on attachment 146814 [details] [diff] [review]
possible fix

I haven't had any problems with this patch...but I have no idea if this is
right. It doesn't crash, and it doesn't seem to leak the frames...
Attachment #146814 - Flags: superreview?(dbaron)
Comment on attachment 146814 [details] [diff] [review]
possible fix

>+  if (mListBoxBody) {
>+    nsCOMPtr<nsIListBoxObject> body(do_QueryInterface(mListBoxBody));
>     return body;

This could just be

if (mListBoxBody)
  return mListBoxBody;

but other than that, you need to find someone who knows something about box
objects to review...
Attachment #146814 - Flags: superreview?(dbaron) → superreview+
Comment on attachment 146814 [details] [diff] [review]
possible fix

Ok, looking at the checkin log, I'm going to try jst. I'll remove the QI and
comptr
Attachment #146814 - Flags: review?(jst)
I think I'd prefer this over the proposed fix since the proposed fix still
leaves dangling pointers that could easily cause crashes in other situations. I
don't know enough about this code to say if it will happen or not, but it seems
likely that it could.

David, can you test this?
yes, that works, and it seems like that's the way the code was supposed to work...
Attachment #147068 - Flags: superreview?(dbaron)
Attachment #147068 - Flags: review?(bienvenu)
Attachment #147068 - Flags: review?(bienvenu) → review+
Comment on attachment 147068 [details] [diff] [review]
How about this instead? This makes sure we invalidate the listbox's box object when the listbox's body frame is destroyed.

sr=dbaron, although I'm not a big fan of calling a variable that iterates over
ancestors |parent|.  I prefer |f| or |a|. :-)  And the loop could also be a for
loop instead of a while loop...
Attachment #147068 - Flags: superreview?(dbaron) → superreview+
David do you think this crash is in 1.7/0.6?
Fix checked in, let me know if someone wants me to land this on the 1.7 branch too.
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
I doubt it - it popped up right when the tree opened for 1.8, so some change
there probably triggered it (I suspect some de-COM-tamification work exposed
this problem). But we could scour talkback and see if any stack trace like that
shows up in 1.7 builds...
Attachment #146814 - Flags: review?(jst)
*** Bug 263771 has been marked as a duplicate of this bug. ***
Product: MailNews → Core
Product: Core → MailNews Core
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: