327504 - Crash Reading Mail [@ nsTemplateRule::GetAction]

Status: RESOLVED FIXED

(Thunderbird :: Mail Window Front End, defect)

Description

[Scott MacGregor]

Thunderbird trunk build 02/16.

I was reading some newsgroups and marking one of the groups as read when I crashed in the xul tree builder code.

Stack Trace:

ns_if_addref(nsIContent * 0xd8d8d8d8) line 114 + 9 bytes
nsTemplateRule::GetAction(nsIContent * * 0x0012eae4) line 321 + 11 bytes
nsXULTreeBuilder::GetTemplateActionRowFor(int 19, nsIContent * * 0x0012ed44) line 1415 + 35 bytes
nsXULTreeBuilder::GetRowProperties(nsXULTreeBuilder * const 0x032fd06c, int 19, nsISupportsArray * 0x02dec080) line 495 + 45 bytes
nsTreeBodyFrame::PaintRow(int 19, const nsRect & {...}, nsPresContext * 0x01a86bb8, nsIRenderingContext & {...}, const nsRect & {...}, nsPoint {...}) line 2346
nsTreeBodyFrame::PaintTreeBody(nsIRenderingContext & {...}, const nsRect & {...}, nsPoint {...}) line 2277
PaintTreeBody(nsIFrame * 0x03441da8, nsIRenderingContext * 0x044ce8e0, const nsRect & {...}, nsPoint {...}) line 2197
nsDisplayGeneric::Paint(nsDisplayListBuilder * 0x0012f034, nsIRenderingContext * 0x044ce8e0, const nsRect & {...}) line 734 + 42 bytes
nsDisplayList::Paint(nsDisplayListBuilder * 0x0012f034, nsIRenderingContext * 0x044ce8e0, const nsRect & {...}) line 166
nsDisplayWrapList::Paint(nsDisplayListBuilder * 0x0012f034, nsIRenderingContext * 0x044ce8e0, const nsRect & {...}) line 521
nsDisplayClip::Paint(nsDisplayListBuilder * 0x0012f034, nsIRenderingContext * 0x044ce8e0, const nsRect & {...}) line 754
nsDisplayList::Paint(nsDisplayListBuilder * 0x0012f034, nsIRenderingContext * 0x044ce8e0, const nsRect & {...}) line 166
nsLayoutUtils::PaintFrame(nsIRenderingContext * 0x044ce8e0, nsIFrame * 0x02ee6988, const nsRegion & {...}, unsigned int 4292405740) line 688
PresShell::Paint(PresShell * const 0x02d36c38, nsIView * 0x02d36760, nsIRenderingContext * 0x044ce8e0, const nsRegion & {...}) line 5536 + 21 bytes
nsViewManager::RenderViews(nsView * 0x02dec0f8, nsIRenderingContext & {...}, const nsRegion & {...}, nsIDrawingSurface * 0x067c22e0) line 861
nsViewManager::Refresh(nsView * 0x02dec0f8, nsIRenderingContext * 0x044ce8e0, nsIRegion * 0x04ccd610, unsigned int 1) line 699
nsViewManager::DispatchEvent(nsViewManager * const 0x02ef1860, nsGUIEvent * 0x0012f524, nsEventStatus * 0x0012f408) line 1459

Comment 1

[Scott MacGregor]

This is probably related to the new xul template builder stuff that landed the other day. 

Comment 2

[timeless]

Afaik 0xd8d8d8d8 is leaky MARKER2_0, is this a debug build?

Comment 3

[David :Bienvenu]

this isn't particular to newsgroups - I saw this reading mail, with the patch for bug 326712 applied.

Comment 4

[Scott MacGregor]

adjusting the summary to note that this crash isn't specific to newsgroups but any folders in the folder pane.

Comment 5

[Wayne Mery (:wsmwk)]

TB15249603 probably same stack, different circumstances (account related?), first time I have used folder views.

Stack Signature	 nsTemplateRule::GetAction 2e43f5e1
Build ID	2006021508
Operating System	Windows NT 5.0 build 2195

User Comments	folder view set to UNREAD, selected POP account which had not yet been logged in, typed password incorrectly twice, crash on 3rd pwd attempt 

Source File, Line No.	e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/templates/src/nsTemplateRule.cpp, line 321
Stack Trace 	
nsTemplateRule::GetAction  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/templates/src/nsTemplateRule.cpp, line 321]
nsXULTreeBuilder::GetRowProperties  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 496]
nsTreeBodyFrame::PaintRow  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 2346]
nsTreeBodyFrame::PaintTreeBody  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 2277]
PaintTreeBody  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 2197]
nsDisplayGeneric::Paint  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/generic/../base\nsDisplayList.h, line 734]
nsDisplayList::Paint  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/base/nsDisplayList.cpp, line 161]
PresShell::Paint  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 5536]
nsViewManager::RenderViews  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 886]
nsViewManager::Refresh  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 726]
nsViewManager::DispatchEvent  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 1482]
HandleEvent  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line 175]
nsWindow::DispatchEvent  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1036]
nsWindow::ProcessMessage  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4149]
nsWindow::WindowProc  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1225]
USER32.DLL + 0x3158f (0x77e4158f)
USER32.DLL + 0x2c19d (0x77e3c19d)
USER32.DLL + 0x2c1ca (0x77e3c1ca)
ntdll.dll + 0x11baf (0x77f91baf)
USER32.DLL + 0x31e7e (0x77e41e7e)
nsAppStartup::Run  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 162]
main  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/mail/app/nsMailApp.cpp, line 62]
KERNEL32.dll + 0x28989 (0x7c598989)

Comment 6

[Neil Deakin]

I know why this is happening. I can consistently reproduce using these steps:

1. switch to the Unread folder view.
2. Mark all messages in a folder as read, and then mark one as unread.

The mail datasource seems to be readding the folder to the list and the template builder gets confused. I should have a patch soon.

Comment 7

[Neil Deakin]

Attachment: remove the old match properly if it is the same as the new one

See if this patch fixes the crash.

Comment 8

[David :Bienvenu]

I've been running with this patch and haven't crashed yet.