Closed Bug 42109 Opened 24 years ago Closed 24 years ago

crash at shift-clicking a title in the messages list

Categories

(Core :: XUL, defect, P1)

Product:
Core
Component:
XUL
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: tarahim, Assigned: bryner)

References

Details

(Keywords: crash, Whiteboard: [nsbeta3+][PDTP1])

Attachments

(1 file)

talkback report
5.00 KB, text/plain
Details 
Currently, there are 7 messages in the trash folder of an mail account.  When I select Trash, and the list of 
messages title are displayed but none of them are selected for displaying the message body.  Then, at the 
instant I shift-click a title in the message list, Mozilla crashes with type 11 error.
Severity: blocker → critical
Is this for any message you have?  Is this particular to just those messages?
Status: UNCONFIRMED → NEW
Ever confirmed: true
OK, I nailed it down.  The crash occurs only when the last in the list is shift-
clicked.  It does not crash when there is only one message in the list.  May be 
related to the shift-click bug No.30377.  Shift-clicking others in the list 
before any selection shows some weird behavior, too.

similar type 11 crash after shift-click occured in Manage Bookmark window, 
too(2000060908-M17).  Even more likely a duplicate of No.30377 with 
worse outcome in MacOS?  If this is 30377, the priority for fix is disppointingly 
low for Mac version.

I'm not clear on what the steps to reproduce this crash are. Can you try to 
explain this again? I cannot get a crash for Mac with the build you mentioned,
by shift-clicking on the last message in the mail thread pane, or in the 
bookmarks window. 

I doubt this is causally related to bug 30377. That's just some selection
logic that is wrong in the UI sense, but not likely to cause a crash.
1)Start Mozilla (with Browser window in my case, I doubt it matters).
2)Open Mail window (at this point, Mozilla Mail Start message is displayed), 
select whatever box you have a message in, and display a message content by 
clicking one of the title.
3)Change the box to another where there are more than two messages by cliking in 
Mail Folders pane.
4)At this point no message content is displayed. This is the requirement for the 
crash to occur.
5)Shift-click the last title in the message list and you get a crash.
Now I am getting type 2 crash instead of type 11 in build 2000060908M17.
This is still very reproducible.  I am not sure about the exact conditon for 
Bookmarks, yet.  But the mechanism seems similar.

I believe this is related to selection logic.
For Bookmarks, you select one and delete it.
Then, you shift click the one  at the bottom of the list, and you get type 11.
The crash with Mail seems that since you have selected one message before moving 
to another box, the effect is like deleting the previously selected message in 
Bookmarks.
No wonder they behave similarly.

FYI
I remeber a similar "shift-clicking selection of deleted bookmark" crash bug was 
present in NScommunicator PRs.

Thank you. Most excellent descriptions. Certainly a selection bug in 
tree code. This code is all going under the knife as we 'speak', but 
I'll move this over to hyatt and I'll see if this is still a problem
with the tree-is-a-grid-not-an-HTMLTable code. Thanks again. cc: claudius
for the bookmark's test.
Assignee: putterman → hyatt
Component: Mail Window Front End → XP Toolkit/Widgets: Trees
Keywords: crash
OS: Mac System 8.6 → All
Product: MailNews → Browser
QA Contact: lchiang → jrgm
Hardware: Macintosh → All
This is the stack from the mail thread crash:

 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  1F504B04  
  0E710AC0    PPC  1F4EF718  main+00130
  0E710A60    PPC  1F4EEC14  main1(int, char**, nsISupports*)+00944
  0E7107A0    PPC  1F0EED34  nsAppShellService::Run()+00018
  0E710760    PPC  1EC39D44  nsAppShell::Run()+00038
  0E710710    PPC  1EC3A440  nsMacMessagePump::DoMessagePump()+0003C
  0E7106C0    PPC  1EC3A944  nsMacMessagePump::DispatchEvent(int, 
EventRecord*)+00070
  0E710670    PPC  1EC3B2AC  nsMacMessagePump::DoMouseUp(EventRecord&)+0004C
  0E710620    PPC  1EC3B840  
nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort*)+00044
  0E7105D0    PPC  1EC371E4  nsMacMessageSink::DispatchOSEvent(EventRecord&, 
GrafPort*)+00038
  0E710590    PPC  1EC32488  nsMacWindow::HandleOSEvent(EventRecord&)+00020
  0E710550    PPC  1EC331D4  
nsMacEventHandler::HandleOSEvent(EventRecord&)+000D0
  0E710500    PPC  1EC34990  
nsMacEventHandler::HandleMouseUpEvent(EventRecord&)+00048
  0E710470    PPC  1EC18368  nsWindow::DispatchMouseEvent(nsMouseEvent&)+00054
  0E710410    PPC  1EC18224  nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018
  0E7103D0    PPC  1EC18150  nsWindow::DispatchEvent(nsGUIEvent*, 
nsEventStatus&)+00094
  0E710380    PPC  1CD2A4DC  HandleEvent(nsGUIEvent*)+00058
  0E710330    PPC  1CD33834  nsViewManager2::DispatchEvent(nsGUIEvent*, 
nsEventStatus*)+005EC
  0E710200    PPC  1CD2BE8C  nsView::HandleEvent(nsGUIEvent*, unsigned int, 
nsEventStatus*, int&)+0015C
  0E710180    PPC  1CD2BF18  nsView::HandleEvent(nsGUIEvent*, unsigned int, 
nsEventStatus*, int&)+001E8
  0E710100    PPC  1DFF52B8  PresShell::HandleEvent(nsIView*, nsGUIEvent*, 
nsEventStatus*, int&)+002E4
  0E710090    PPC  1DFF55F4  PresShell::HandleEventInternal(nsEvent*, nsIView*, 
nsEventStatus*)+001C8
  0E710030    PPC  1E0AD294  
nsEventStateManager::PostHandleEvent(nsIPresContext*, nsEvent*, nsIFrame*, 
nsEventStatus*, nsIView*)+00398
  0E70FEC0    PPC  1E0AF18C  
nsEventStateManager::CheckForAndDispatchClick(nsIPresContext*, nsMouseEvent*, 
nsEventStatus*)+00158
  0E70FDE0    PPC  1DFF539C  PresShell::HandleEventWithTarget(nsEvent*, 
nsIFrame*, nsIContent*, nsEventStatus*)+00038
  0E70FD90    PPC  1DFF54E8  PresShell::HandleEventInternal(nsEvent*, nsIView*, 
nsEventStatus*)+000BC
  0E70FD30    PPC  1F054E50  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4
  0E70FAE0    PPC  1F054E50  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4
  0E70F890    PPC  1F054E50  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4
  0E70F640    PPC  1F054D74  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+004C8
  0E70F3F0    PPC  1E0A7968  
nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, 
nsIDOMEventTarget*, unsigned int, nsEventStatus*)+002C8
  0E70F210    PPC  1E35BA04  nsXBLEventHandler::MouseClick(nsIDOMEvent*)+000BC
  0E70F110    PPC  1E35D944  nsXBLEventHandler::ExecuteHandler(const nsString&, 
nsIDOMEvent*)+003C8
  0E70EDD0    PPC  1F1BC9A0  nsJSEventListener::HandleEvent(nsIDOMEvent*)+00268
  0E70ECB0    PPC  1F15FB9C  nsJSContext::CallEventHandler(void*, void*, 
unsigned int, void*, int*, int)+001E0
  0E70EBF0    PPC  1EE2C520  JS_CallFunctionValue+00028
  0E70EBB0    PPC  1EE4578C  js_InternalInvoke+000C0
  0E70EAF0    PPC  1EE45558  js_Invoke+004C4
  0E70EA10    PPC  1EE4C58C  js_Interpret+06528
  0E70E7D0    PPC  1EE45500  js_Invoke+0046C
  0E70E6F0    PPC  1F039AE8  XULTreeElementSelectItemRange(JSContext*, 
JSObject*, unsigned int, long*, long*)+002D8
  0E70E510    PPC  1F03B92C  
nsXULTreeElement::SelectItemRange(nsIDOMXULElement*, nsIDOMXULElement*)+00228
  0E70E170    PPC  1EC7CE24  nsCOMPtr_base::assign_from_helper(const 
nsCOMPtr_helper&, const nsID&)+00028
  0E70E120    PPC  1EC7CC50  nsQueryInterface::operator()(const nsID&, void**) 
const+00028

This is the code from the bookmark crash:

 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  1F504B04  
  0E710AC0    PPC  1F4EF718  main+00130
  0E710A60    PPC  1F4EEC14  main1(int, char**, nsISupports*)+00944
  0E7107A0    PPC  1F0AED34  nsAppShellService::Run()+00018
  0E710760    PPC  1ED8BD44  nsAppShell::Run()+00038
  0E710710    PPC  1ED8C440  nsMacMessagePump::DoMessagePump()+0003C
  0E7106C0    PPC  1ED8C944  nsMacMessagePump::DispatchEvent(int, 
EventRecord*)+00070
  0E710670    PPC  1ED8D2AC  nsMacMessagePump::DoMouseUp(EventRecord&)+0004C
  0E710620    PPC  1ED8D840  
nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort*)+00044
  0E7105D0    PPC  1ED891E4  nsMacMessageSink::DispatchOSEvent(EventRecord&, 
GrafPort*)+00038
  0E710590    PPC  1ED84488  nsMacWindow::HandleOSEvent(EventRecord&)+00020
  0E710550    PPC  1ED851D4  
nsMacEventHandler::HandleOSEvent(EventRecord&)+000D0
  0E710500    PPC  1ED86990  
nsMacEventHandler::HandleMouseUpEvent(EventRecord&)+00048
  0E710470    PPC  1ED6A368  nsWindow::DispatchMouseEvent(nsMouseEvent&)+00054
  0E710410    PPC  1ED6A224  nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018
  0E7103D0    PPC  1ED6A150  nsWindow::DispatchEvent(nsGUIEvent*, 
nsEventStatus&)+00094
  0E710380    PPC  1CD2A4DC  HandleEvent(nsGUIEvent*)+00058
  0E710330    PPC  1CD33834  nsViewManager2::DispatchEvent(nsGUIEvent*, 
nsEventStatus*)+005EC
  0E710200    PPC  1CD2BE8C  nsView::HandleEvent(nsGUIEvent*, unsigned int, 
nsEventStatus*, int&)+0015C
  0E710180    PPC  1CD2BF18  nsView::HandleEvent(nsGUIEvent*, unsigned int, 
nsEventStatus*, int&)+001E8
  0E710100    PPC  1DFF52B8  PresShell::HandleEvent(nsIView*, nsGUIEvent*, 
nsEventStatus*, int&)+002E4
  0E710090    PPC  1DFF55F4  PresShell::HandleEventInternal(nsEvent*, nsIView*, 
nsEventStatus*)+001C8
  0E710030    PPC  1E0AD294  
nsEventStateManager::PostHandleEvent(nsIPresContext*, nsEvent*, nsIFrame*, 
nsEventStatus*, nsIView*)+00398
  0E70FEC0    PPC  1E0AF18C  
nsEventStateManager::CheckForAndDispatchClick(nsIPresContext*, nsMouseEvent*, 
nsEventStatus*)+00158
  0E70FDE0    PPC  1DFF539C  PresShell::HandleEventWithTarget(nsEvent*, 
nsIFrame*, nsIContent*, nsEventStatus*)+00038
  0E70FD90    PPC  1DFF54E8  PresShell::HandleEventInternal(nsEvent*, nsIView*, 
nsEventStatus*)+000BC
  0E70FD30    PPC  1F014E50  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4
  0E70FAE0    PPC  1F014E50  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4
  0E70F890    PPC  1F014E50  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4
  0E70F640    PPC  1F014E50  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4
  0E70F3F0    PPC  1F014E50  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4
  0E70F1A0    PPC  1F014D74  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+004C8
  0E70EF50    PPC  1E0A7968  
nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, 
nsIDOMEventTarget*, unsigned int, nsEventStatus*)+002C8
  0E70ED70    PPC  1E35BA04  nsXBLEventHandler::MouseClick(nsIDOMEvent*)+000BC
  0E70EC70    PPC  1E35D944  nsXBLEventHandler::ExecuteHandler(const nsString&, 
nsIDOMEvent*)+003C8
  0E70E930    PPC  1F17C9A0  nsJSEventListener::HandleEvent(nsIDOMEvent*)+00268
  0E70E810    PPC  1F11FB9C  nsJSContext::CallEventHandler(void*, void*, 
unsigned int, void*, int*, int)+001E0
  0E70E750    PPC  1EE2C520  JS_CallFunctionValue+00028
  0E70E710    PPC  1EE4578C  js_InternalInvoke+000C0
  0E70E650    PPC  1EE45558  js_Invoke+004C4
  0E70E570    PPC  1EE4C58C  js_Interpret+06528
  0E70E330    PPC  1EE45500  js_Invoke+0046C
  0E70E250    PPC  1EFF9AE8  XULTreeElementSelectItemRange(JSContext*, 
JSObject*, unsigned int, long*, long*)+002D8

nominate nsbeta3.
Keywords: nsbeta3
Oh yes. Very reproducible in the bookmarks context. Simply delete bookmark and shift+click on the last bookmark and you crash 
immediately. Reproduced with the 2000061109 Rh 6.1 Linux build

I wonder if I should nominate for nsbeta2 instead.  Will your new tree rewrite 
address this, hyatt?
Summary: type 11 crash at shift-clicking a title in the messages list → crash at shift-clicking a title in the messages list
*** Bug 42807 has been marked as a duplicate of this bug. ***
fixed.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
(grumble, I suck, reopening ...) I can reproduce this crash in 3pane mail, using
the steps provided by hirata masakazu on 06/10. (reproduced on mac/linux/win32 
20000719nn builds).

(Note: I cannot reproduce this using the steps in the dup of this bug (Bug 
42807), and bug 42013, which could generate the same stack trace is also no
longer crashable. However, this bug can still trigger the required code path).
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
This is a result of not updating the current item when a tree item is deleted. 
I've been working on this.
Assignee: hyatt → bryner
Status: REOPENED → NEW
Status: NEW → ASSIGNED
Whiteboard: nsbeta3+
Whiteboard: nsbeta3+ → [nsbeta3+]
*** Bug 46426 has been marked as a duplicate of this bug. ***
Target Milestone: --- → M18
Keywords: mailtrack
P1
Priority: P3 → P1
*** Bug 49685 has been marked as a duplicate of this bug. ***
Checked in a fix.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago → 24 years ago
Resolution: --- → FIXED
Reopening. I can crash in mailnews using the steps provided by  hirata masakazu 
2000-06-10 20:02 -- note: this does not involve deleting any items, just 
doing a selection. It appears that currentItem is null prior to doing the 
shift-click (hence deref's a null pointer). Crash on mac/linux/win32 2000090508
builds.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Note: this _is_ fixed for the bookmark case (deleting, then doing shift-click).
I see this all the time.  I think I'm doing the steps here.  I'll attach the
talkback report I have.
Attached file talkback report — 

    
    

    
  
Ok, I must have missed something...

Status: REOPENED → ASSIGNED

    
    

    
  
PDT agrees P1
Whiteboard: [nsbeta3+] → [nsbeta3+][PDTP1]

    
    

    
  
Fixed for good, I hope.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago → 24 years ago
Resolution: --- → FIXED

    
    

    
  
Verified fixed 2000080708 win32/mac/linux builds -- no mo crash on the shift 
click. bryner is the man ...
Status: RESOLVED → VERIFIED

    
  
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: jrgmorrison → xptoolkit.widgets

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: