74902 - Crash on open, then immediate close of MailNews window

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[David Caswell]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.2 i686; en-US; 0.8.1)
BuildID:    2001040508

Closing the Mailnews window without doing anything in it crashes Mozilla.

Reproducible: Always
Steps to Reproduce:
1. Start Mozilla.
2. Open Mailnews.
3. Immediately close the Mailnews window without doing anything.

Actual Results:  Segmentation Fault.

Has also happened with 2001040414.

If you use "Quit" with Mailnews recently-open instead, "Illegal instruction" is
returned.

The behaviors in bug 72588 and bug 72182 may or not be related to this one;
insufficient data to draw a solid conclusion.

Going to attach a stack trace bz made yesterday from this, as he could repeat
the behavior with 0414(And ATM I have an old GDB...Getting this fixed soon). The
trace seems to point to XPCOM, roughly, so that's what I'm filing this as.

Comment 1

[David Caswell]

Attachment: Stack trace provided by bz (Though with an optimized build)

Comment 2

[Dan M]

hyatt wants it (because of nsOutlinerBodyFrame::Destroy in the stack)

Comment 3

[Boris Zbarsky [:bzbarsky]]

ccing myself so that when I'm back home I can update my debug build and 
hopefully get some more useful info...

Comment 4

[John Morrison]

*** Bug 74956 has been marked as a duplicate of this bug. ***

Comment 5

[Boris Zbarsky [:bzbarsky]]

well, we are crashing right after:

#1  0x41f0c788 in nsCOMPtr<nsIBoxObject>::assign_from_helper (this=0xbfffecf0, 
    helper=@0xbfffece4, aIID=@0x41f5ea24)
    at ../../../../../../dist/include/nsCOMPtr.h:970
970         if ( !NS_SUCCEEDED( helper(aIID, NS_REINTERPRET_CAST(void**,
&newRawPtr)) ) )

That's all the useful info I can glean...

Comment 6

[hirata masakazu]

The same bug 74849 has been duped to bug 74944 which has been fixed.

Comment 7

[Boris Zbarsky [:bzbarsky]]

I just tried a build that includes the fix to bug 74944 (a CVS build checked out
at "Tue Apr 10 7:32:37 PDT 2001") and I still see this crash.

bug 74849 was dupped erroneously -- while it is identical to this one the stack
trace is different from that of bug 74944

ccing seth.

Comment 8

[Håkan Waara]

Mailnews ain't even *mentioned* in the stack-trace so it has nothing to do with
it. Must be some kind of regression in layout..

Why is this XPCOM? As far as I can see it's the caller to XPCOM that is
crashing, not XPCOM itself.

Comment 9

[(not reading, please use [e-mail] instead)]

*** Bug 75614 has been marked as a duplicate of this bug. ***

Comment 10

[(not reading, please use [e-mail] instead)]

laurel has found two other ways to reproduce this:

"Crash exiting when Search Msg UI open, or close search after mail closed."

Comment 11

[(not reading, please use [e-mail] instead)]

I've seen this crash on winnt. 

some info:  

hyatt and I have seen this with any RDF outliners.

waterson thinks "It looks like what is happening is
that the box object is going away without notifying the frame.

Comment 12

[John Morrison]

*** Bug 75683 has been marked as a duplicate of this bug. ***

Comment 13

[laurel]

Another way to get this is to open mail window, open a second mail window and
close the second mail window (seen on both mac and linux).  

Mac seems to be more sensitive and can crash if you have one mail window open,
open search messages or a new message compose window, open a second mail window
then close the search or compose window (both mail windows still open).

Comment 14

[J Luh]

I had a similar problem with build 2001041108 on Mac OS 9.1:

Steps to Reproduce:
1. Open Mozilla.
2. Open mail (leave Navigator window open).
3. Close mail window.
Mozilla crashes.

Comment 15

[Asa Dotzler [:asa]]

*** Bug 75669 has been marked as a duplicate of this bug. ***

Comment 16

[Peter Lubczynski]

*** Bug 74659 has been marked as a duplicate of this bug. ***

Comment 17

[scottputterman]

I was able to easily reproduce Laurel's method of opening a 2nd mail window and 
then closing it and crashing on Win2000.

Comment 18

[R.K.Aa.]

*** Bug 76081 has been marked as a duplicate of this bug. ***

Comment 19

[R.K.Aa.]

*** Bug 76082 has been marked as a duplicate of this bug. ***

Comment 20

[R.K.Aa.]

dup bug 76081 and bug 76082 describe yet two ways to achieve the same crash.
Both crash in nsCOMPtr_base::assign_from_helper
(tested with current linux CVS)

Comment 21

[[e-mail] (gone - use [e-mail] instead)]

*** Bug 74849 has been marked as a duplicate of this bug. ***

Comment 22

[David Hyatt]

All outliners crash because of a refcount bug.  I have a fix.

Comment 23

[David Hyatt]

FIxed.

Comment 24

[laurel]

FYI: So far so good -- instances of the crash I was experiencing are gone.
Using apr18 commercial trunk build, win98 and linux rh6.2 (no commercial mac
build yet)