83753 - Crash backspacing in mail autocomplete widget

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect)

Description

[Phil Peterson]

Using 2001-05-31-04 commercial release build on NT

1. Open mail compose window
2. Type an address which doesn't auto-complete to anything
3. Hit return
4. Begin typing an address which does autocomplete
5. Use backspace key repeatedly, more times than necessary to erase the address
6. Boom

Will attach stack trace when talkback server comes up

Comment 1

[Håkan Waara]

I reliably crash with Phil's reproducable steps in a build from today. Here is 
the stack:

nsPopupSetFrame::ActivatePopup(int 0) line 618 + 27 bytes
nsPopupSetFrame::HidePopup(nsPopupSetFrame * const 0x02ace0ec) line 490
nsMenuPopupFrame::HideChain(nsMenuPopupFrame * const 0x02ace278) line 1246
nsMenuDismissalListener::Rollup(nsMenuDismissalListener * const 0x051e69e8) 
line 90
nsWindow::Destroy(nsWindow * const 0x051e3174) line 1226
nsView::~nsView() line 158
nsView::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsView::Destroy(nsView * const 0x051e32b0) line 254 + 34 bytes
nsFrame::Destroy(nsFrame * const 0x02ace1fc, nsIPresContext * 0x03cc3530) line 
428
nsContainerFrame::Destroy(nsContainerFrame * const 0x02ace1fc, nsIPresContext * 
0x03cc3530) line 120
nsBoxFrame::Destroy(nsBoxFrame * const 0x02ace1fc, nsIPresContext * 0x03cc3530) 
line 1008 + 13 bytes
nsMenuPopupFrame::Destroy(nsMenuPopupFrame * const 0x02ace1fc, nsIPresContext * 
0x03cc3530) line 1397
nsFrameList::DestroyFrames(nsIPresContext * 0x03cc3530) line 116
nsPopupSetFrame::Destroy(nsPopupSetFrame * const 0x02ace070, nsIPresContext * 
0x03cc3530) line 220
nsFrameList::DestroyFrames(nsIPresContext * 0x03cc3530) line 116
nsContainerFrame::Destroy(nsContainerFrame * const 0x02ae443c, nsIPresContext * 
0x03cc3530) line 119
nsBoxFrame::Destroy(nsBoxFrame * const 0x02ae443c, nsIPresContext * 0x03cc3530) 
line 1008 + 13 bytes
nsMenuFrame::Destroy(nsMenuFrame * const 0x02ae443c, nsIPresContext * 
0x03cc3530) line 271
nsFrameList::DestroyFrame(nsIPresContext * 0x03cc3530, nsIFrame * 0x02ae443c) 
line 202
nsBoxFrame::RemoveFrame(nsBoxFrame * const 0x049a1a68, nsIPresContext * 
0x03cc3530, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x02ae443c) 
line 1063
FrameManager::RemoveFrame(FrameManager * const 0x03cc5ab0, nsIPresContext * 
0x03cc3530, nsIPresShell & {...}, nsIFrame * 0x049a1a68, nsIAtom * 0x00000000, 
nsIFrame * 0x02ae443c) line 899
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x03cc4970, 
nsIPresContext * 0x03cc3530, nsIContent * 0x0519bd00, nsIContent * 0x0519bb50, 
int 0) line 9230 + 58 bytes
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x03cc4a30, nsIPresContext * 
0x03cc3530, nsIContent * 0x0519bd00, nsIContent * 0x0519bb50, int 0) line 1123
PresShell::ContentRemoved(PresShell * const 0x03cc45c8, nsIDocument * 
0x03cc2910, nsIContent * 0x0519bd00, nsIContent * 0x0519bb50, int 0) line 4904 
+ 53 bytes
nsXULDocument::ContentRemoved(nsXULDocument * const 0x03cc2910, nsIContent * 
0x0519bd00, nsIContent * 0x0519bb50, int 0) line 1746
nsXULElement::RemoveChildAt(nsXULElement * const 0x0519bd00, int 0, int 1) line 
2766
nsXULElement::RemoveChild(nsXULElement * const 0x0519bd04, nsIDOMNode * 
0x0519bb54, nsIDOMNode * * 0x006ed170) line 1199 + 22 bytes
XPTC_InvokeByIndex(nsISupports * 0x0519bd04, unsigned int 17, unsigned int 2, 
nsXPTCVariant * 0x006ed160) line 139
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
CALL_METHOD) line 1835 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x03cb8900, JSObject * 0x02989330, unsigned int 
1, long * 0x02b27828, long * 0x006ed368) line 1241 + 14 bytes
js_Invoke(JSContext * 0x03cb8900, unsigned int 1, unsigned int 0) line 807 + 23 
bytes
js_Interpret(JSContext * 0x03cb8900, long * 0x006edc14) line 2702 + 15 bytes
js_Invoke(JSContext * 0x03cb8900, unsigned int 1, unsigned int 2) line 824 + 13 
bytes
js_InternalInvoke(JSContext * 0x03cb8900, JSObject * 0x02989338, long 43559896, 
unsigned int 0, unsigned int 1, long * 0x006eddf4, long * 0x006edd44) line 896 
+ 20 bytes
JS_CallFunctionValue(JSContext * 0x03cb8900, JSObject * 0x02989338, long 
43559896, unsigned int 1, long * 0x006eddf4, long * 0x006edd44) line 3320 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x03cb8ab0, void * 
0x02989338, void * 0x0298abd8, unsigned int 1, void * 0x006eddf4, int * 
0x006eddf0, int 0) line 934 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x0519b780, 
nsIDOMEvent * 0x051ed4a4) line 139 + 58 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0519b700, 
nsIDOMEvent * 0x051ed4a4, nsIDOMEventTarget * 0x0519bb58, unsigned int 1, 
unsigned int 2) line 1119 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x0519b7d0, 
nsIPresContext * 0x03cc3530, nsEvent * 0x006ef580, nsIDOMEvent * * 0x006ef05c, 
nsIDOMEventTarget * 0x0519bb58, unsigned int 2, nsEventStatus * 0x006ef4ec) 
line 1580 + 36 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0519bb50, nsIPresContext * 
0x03cc3530, nsEvent * 0x006ef580, nsIDOMEvent * * 0x006ef05c, unsigned int 2, 
nsEventStatus * 0x006ef4ec) line 3631
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0519fa50, nsIPresContext * 
0x03cc3530, nsEvent * 0x006ef580, nsIDOMEvent * * 0x006ef05c, unsigned int 2, 
nsEventStatus * 0x006ef4ec) line 3648 + 53 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0519f5b0, nsIPresContext * 
0x03cc3530, nsEvent * 0x006ef580, nsIDOMEvent * * 0x006ef05c, unsigned int 2, 
nsEventStatus * 0x006ef4ec) line 3648 + 53 bytes
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x0519f3c0, 
nsIPresContext * 0x03cc3530, nsEvent * 0x006ef580, nsIDOMEvent * * 0x006ef05c, 
unsigned int 1, nsEventStatus * 0x006ef4ec) line 1695 + 53 bytes
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x0519f3c0, 
nsIPresContext * 0x03cc3530, nsEvent * 0x006ef580, nsIDOMEvent * * 0x00000000, 
unsigned int 1, nsEventStatus * 0x006ef4ec) line 1078 + 29 bytes
PresShell::HandleEventInternal(nsEvent * 0x006ef580, nsIView * 0x0503b9b0, 
unsigned int 1, nsEventStatus * 0x006ef4ec) line 5513 + 47 bytes
PresShell::HandleEvent(PresShell * const 0x03cc45c4, nsIView * 0x0503b9b0, 
nsGUIEvent * 0x006ef580, nsEventStatus * 0x006ef4ec, int 0, int & 1) line 5440 
+ 25 bytes
nsView::HandleEvent(nsView * const 0x0503b9b0, nsGUIEvent * 0x006ef580, 
unsigned int 8, nsEventStatus * 0x006ef4ec, int 0, int & 1) line 377
nsView::HandleEvent(nsView * const 0x0503bf70, nsGUIEvent * 0x006ef580, 
unsigned int 8, nsEventStatus * 0x006ef4ec, int 0, int & 1) line 350
nsView::HandleEvent(nsView * const 0x03cc4c80, nsGUIEvent * 0x006ef580, 
unsigned int 28, nsEventStatus * 0x006ef4ec, int 1, int & 1) line 350
nsViewManager::DispatchEvent(nsViewManager * const 0x03cc4e20, nsGUIEvent * 
0x006ef580, nsEventStatus * 0x006ef4ec) line 2051
HandleEvent(nsGUIEvent * 0x006ef580) line 68
nsWindow::DispatchEvent(nsWindow * const 0x0503bc94, nsGUIEvent * 0x006ef580, 
nsEventStatus & nsEventStatus_eIgnore) line 712 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x006ef580) line 733
nsWindow::DispatchKeyEvent(unsigned int 133, unsigned short 0, unsigned int 8) 
line 2380 + 15 bytes
nsWindow::OnKeyDown(unsigned int 8, unsigned int 16398) line 2411 + 25 bytes
nsWindow::ProcessMessage(unsigned int 256, unsigned int 8, long 1074659329, 
long * 0x006ef994) line 3114 + 32 bytes
nsWindow::WindowProc(HWND__ * 0x00000718, unsigned int 256, unsigned int 8, 
long 1074659329) line 979 + 27 bytes
KERNEL32! bff7363b()
KERNEL32! bff94407()
006e8a1a()

Comment 2

[Phil Peterson]

cc pinkerton and rods based on the code in that stack trace. Guys, please take a
look and comment on a good owner for this bug.

Comment 3

[scottputterman]

Putting on the 0.9.1 radar, if whoever ends up owning this bug disagrees please
remove it, but it seems pretty easy to hit and I think should be in 0.9.1.  I
could also reproduce it following Phil's steps.

I'm going to start off with pinkerton but from phil's comments it sounds like it
could also be rods.  Adding ducarroz and hewitt to cc.

Comment 4

[Phil Peterson]

Maybe related to bug 83448

Comment 5

[Mike Pinkerton (not reading bugmail)]

oh lordy. i'll look into it.

Comment 6

[Mike Pinkerton (not reading bugmail)]

i tracked this down to my checkin to fix the previous topcrasher, and while it
shouldn't crash, this code shouldn't be getting called.

it happens that if you backspace fast enough, the XBL doesn't call
nsPopupBoxObject::DestroyPopup(). This trips my code, which fires if the popup
is destroyed but it hasn't correctly unregistered. It is getting destroyed as a
result of some content node being removed from JS/XBL.

--> hewitt. I think this is his baby. I'll add a null check to the popupSetFrame
where it's crashing so my failsafe continues to work.

Comment 7

[Mike Pinkerton (not reading bugmail)]

Attachment: [patch] don't crash when we're cleaning up after someone, not the real fix

Comment 8

[Mike Pinkerton (not reading bugmail)]

my patch, while not the correct fix, will plug one crash when things go wrong. i
left in an assertion so people know when they don't correctly dispose of the
popup. it does seem to stop it from crashing on my win32 build.

can i get r/s/a for this for the trunk? it's a good safety check regardless of
its value to this particular bug. 

Comment 9

[Phil Peterson]

Mike, you're going to check in to the 0.9.1 branch, too, right?

Comment 10

[Mike Pinkerton (not reading bugmail)]

i'll land on the branch if i get r/sr/a for my bandaid. ;)

Comment 11

[David Hyatt]

sr=hyatt

Comment 12

[Mike Pinkerton (not reading bugmail)]

r=pchen. now i just need a=

Comment 13

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to the 0.9.1 branch and the trunk!
(on behalf of drivers)

Comment 14

[Mike Pinkerton (not reading bugmail)]

band-aid on trunk and branch. all yours hewitt! ;)

Comment 15

[selmer (gone)]

Can we close this to get verifications and open a new bug for the follow-on work?

Comment 16

[chris hofmann]

Marking fixed so it gets verfied on the branch.
Open a new one if needed for additional work needed on the trunk.
Any reason why this should not go on the trunk as a partial fix?

Comment 17

[selmer (gone)]

(or was this already checked in on the trunk as well?)

Comment 18

[Mike Pinkerton (not reading bugmail)]

this was checked into both the trunk and the branch (as my comment said
previously). A new bug needs to be opened to hewitt on work that should be done
on the trunk.

Comment 19

[Sheela Ravindran]

Saw the crash on 06-03 build before verifying.  
verified this bug on suresh's NT machine on branch build WindowNT-2001-06-05-09. 
Still need to verify this on trunk build.  

Comment 20

[John Morrison]

Filed http://bugzilla.mozilla.org/show_bug.cgi?id=84265 to hewitt 
for the remaining issues.

Comment 21

[fenella]

Win32 (2001-07-31-06 trunk)
I cannot re-produce this problem.