Closed Bug 11278 Opened 25 years ago Closed 25 years ago

Crash when opening Mailnews Sidebar

Categories

(Core :: Layout, defect, P3)

x86
Windows NT
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: scottputterman, Assigned: troy)

References

Details

I get the following crash when I open the Mailnews sidebar.  It's generally only
happening when an account is open.  To reproduce:

1. Start mailnews
2. Click on a twisty next to one of your accounts to show folders
3. Close the sidebar
4. Open the sidebar and crash.

This also happens to me sometimes when hitting the close box on the title bar.

It looks like it's crashing because mFrameManager has been destroyed.

PresShell::SetPrimaryFrameFor(PresShell * const 0x0ab2b1c0, nsIContent *
0x0b476480, nsIFrame * 0x00000000) line 1872 + 23 bytes
DeletingFrameSubtree(nsIPresContext * 0x0ae85850, nsIPresShell * 0x0ab2b1c0,
nsIFrame * 0x0a707cf8, nsIFrame * 0x0a707cf8) line 4531
nsCSSFrameConstructor::RemoveMappingsForFrameSubtree(nsCSSFrameConstructor *
const 0x0ab2b2b0, nsIPresContext * 0x0ae85850, nsIFrame * 0x0a707cf8) line 4590
+ 26 bytes
nsTreeRowGroupFrame::Destroy(nsTreeRowGroupFrame * const 0x0b3189a0,
nsIPresContext & {...}) line 84
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x0b30d8a0, nsIPresContext &
{...}) line 88
nsTableFrame::Destroy(nsTableFrame * const 0x0b30d8a0, nsIPresContext & {...})
line 368
nsTreeFrame::Destroy(nsTreeFrame * const 0x0b30d8a0, nsIPresContext & {...})
line 284
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x0b30c030, nsIPresContext &
{...}) line 88
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x0b318610) line
158
nsBlockFrame::Destroy(nsBlockFrame * const 0x0b309f90, nsIPresContext & {...})
line 822 + 16 bytes
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x011d6dd8, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x0b308c30, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x0b304050, nsIPresContext &
{...}) line 88
ViewportFrame::Destroy(ViewportFrame * const 0x0b304050, nsIPresContext & {...})
line 131
PresShell::~PresShell() line 479
PresShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes
PresShell::Release(PresShell * const 0x0ab2b1c0) line 410 + 34 bytes
nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 474
DocumentViewerImpl::~DocumentViewerImpl() line 295 + 22 bytes
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x0ae831d0) line 237 + 99
bytes
nsWebShell::Destroy(nsWebShell * const 0x0aee9d90) line 1136 + 27 bytes
nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame() line 474
nsHTMLFrameInnerFrame::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsFrame::Destroy(nsFrame * const 0x0aeeaf80, nsIPresContext & {...}) line 413 +
34 bytes
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x0ae195d0, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x01180170, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x01179018, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x0118a290, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x0ae0e3b0, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x0ae00960, nsIPresContext &
{...}) line 88
ViewportFrame::Destroy(ViewportFrame * const 0x0ae00960, nsIPresContext & {...})
line 131
PresShell::~PresShell() line 479
PresShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes
PresShell::Release(PresShell * const 0x0ad507f0) line 410 + 34 bytes
nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 474
DocumentViewerImpl::~DocumentViewerImpl() line 295 + 22 bytes
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x0ad4f470) line 237 + 99
bytes
nsWebShell::Embed(nsWebShell * const 0x0ab20e40, nsIContentViewer * 0x0b488690,
const char * 0x0b483fa0, nsISupports * 0x00000000) line 916 + 27 bytes
nsDocumentBindInfo::OnStartRequest(nsDocumentBindInfo * const 0x0b486e30,
nsIChannel * 0x0b486c80, nsISupports * 0x00000000) line 1945 + 36 bytes
nsOnStartRequestEvent::HandleEvent(nsOnStartRequestEvent * const 0x0b489810)
line 212
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x0b489814) line 149 + 12 bytes
PL_HandleEvent(PLEvent * 0x0b489814) line 509 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00f1b290) line 470 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0246092e, unsigned int 49307, unsigned int 0,
long 15839888) line 932 + 9 bytes
USER32! 77e71250()
00f1b290()
Status: NEW → ASSIGNED
Target Milestone: M9
I don't even know what the frame manager is.  I'm assuming Troy might have
changed something?  cc'ing him.
It's really hyatt's fault (of course :-). Seems that while we're destroying the
entire frame hierarchy he's calling into the frame construction code which
triggers a call into the pres shell (which is in the middle of the destructor)
which refernces the now destroyed frame manager
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
I intentionally destroyed the frame manager before destroying the frame model so
we wouldn't have the overhead of removing frames from the content->frame map.

I should have added a NULL pointer check in SetPrimaryFrameFor() and
SetPlaceholderFrameFor(), which I carelessly forgot about so I'm adding it now
QA Contact: petersen → lchiang
Lisa,



I'm not sure why I was assigned as QA contact for this mailnews crash. Could you

have one of your expert mail QA engineers check to see if this crash is fixed ?
*** Bug 11339 has been marked as a duplicate of this bug. ***
QA Contact: lchiang → nbaca
nbaca - can you verify? Thanks.
Status: RESOLVED → VERIFIED
Build 1999112208M12: NT4
Verified Fixed. Also checked Linux and Mac and they do not crash either.
You need to log in before you can comment on or make changes to this bug.