150893 - Crash when changing pref [@ nsQueryInterface::operator]

Status: VERIFIED DUPLICATE of bug 156486

(Core :: XUL, defect)

Description

[Brad Clarke]

Mozilla 1.0
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.0) Gecko/20020530

Open the Sidebar (press F9) (had the bugzilla sidebar open, so this -could- be a
bugzilla issue? general sidebar issue?)
From the menu, Edit; Preferences
In the tree view, Select Appearance; Colors
Press the button for the background color and change the color (defaulted to
white, I changed to the grey just below it)
Press OK

Result: *boom*

Comment 1

[Brian Nesse (gone)]

->FE

Comment 2

[Olivier Cahagne]

confirming using build 2002061104 on Win2k (trunk).
Talkback ID: TB7240113W.

Comment 3

[[e-mail] (gone - use [e-mail] instead)]

nsQueryInterface::operator() [nsCOMPtr.cpp, line 52] 
nsCOMPtr_base::assign_from_helper [nsCOMPtr.cpp, line 81] 
nsCSSFrameConstructor::ConstructXULFrame [nsCSSFrameConstructor.cpp, line 5806] 
nsCSSFrameConstructor::ConstructFrameInternal [nsCSSFrameConstructor.cpp, line 
7326] 
nsCSSFrameConstructor::ConstructFrame [nsCSSFrameConstructor.cpp, line 7201] 
nsCSSFrameConstructor::CreateAnonymousFrames [nsCSSFrameConstructor.cpp, line 
5177] 
nsCSSFrameConstructor::CreateAnonymousFrames [nsCSSFrameConstructor.cpp, line 
5115] 
nsCSSFrameConstructor::ConstructDocElementFrame [nsCSSFrameConstructor.cpp, 
line 3444] 
nsCSSFrameConstructor::ReconstructDocElementHierarchy 
[nsCSSFrameConstructor.cpp, line 7467] 
StyleSetImpl::ReconstructDocElementHierarchy [nsStyleSet.cpp, line 1519] 
PresShell::ReconstructFrames [nsPresShell.cpp, line 5363] 
PresShell::SetPreferenceStyleRules [nsPresShell.cpp, line 2246] 
nsPresContext::PreferenceChanged [nsPresContext.cpp, line 617] 
nsPresContext::PrefChangedCallback [nsPresContext.cpp, line 103] 
pref_DoCallback [prefapi.cpp, line 1165] 
pref_HashPref [prefapi.cpp, line 1051] 
PREF_SetCharPref [prefapi.cpp, line 531] 
nsPrefBranch::SetCharPref [nsPrefBranch.cpp, line 230] 
nsPrefBranch::SetComplexValue [nsPrefBranch.cpp, line 489] 
nsPrefService::SetComplexValue [nsPrefService.h, line 57] 
nsPref::SetUnicharPref [nsPref.cpp, line 427] 
XPTC_InvokeByIndex [xptcinvoke.cpp, line 106] 
XPCWrappedNative::CallMethod [xpcwrappednative.cpp, line 1996] 
XPC_WN_CallMethod [xpcwrappednativejsops.cpp, line 1267] 
js_Invoke [jsinterp.c, line 790] 
js_Interpret [jsinterp.c, line 2744] 
js_Invoke [jsinterp.c, line 806] 
js_InternalInvoke [jsinterp.c, line 881] 
JS_CallFunctionValue [jsapi.c, line 3426] 
nsJSContext::CallEventHandler [nsJSEnvironment.cpp, line 1045] 
GlobalWindowImpl::RunTimeout [nsGlobalWindow.cpp, line 4515] 
GlobalWindowImpl::TimerCallback [nsGlobalWindow.cpp, line 4862] 
nsTimerImpl::Fire [nsTimerImpl.cpp, line 345] 
nsTimerManager::FireNextIdleTimer [nsTimerImpl.cpp, line 593] 
nsAppShell::Run [nsAppShell.cpp, line 134] 
nsAppShellService::Run [nsAppShellService.cpp, line 451] 
main1 [nsAppRunner.cpp, line 1472] 
main [nsAppRunner.cpp, line 1808] 
WinMain [nsAppRunner.cpp, line 1826] 
WinMainCRTStartup() 
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 4

[Olivier Cahagne]

Only related bug: bug 114043. Thus reassigning to XP Toolkit/Widgets: XUL.

Comment 5

[timeless]

.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Did you have scc's nsEngineer panel displayed?  If so (and perhaps even if not),
this is a duplicate of bug 136513.

Comment 7

[Olivier Cahagne]

I had Google, a Cisco internal panel and the History panel in my Sidebar. I've
never installed nsEngineer panel.

Comment 8

[Brad Clarke]

The only sidebar I had installed at the time was the bugzilla one from 2.16.rc1

I did however reproduce the crash by chaning the font mentioned in bug 136513 
using only the bugzilla sidebar so it probably is either the same bug or 
closely related

Comment 9

[Boris Zbarsky [:bzbarsky]]

*** Bug 155924 has been marked as a duplicate of this bug. ***

Comment 10

[Matthias Versen [:Matti]]

*** Bug 157029 has been marked as a duplicate of this bug. ***

Comment 11

[Koike Kazuhiko]

The latest Linux build from CVS crashed.

Steps to reproduce:
(1) Access to <http://ajisai.sakura.ne.jp/~morning/>.
(2) Change minimum font size twice.

**************************************************
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (runnable)]
0x4020a5e6 in nsQueryInterface::operator() (this=0xbfffe664, aIID=@0x41a81ca0, 
    answer=0xbfffe63c) at nsCOMPtr.cpp:47
47			status = mRawPtr->QueryInterface(aIID, answer);
(gdb) bt
#0  0x4020a5e6 in nsQueryInterface::operator() (this=0xbfffe664, 
    aIID=@0x41a81ca0, answer=0xbfffe63c) at nsCOMPtr.cpp:47
#1  0x41a4b2da in nsCOMPtr<nsIDocShellTreeItem>::assign_from_helper (
    this=0xbfffe670, helper=@0xbfffe664, aIID=@0x41a81ca0)
    at ../../../../dist/include/xpcom/nsCOMPtr.h:922
#2  0x419af5a1 in nsPresContext::PreferenceChanged (this=0x90684a8, 
    aPrefName=0x8ac45b0 "font.minimum-size.ja")
    at ../../../dist/include/xpcom/nsCOMPtr.h:565
#3  0x419acaa0 in nsPresContext::PrefChangedCallback (
    aPrefName=0x8ac45b0 "font.minimum-size.ja", instance_data=0x90684a8)
    at nsPresContext.cpp:101
#4  0x407f8928 in pref_DoCallback (
    changed_pref=0x8ac45b0 "font.minimum-size.ja") at prefapi.cpp:1187
#5  0x407f86f6 in pref_HashPref (key=0x8ac45b0 "font.minimum-size.ja", value=
      {stringVal = 0xe <Address 0xe out of bounds>, intVal = 14, boolVal = 14},
type=PREF_INT, action=PREF_SETUSER) at prefapi.cpp:1073
#6  0x407f79c7 in PREF_SetIntPref (pref_name=0x8ac45b0 "font.minimum-size.ja", 
    value=14) at prefapi.cpp:560
#7  0x407ed612 in nsPrefBranch::SetIntPref (this=0x811eba0, 
    aPrefName=0x8ac45b0 "font.minimum-size.ja", aValue=14)
    at nsPrefBranch.cpp:257
#8  0x407f5b30 in nsPrefService::SetIntPref (this=0x811eb70, 
    aPrefName=0x8ac45b0 "font.minimum-size.ja", aValue=14)
    at nsPrefService.h:57
#9  0x407e9ea1 in nsPref::SetIntPref (this=0x813eda8, 
    aPrefName=0x8ac45b0 "font.minimum-size.ja", aValue=14) at nsPref.cpp:244
#10 0x401e5e08 in XPTC_InvokeByIndex () at xptcinvoke_gcc_x86_unix.cpp:86
#11 0x406d9dbe in XPCWrappedNative::CallMethod (ccx=@0xbfffe9b8, 
    mode=CALL_METHOD) at xpcwrappednative.cpp:1994
#12 0x406e2abb in XPC_WN_CallMethod (cx=0x93f8f58, obj=0x926b8e8, argc=2, 
    argv=0x94fd948, vp=0xbfffeabc) at xpcwrappednativejsops.cpp:1266
#13 0x400a36f2 in js_Invoke (cx=0x93f8f58, argc=2, flags=0) at jsinterp.c:838
#14 0x400adfd7 in js_Interpret (cx=0x93f8f58, result=0xbfffefec)
    at jsinterp.c:2791
#15 0x400a3753 in js_Invoke (cx=0x93f8f58, argc=2, flags=2) at jsinterp.c:855
#16 0x400a39ac in js_InternalInvoke (cx=0x93f8f58, obj=0x8d18a40, 
    fval=138539184, flags=0, argc=2, argv=0x9425b18, rval=0xbffff14c)
    at jsinterp.c:930
#17 0x400814bb in JS_CallFunctionValue (cx=0x93f8f58, obj=0x8d18a40, 
    fval=138539184, argc=2, argv=0x9425b18, rval=0xbffff14c) at jsapi.c:3428
#18 0x40c72a83 in nsJSContext::CallEventHandler (this=0x93f9320, 
    aTarget=0x8d18a40, aHandler=0x841f0b0, argc=2, argv=0x9425b18, 
    aBoolResult=0xbffff210, aReverseReturnResult=0) at nsJSEnvironment.cpp:1040
#19 0x40c93111 in GlobalWindowImpl::RunTimeout (this=0x93f9188, 
    aTimeout=0x93536b0) at nsGlobalWindow.cpp:4585
#20 0x40c9418c in GlobalWindowImpl::TimerCallback (aTimer=0x95a36d0, 
    aClosure=0x93536b0) at nsGlobalWindow.cpp:4933
#21 0x401c53ec in nsTimerImpl::Fire (this=0x95a36d0) at nsTimerImpl.cpp:342
#22 0x401c578b in handleTimerEvent (event=0x42301360) at nsTimerImpl.cpp:403
#23 0x401bcd22 in PL_HandleEvent (self=0x42301360) at plevent.c:596
#24 0x401bcbb7 in PL_ProcessPendingEvents (self=0x80fd120) at plevent.c:526
#25 0x401beba8 in nsEventQueueImpl::ProcessPendingEvents (this=0x80fd0d8)
    at nsEventQueue.cpp:388
#26 0x409d269f in event_processor_callback (data=0x80fd0d8, source=7, 
    condition=GDK_INPUT_READ) at nsAppShell.cpp:184
#27 0x409d231d in our_gdk_io_invoke (source=0x83391b8, condition=G_IO_IN, 
    data=0x84c5bc8) at nsAppShell.cpp:77
#28 0x404218da in g_io_unix_dispatch (source_data=0x8399338, 
    current_time=0xbffff4c0, user_data=0x84c5bc8) at giounix.c:135
#29 0x40422f96 in g_main_dispatch (dispatch_time=0xbffff4c0) at gmain.c:656
#30 0x40423561 in g_main_iterate (block=1, dispatch=1) at gmain.c:877
#31 0x40423701 in g_main_run (loop=0x8268bd0) at gmain.c:935
#32 0x40349cf9 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#33 0x409d306c in nsAppShell::Run (this=0x815d5b0) at nsAppShell.cpp:332
#34 0x4098e22a in nsAppShellService::Run (this=0x8165a78)
    at nsAppShellService.cpp:451
#35 0x08057fab in main1 (argc=1, argv=0xbffff674, nativeApp=0x8094aa0)
    at nsAppRunner.cpp:1518
#36 0x08058be5 in main (argc=1, argv=0xbffff674) at nsAppRunner.cpp:1878
#37 0x4051d98b in __libc_start_main (main=0x8058a5c <main>, argc=1, 
    argv=0xbffff674, init=0x804e894 <_init>, fini=0x805cfcc <_fini>, 
    rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff66c)
    at ../sysdeps/generic/libc-start.c:92

Comment 12

[Koike Kazuhiko]

2002092308-trunk/Linux doesn't crash.

Comment 13

[FZiegler]

Just got the same crash on OS X trunk build 2002-09-19-08, while changing the
Font preference. Stack trace (attached below) is the same as in comment 11, and
in attachments to bug 156486 and bug 160656. Aren't these dupes of this one?

Comment 14

[FZiegler]

Attachment: Stack trace

Comment 15

[Alexandru Savulov]

is anyone working on this right now, cause i'm working on bug 156486.

Comment 16

[Alexandru Savulov]

dupe. will move CC the people from this report on 156486.

*** This bug has been marked as a duplicate of 156486 ***

Comment 17

[timeless]

vrfy dupe