165446 - Ctrl-double-click many items causes crash

Status: RESOLVED WORKSFORME

(SeaMonkey :: MailNews: Message Display, defect)

Description

[James Rome]

In the 8/28 build, I tried to clean out my IMAP inbox by ordering by sender, and
then Ctrl-clicking to select the items I want to delete.

After selecting enough items (~30), Mozilla always crashes.

Comment 1

[laurel]

Worksforme with aug29 commercial trunk build, linux rh6.2 and win98.

Comment 2

[James Rome]

You have to keep clicking. It might also be related to the speed between clicks.
Get to a point where the messages are all highlighted, and keep ctrl-clicking
the bottom message so it scrolls. 

it crashes every time for me if I ctrl-click enough messages.

Comment 3

[James Rome]

I deleted over a thousand mail messages today and it crashed 4 times without
triggering the feedback agent....

Comment 4

[Andrew Schultz]

I think what you are seeing is:
1. select a message
2. ctrl-double-click another message
=> seg fault, talkback doesn't catch it

debug/optimized CVS does not crash

the regression here between linux trunk builds 2002050121 and 2002050221
1.0.1rc2 works fine.

using shift instead of ctrl also crashes

Comment 5

[James Rome]

You are probably right. When selecting a lot of messages, the clicks get close
together. Thanks for verifying this.

Comment 6

[Andrew Schultz]

I still don't crash with CVS, but I've gotten the rather unusual behavior (at
least once) that if I select one message and then ctrl-double-click another, the
CVS build sometimes opens both messages in windows with gargantuan dimensions,
approximately 10x my screen size (~13000 pixels wide at least, considerably
taller than my screen size as well).

Comment 7

[Andrew Schultz]

Attachment: stacktrace from egcs/CVS build

stack shows fun with recursion.  the recursion goes down to at least frame
20000.
the fun ends when it calls gdk_superwin_resize (instead of OnResize)

note that the window dimensions get bigger every cycle.

Comment 8

[Andrew Schultz]

Attachment: "full" stacktrace

I think I should get a prize for longest stacktrace.  :)

(gdb) frame 136349
#136349 0x40876589 in DocumentViewerImpl::SizeToContent (this=0x8696db0) at
nsDocumentViewer.cpp:2717
2717	   NS_ENSURE_SUCCESS(treeOwner->SizeShellTo(docShellAsItem, width+1,
height),
Current language:  auto; currently c++
(gdb) p width
$1 = 53687092
(gdb) p height
$2 = 53687092
(gdb) p pixelScale
$3 = 0.0500000007
(gdb) p shellArea
$4 = {x = 0, y = 0, width = 1073741824, height = 1073741824}

Comment 9

[Andrew Schultz]

ok, the dimensions are whacky because:
1. DocumentViewerImpl::SizeToContent() is called.  it calls 
   presShell->ResizeReflow(NS_UNCONSTRAINEDSIZE,NS_UNCONSTRAINEDSIZE)
   (NS_UNCONSTRAINED = NS_MAXSIZE = 2^30)
2. in ResizeReflow, mFrameManager->GetRootFrame sets rootFrame to null, so the
   dimensions stay at 2^30

If i double click on a message (without control or shift), SizeToContent is not
called.  In fact, after doing so, SizeToContent is not called even when using
control or shift.  So, if you can't reproduce this bug, try a clean profile.

And James: if you want this bug to go away, double click on a single message...
it might just work.

Comment 10

[Andrew Schultz]

I'm seeing a crash with CVS/gcc now as well, except that it dies with a gdk error.

Comment 11

[Olivier Cahagne]

*** Bug 186761 has been marked as a duplicate of this bug. ***

Comment 12

[Patrick Reiter Horn]

This bug is still around in Thunderbird 0.5, and all it takes is to ctrl-double
click a message after selecting another message.
Steps:
1. Click on one message
2. Hold down cntl
3. Click rapidly on another message or two (make sure not to drag mouse in the
process)
4. Crash

It seems that this bug gets worse when it interepets clicking quickly on two
different messages (once on one message, and another on another message within
the double-click time) as a double-click on the first message, therefore causing
this crash to happen. (And if it didn't crash then, then it would cause 100 or
so messages to pop up, which is as bad as a crash.)

The crash happens in Thunderbird 0.5 glibc2.2.x build, Linux Debian wodoy
(2.4.18-bf2.4 kernel)

But, it does not happen in Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.0)
Gecko/20020623 Debian/1.0.0-0.woody.1

Comment 13

[Andrew Schultz]

This was probably the same backend problem as bug 205530.  What I get now is a single window open properly and the rest open with size 0 (or 1) pixel.

Comment 14

[James Rome]

In Seamonkey 1.0, I get the same results as Andrew.The second window just opens with the top bar.
I see this behavior sometimes in the browser as well....
Why hasn't this been fixed in 4 years??

Comment 15

[Wayne Mery (:wsmwk)]

Tony do you see this?


James in comment #14:
> In Seamonkey 1.0, I get the same results as Andrew.The second window just opens
> with the top bar.
> I see this behavior sometimes in the browser as well....
> Why hasn't this been fixed in 4 years??

different bug#

Comment 16

[Tony Mechelynck [:tonymec]]

(In reply to comment #15)
> Tony do you see this?

Not AFAICT but all my mail accounts are POP3 (plus one Movemail and one RSS). IIRC, Bienvenu uses IMAP a lot.

Comment 17

[David :Bienvenu]

this bug is ancient, and looks very much like a core bug, so it's very possible it's been fixed in gecko 1.9 or 1.9.1

Comment 18

[Wayne Mery (:wsmwk)]

I used SM til 07, and didn't see this at that time, so => WFM

James, please comment if by chance you still see the problem using a current build

Comment 19

[James Rome]

I gave up on SeaMonkey