27525 - Crash in nsCOMPtr_base::~nsCOMPtr_base when clicking in tree

Status: VERIFIED WORKSFORME

(Core :: XUL, defect, P3)

Description

[Richard Zach]

I'm crashing on Linux comm build 2000.02.12.11 whenever I select a tree
element.  

To reproduce:
1. Edit | Preferences
2. select Navigator

Actual result: crash
Expected result: Navigator preferences displayed on right

Same thing happens in MailNews when selecting a folder in the account pane, or
when selecting a card in the address book.

Program received signal SIGSEGV, Segmentation fault.
0x40104caa in nsCOMPtr_base::~nsCOMPtr_base ()
(gdb) where
#0  0x40104caa in nsCOMPtr_base::~nsCOMPtr_base ()
#1  0x40ce9b5e in NSGetModule ()
#2  0x40cefb1d in NSGetModule ()
#3  0x40cef9e6 in NSGetModule ()
#4  0x40bb1d62 in NSGetModule ()
#5  0x41071a34 in NSGetModule ()
#6  0x410719e0 in NSGetModule ()
#7  0x4107ab9a in NSGetModule ()
#8  0x4107058d in NSGetModule ()
#9  0x404e50ba in nsWidget::DispatchEvent ()
#10 0x404e4fe5 in nsWidget::DispatchWindowEvent ()
#11 0x404e5140 in nsWidget::DispatchMouseEvent ()
#12 0x404e5d9a in nsWidget::OnButtonPressSignal ()
#13 0x404e907f in nsWindow::HandleGDKEvent ()
#14 0x404db8da in handle_gdk_event ()
#15 0x4063e5cb in gdk_event_dispatch ()
#16 0x4066cbe6 in g_main_dispatch ()
#17 0x4066d1a1 in g_main_iterate ()
#18 0x4066d254 in g_main_iteration ()
#19 0x404d369d in nsAppShell::DispatchNativeEvent ()
#20 0x40410187 in NSGetModule ()
#21 0x40415868 in NSGetModule ()
#22 0x40415848 in NSGetModule ()
---Type <return> to continue, or q <return> to quit---
#23 0x4040c56a in NSGetModule ()
#24 0x4035d12a in GlobalWindowImpl::OpenInternal ()
#25 0x4035a35d in GlobalWindowImpl::OpenDialog ()
#26 0x403527a1 in NS_CreateScriptContext ()
#27 0x4006144a in js_Invoke ()
#28 0x40067c7e in js_Interpret ()
#29 0x40061495 in js_Invoke ()
#30 0x40067c7e in js_Interpret ()
#31 0x40061495 in js_Invoke ()
#32 0x4006167c in js_InternalInvoke ()
#33 0x4004965f in JS_CallFunctionValue ()
#34 0x4034c85e in nsJSContext::CallEventHandler ()
#35 0x4037a4df in nsJSEventListener::HandleEvent ()
#36 0x40b7c878 in NSGetModule ()
#37 0x40b7db1e in NSGetModule ()
#38 0x4083080c in NSGetModule ()
#39 0x40cfb1e4 in NSGetModule ()
#40 0x40cf92e7 in NSGetModule ()
#41 0x40bb1d62 in NSGetModule ()
#42 0x41071a34 in NSGetModule ()
#43 0x410719e0 in NSGetModule ()
#44 0x4107ab9a in NSGetModule ()
#45 0x4107058d in NSGetModule ()
---Type <return> to continue, or q <return> to quit---
#46 0x404e50ba in nsWidget::DispatchEvent ()
#47 0x404e4fe5 in nsWidget::DispatchWindowEvent ()
#48 0x404e5140 in nsWidget::DispatchMouseEvent ()
#49 0x404e5ea1 in nsWidget::OnButtonReleaseSignal ()
#50 0x404e907f in nsWindow::HandleGDKEvent ()
#51 0x404db8da in handle_gdk_event ()
#52 0x4063e5cb in gdk_event_dispatch ()
#53 0x4066cbe6 in g_main_dispatch ()
#54 0x4066d1a1 in g_main_iterate ()
#55 0x4066d341 in g_main_run ()
#56 0x40592859 in gtk_main ()
#57 0x404d362a in nsAppShell::Run ()
#58 0x40411a62 in NSGetModule ()
#59 0x804a980 in JS_PushArguments ()
#60 0x804ad0c in JS_PushArguments ()
#61 0x4021dcb3 in __libc_start_main (main=0x804ab08 <JS_PushArguments+5956>, 
    argc=1, argv=0xbffff824, init=0x8049104 <_init>, fini=0x804bae0 <_fini>, 
    rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffff81c)
    at ../sysdeps/generic/libc-start.c:78
(gdb)

Comment 1

[David Hyatt]

I see no crash on a current tip build.  Marking WORKSFORME.

Comment 2

[Richard Zach]

Works on 2000.02.13.09 Linux. Verified.