68451 - M081 crash [@ 0x00000000 - nsXULElement::SetAttribute] Editing bookmarks causes crash

Status: VERIFIED WORKSFORME

(SeaMonkey :: Bookmarks & History, defect, P1)

Description

[Mark D. Leighty]

In Win-2001020904, editing 3 or 4 bookmarks crashes Mozilla.  Unlike 65066, this
happens whether using the OK button or Enter on the keyboard.

Comment 1

[Fabian Guisset]

Mark, please read the bug writing guidelines at
http://www.mozilla.org/quality/bug-writing-guidelines.html for a document on how
to write better bug reports, thanks. Could you give precise steps to reproduce?
Are you editing in the sidebar or the bookmarks manager? How are you editing it?
Inline, with the rename command, with the properties dialog? Would it be
possible to get a stacktrace or anything related?
Thanks a lot!

Comment 2

[Mark D. Leighty]

Sorry I wasn't specific enough.  In the bookmark manager, right-click and select
properties, then click OK when finished.  After 3 or 4 edits, Mozilla
(win-2001020904) will crash.  If you want to edit more, you must close and
reopen the bookmark manager every 2 edits.  The crash doesn't happen for me when
using inline remaning or the rename command.

Comment 3

[avi]

After editing the preferences of exactly three bookmarks Mozilla crashes.

Comment 4

[Boris Zbarsky [:bzbarsky]]

I see a crash after exactly 3 edits on a 2001-02-11 cvs linux build. severity
critical, status new, adding crash keyword.

I can't get a full stack trace because gdb hangs, but here is what it tells me:

#0  0x740074 in ?? ()
#1  0x40c7fc22 in nsXULElement::SetAttribute (this=0x429e2b80, aName=@0xbfffc808, 
    aValue=@0xbfffc770) at nsXULElement.cpp:1306
        this = (nsXULElement *) 0x740074
        rv = 0
        ni = {mRawPtr = 0x429aaa78}

Comment 5

[Boris Zbarsky [:bzbarsky]]

Got a stack trace with a newer version of gdb.  Attaching.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: Stack trace

Comment 7

[Doron Rosenberg (IBM)]

anyone still seeing this with a new build?

Comment 8

[Håkan Waara]

Worksforme using build 20010227, Windows 98.

Can anyone please try this in a new nightly and either mark it Worksforme or
comment that you can reproduce it in here please?

Thanks.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Still seeing crash with the same stack trace with a CVS build from this evening
(20 mins ago) on Linux

Comment 10

[Håkan Waara]

Boris, can you try this in a clobber *nightly*?

Maybe it's your cvs build acting up..

Comment 11

[Boris Zbarsky [:bzbarsky]]

Same crash with both my usual profile and a fresh profile, with the
2001-02-27-21 nightly on Linux.

Comment 12

[Mark D. Leighty]

Still seeing a crash in Win98 using 2001022805.

Comment 13

[Ben Goodger (use ben at mozilla dot org for email)]

I've seen this before, it seems related to broadcaster notification. cc'ing 
hyatt. 

Comment 14

[Paul Chen]

Marking nsbeta1+, p1, mozilla0.9.1

Comment 15

[Jay Patel [:jay]]

This is a topcrash for Mozilla 0.8 on Linux and Windows.  It's showing up under 
the 0x00000000 stack signature for Linux.  Adding topcrash keyword, M08 and [@ 
nsXULElement::SetAttribute] for tracking.  

Here's the top portion of the stack trace for Linux:
Incident ID 26806019 
0x00000000 
nsXULElement::SetAttribute() 
ElementSetAttribute() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
JS_CallFunctionValue() 
nsJSContext::CallEventHandler() 
nsJSEventListener::HandleEvent() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
nsXULCommandDispatcher::UpdateCommands() 
XULCommandDispatcherUpdateCommands() 
.
.
.

and a full stack trace for Windows:
Incident ID 26940562 
nsXULElement::SetAttribute 
[d:\builds\0.8\mozilla\rdf\content\src\nsXULElement.cpp, line 2859] 
nsXULElement::SetAttribute 
[d:\builds\0.8\mozilla\rdf\content\src\nsXULElement.cpp, line 1310] 
ElementSetAttribute [d:\builds\0.8\mozilla\dom\src\coreDOM\nsJSElement.cpp, line 
250] 
js_Invoke [d:\builds\0.8\mozilla\js\src\jsinterp.c, line 779] 
js_Interpret [d:\builds\0.8\mozilla\js\src\jsinterp.c, line 2671] 
js_Invoke [d:\builds\0.8\mozilla\js\src\jsinterp.c, line 795] 
js_InternalInvoke [d:\builds\0.8\mozilla\js\src\jsinterp.c, line 867] 
JS_CallFunctionValue [d:\builds\0.8\mozilla\js\src\jsapi.c, line 3273] 
nsJSContext::CallEventHandler 
[d:\builds\0.8\mozilla\dom\src\base\nsJSEnvironment.cpp, line 937] 
nsJSEventListener::HandleEvent 
[d:\builds\0.8\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\0.8\mozilla\layout\events\src\nsEventListenerManager.cpp, line 839] 
nsEventListenerManager::HandleEvent 
[d:\builds\0.8\mozilla\layout\events\src\nsEventListenerManager.cpp, line 1727] 
nsXULElement::HandleDOMEvent 
[d:\builds\0.8\mozilla\rdf\content\src\nsXULElement.cpp, line 3455] 
nsXULCommandDispatcher::UpdateCommands 
[d:\builds\0.8\mozilla\rdf\content\src\nsXULCommandDispatcher.cpp, line 342] 
GlobalWindowImpl::UpdateCommands 
[d:\builds\0.8\mozilla\dom\src\base\nsGlobalWindow.cpp, line 2140] 
nsFocusController::UpdateCommands 
[d:\builds\0.8\mozilla\dom\src\base\nsFocusController.cpp, line 120] 
nsFocusController::SetSuppressFocus 
[d:\builds\0.8\mozilla\dom\src\base\nsFocusController.cpp, line 355] 
nsEventStateManager::PreHandleEvent 
[d:\builds\0.8\mozilla\layout\events\src\nsEventStateManager.cpp, line 460] 
PresShell::HandleEventInternal 
[d:\builds\0.8\mozilla\layout\html\base\src\nsPresShell.cpp, line 4911] 
PresShell::HandleEvent 
[d:\builds\0.8\mozilla\layout\html\base\src\nsPresShell.cpp, line 4851] 
nsView::HandleEvent [d:\builds\0.8\mozilla\view\src\nsView.cpp, line 372] 
nsViewManager2::DispatchEvent 
[d:\builds\0.8\mozilla\view\src\nsViewManager2.cpp, line 1424] 
HandleEvent [d:\builds\0.8\mozilla\view\src\nsView.cpp, line 68] 
nsWindow::DispatchEvent [d:\builds\0.8\mozilla\widget\src\windows\nsWindow.cpp, 
line 691] 
nsWindow::DispatchWindowEvent 
[d:\builds\0.8\mozilla\widget\src\windows\nsWindow.cpp, line 708] 
nsWindow::DispatchFocus [d:\builds\0.8\mozilla\widget\src\windows\nsWindow.cpp, 
line 4099] 
nsWindow::ProcessMessage [d:\builds\0.8\mozilla\widget\src\windows\nsWindow.cpp, 
line 3099] 
nsWindow::WindowProc [d:\builds\0.8\mozilla\widget\src\windows\nsWindow.cpp, 
line 924] 
KERNEL32.DLL + 0x363b (0xbff7363b) 
KERNEL32.DLL + 0x242e7 (0xbff942e7) 

Most of the user comments in the talkback reports mentioned editing bookmarks, 
working in bookmark manager or renaming bookmark folders.

Comment 16

[Ben Goodger (use ben at mozilla dot org for email)]

-> hyatt

Comment 17

[Becki Sanford]

This problem also occurs after deleting 3 bookmarks (vertified with Linux M0.8
and nightly build IDs 2001020810 and 2001031408).

Comment 18

[Becki Sanford]

I should have clarified that when you delete 3 bookmarks VIA THE POPUP MENU,
Mozilla crashes.  Deleting bookmarks via the Edit/Delete menu items does not
show this problem.

Comment 19

[Becki Sanford]

Could this possibly be related to bug #68208 since Mozilla crashes after an RDF
has been changed 3 times ??

Comment 20

[selmer (gone)]

Using nscatfood keyword to track crash car bugs.

Comment 21

[David Hyatt]

*** Bug 72355 has been marked as a duplicate of this bug. ***

Comment 22

[Claudius Gayle]

Soooo, I've been crashing when using the arrows in Manage Bookmarks to scroll a large BM list.
Looking at the stack hyatt says this looks to be the same crash. The URL field of this bug now
points to a copy of the huge bookmarks test file. You'll probably want to expand it some before
trying to repro.

Comment 23

[Claudius Gayle]

Attachment: trace from scrolling in BM window

Comment 24

[Claudius Gayle]

I should note that this is blocking me from doing bookmarks performance testing

Comment 25

[David Hyatt]

Giving to waterson.

Comment 26

[Stephen P. Morse]

Unable to reproduce.

Comment 27

[Ben Goodger (use ben at mozilla dot org for email)]

*** Bug 65066 has been marked as a duplicate of this bug. ***

Comment 28

[Jay Patel [:jay]]

I haven't seen this particular crash in Talkback data for a while, so if no one 
can reproduce it, we should mark it fixed or worksforme.  Claudius, can you 
verify this?

Comment 29

[Mel Redrup]

Unable to reproduce on build 2001042012.

Comment 30

[Chris Waterson]

I'll happily call this WORKSFORME. :-)

Comment 31

[Shiva Thirumazhusai]

Moving all the Works For Me bugs to talkback user account for future reference.

Comment 32

[Shiva Thirumazhusai]

We are gathering all the Resolved and WFM bugs which are happened to be topcrash 
bugs and assigning it to talkback. I am marking all of them as RESOLVED WFM.

Comment 33

[Claudius Gayle]

VERIFIED WFM with 20010516 builds