75614 - Crash exiting when Search Msg UI open, or close search after mail closed.

Status: VERIFIED DUPLICATE of bug 74902

(SeaMonkey :: MailNews: Message Display, defect)

Description

[laurel]

Using apr11 commercial trunk build, linux rh6.2 and mac OS 9.0
Can't reproduce with win98

There are two ways I can crash Netscape involving Search Messages being open
when exiting or closing the dialog... I think these are probably the same crash.

Scenario 1:
1.  Launch to Browser, go to mail window, login or don't login to mail account
(doesn't seem to make a difference), Search|Search Mail/News.
2.  Leave search messages ui open, File|Quit from mail window.
Result: crashes.

Scenario 2:
1.  Launch to Browser, go to mail window, login or don't, Search|Search Mail/News.
2.  Leave search ui open, Close mail window (browser still open).
3.  Use the Close button in search ui.
Result: crashes.

Comment 1

[laurel]

Attachment: macsbug for close search

Comment 2

[(not reading, please use [e-mail] instead)]

I've seen that too.  hyatt may have a bug on this already.

Comment 3

[(not reading, please use [e-mail] instead)]

I'm in the middle of converting the subscribe dialog to use the outliner bridge 
that waterson wrote.

on close of subscribe, I see the same thing every time.

I've also seen this when closing mail.

here is my stack from when closing the subscribe dialog:

nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012c880) line 32 + 
23 bytes
nsCOMPtr<nsIBoxObject>::assign_from_helper(const nsCOMPtr_helper & {...}, const 
nsID & {...}) line 970 + 18 bytes
nsCOMPtr<nsIBoxObject>::nsCOMPtr<nsIBoxObject>(const nsQueryInterface & {...}) 
line 564
nsOutlinerBodyFrame::Destroy(nsOutlinerBodyFrame * const 0x0130e330, 
nsIPresContext * 0x05aaddb0) line 306
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130e1cc, nsIPresContext * 
0x05aaddb0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x0130e1cc, nsIPresContext * 0x05aaddb0) 
line 1008 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130e13c, nsIPresContext * 
0x05aaddb0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x0130e13c, nsIPresContext * 0x05aaddb0) 
line 1008 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130d604, nsIPresContext * 
0x05aaddb0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x0130d604, nsIPresContext * 0x05aaddb0) 
line 1008 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130d574, nsIPresContext * 
0x05aaddb0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x0130d574, nsIPresContext * 0x05aaddb0) 
line 1008 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130b388, nsIPresContext * 
0x05aaddb0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x0130b388, nsIPresContext * 0x05aaddb0) 
line 1008 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130b148, nsIPresContext * 
0x05aaddb0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x0130b148, nsIPresContext * 0x05aaddb0) 
line 1008 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130b004, nsIPresContext * 
0x05aaddb0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x0130b004, nsIPresContext * 0x05aaddb0) 
line 1008 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130af74, nsIPresContext * 
0x05aaddb0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x0130af74, nsIPresContext * 0x05aaddb0) 
line 1008 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x05aaddb0) line 42
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130af38, nsIPresContext * 
0x05aaddb0) line 98
ViewportFrame::Destroy(ViewportFrame * const 0x0130af38, nsIPresContext * 
0x05aaddb0) line 142
FrameManager::Destroy(FrameManager * const 0x05aae370) line 422
PresShell::~PresShell() line 1422
PresShell::`scalar deleting destructor'() + 15 bytes
PresShell::Release(PresShell * const 0x05aaed50) line 1330 + 158 bytes
nsView::HandleEvent(nsView * const 0x05aad580, nsGUIEvent * 0x0012d050, unsigned 
int 28, nsEventStatus * 0x0012cf44, int 1, int & 1) line 377 + 18 bytes
nsViewManager::DispatchEvent(nsViewManager * const 0x05aad780, nsGUIEvent * 
0x0012d050, nsEventStatus * 0x0012cf44) line 2001
HandleEvent(nsGUIEvent * 0x0012d050) line 68
nsWindow::DispatchEvent(nsWindow * const 0x05aad444, nsGUIEvent * 0x0012d050, 
nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012d050) line 716
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? 
y=???}) line 4018 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? 
y=???}) line 4263
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 21627096, long * 
0x0012d408) line 3000 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x01df0552, unsigned int 514, unsigned int 0, long 
21627096) line 950 + 27 bytes
USER32! 77e71820()
$E2() line 844 + 14 bytes

Comment 4

[Chris Waterson]

Hey dave, I think this is probably your bug. It looks like what is happening is
that the box object is going away without notifying the frame.

Comment 5

[David Hyatt]

I see this too on pretty much all RDF outliners.  This is a dup of one of my
bugs, Seth.

Comment 6

[(not reading, please use [e-mail] instead)]

hyatt, search and threadpane aren't rdf outliners.

I'll look at your bug list for a dup.

Comment 7

[(not reading, please use [e-mail] instead)]

it's a duplicate of #74902.

*** This bug has been marked as a duplicate of 74902 ***

Comment 8

[laurel]

Verified as a duplicate.
Also, looks like fix is good -- no crash in apr18 commercial trunk build with
win98 and linux rh6.2. Mac build not yet available.