Closed Bug 78219 Opened 23 years ago Closed 23 years ago

Trunk crash going to next folder [@ nsMsgDBView::GetThreadContainingIndex]

Categories

(MailNews Core :: Backend, defect, P2)

x86
Windows 2000
defect

Tracking

(Not tracked)

VERIFIED WORKSFORME
mozilla0.9.2

People

(Reporter: scottputterman, Assigned: sspitzer)

Details

(Keywords: crash, topcrash, Whiteboard: [nsbeta1+])

Crash Data

I can't reproduce this crash but it's showing up as a top crash in the talkback
reports.  The crashes have been generated so far between the 4/21 and 4/26 builds.

Here are comments from these crashes:

(29661784)
Comments: Crash using 'n' key to advance to next newsgroup in Mail/News.
     (29604584)	Comments: Was in rec.humor.funny
     (29566905)	Comments: i pressed 'n' to go to next unread in another newsgroup
     (29566215)	URL: www.mozilla.org
     (29566120)	URL: www.mozilla.org
     (29563507)	Comments: I tried to compress the inbox.
     (29549921)	URL: http://www.wellsfargo.com
     (29549921)	Comments: Crash using 'n' to advance to next newsgroup in Mail/News
     (29505079)	URL: http://www.wellsfargo.com
     (29505079)	Comments: Crash using the 'n' key to advance to the next newsgroup in Mail/News.

Here's the stack trace:

nsMsgDBView::GetThreadContainingIndex
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgDBView.cpp, line 2764]
nsMsgDBView::GetCellProperties
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgDBView.cpp, line 754]
nsOutlinerBodyFrame::PaintCell
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerBodyFrame.cpp,
line 1325]
nsOutlinerBodyFrame::PaintRow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerBodyFrame.cpp,
line 1300]
nsOutlinerBodyFrame::Paint
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerBodyFrame.cpp,
line 1207]
PresShell::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5227]
nsView::Paint [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 275]
nsViewManager::RenderDisplayListElement
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1443]
nsViewManager::RenderViews
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1368]
nsViewManager::Refresh [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp,
line 900]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1962]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 708]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 730]
nsWindow::OnPaint [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp,
line 3836]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2842]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 960]
Putting on the nsbeta1 radar and hoping we can reproduce.  This appears to be
happening on Win32.
Keywords: nsbeta1, topcrash
Priority: -- → P2
Whiteboard: [nsbeta1+]
Target Milestone: --- → mozilla0.9.1
Keywords: crash
Summary: crash going to next folder [@nsMsgDBView::GetThreadContainingIndex] → Trunk crash going to next folder [@ nsMsgDBView::GetThreadContainingIndex]
Mozilla Build ID:2001043007 on Windows 2000 also crashes for me, but in a 
different location.

Process is
read through newsgroup using 'n'
use 'n' to go to the next newsgroup
crash at 0x605f1872

It does not happen on every change of folder.
It is repeatable, if it is is going to happen.
Using the mouse to to select the 'n'ext newsgroup folder does not crash.

Extaxct ftom DrWatson log follows:
Application exception occurred:
        App: mozilla.exe (pid=1300)
        When: 1/05/2001 @ 12:31:30.900
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Computer Name: A016148
        User Name: David
        Number of Processors: 1
        Processor Type: x86 Family 6 Model 8 Stepping 3
        Windows 2000 Version: 5.0
        Current Build: 2195
        Service Pack: 1
        Current Type: Uniprocessor Free
        Registered Organization: Mincom Limited
        Registered Owner: Mincom

*----> Task List <----*
   0 Idle.exe
   8 System.exe
 164 SMSS.exe
 188 csrss.exe
 208 WINLOGON.exe
 236 services.exe
 248 LSASS.exe
 412 svchost.exe
 440 SPOOLSV.exe
 508 Avsynmgr.exe
 524 svchost.exe
 560 regsvc.exe
 584 mstask.exe
 636 twgipcsv.exe
 552 twgipc.exe
 656 WinMgmt.exe
 688 mspmspsv.exe
 760 twgescli.exe
 984 unsecapp.exe
 780 VSStat.exe
 884 vshwin32.exe
 852 MCSHIELD.exe
 348 Avconsol.exe
 484 explorer.exe
 996 MDM.exe
1520 promon.exe
 748 PELMICED.exe
 948 realplay.exe
1360 internat.exe
 816 AUTOCHK.exe
 956 taskmgr.exe
1300 mozilla.exe
1336 notepad.exe
1264 DRWTSN32.exe
   0 _Total.exe

(00400000 - 00455000) 
(77F80000 - 77FFA000) 
(60E90000 - 60EF2000) 
(60DF0000 - 60E14000) 
(77DB0000 - 77E0A000) 
(77E80000 - 77F35000) 
(77D40000 - 77DB0000) 
(75050000 - 75058000) 
(75030000 - 75044000) 
(78000000 - 78046000) 
(75020000 - 75028000) 
(60E70000 - 60E76000) 
(60E60000 - 60E67000) 
(60D80000 - 60D89000) 
(69800000 - 69A42000) 
(77F40000 - 77F7C000) 
(77E10000 - 77E74000) 
(77C70000 - 77CBA000) 
(77B50000 - 77BD9000) 
(77A50000 - 77B45000) 
(10000000 - 10007000) 
(6E420000 - 6E426000) 
(75E60000 - 75E7A000) 
(60B70000 - 60B91000) 
(60C40000 - 60C8C000) 
(60F10000 - 60F1C000) 
(601A0000 - 601AA000) 
(60B10000 - 60B1A000) 
(60C90000 - 60CFE000) 
(600D0000 - 600DE000) 
(609B0000 - 609BE000) 
(60090000 - 600AB000) 
(60BF0000 - 60C0D000) 
(76B30000 - 76B6E000) 
(77570000 - 775A0000) 
(60BC0000 - 60BE4000) 
(60C10000 - 60C1C000) 
(608F0000 - 60905000) 
(60BA0000 - 60BA9000) 
(60B40000 - 60B5C000) 
(608E0000 - 608EC000) 
(779B0000 - 77A45000) 
(691D0000 - 69255000) 
(77840000 - 7787C000) 
(770C0000 - 770E3000) 
(60750000 - 60795000) 
(74FD0000 - 74FED000) 
(77340000 - 77353000) 
(77520000 - 77525000) 
(77320000 - 77337000) 
(75150000 - 7515F000) 
(75170000 - 751BF000) 
(77BE0000 - 77BEF000) 
(751C0000 - 751C6000) 
(77950000 - 77979000) 
(77980000 - 779A4000) 
(773B0000 - 773DE000) 
(77380000 - 773A2000) 
(77830000 - 7783E000) 
(77880000 - 7790D000) 
(77C10000 - 77C6D000) 
(774E0000 - 77512000) 
(774C0000 - 774D1000) 
(77530000 - 77552000) 
(77360000 - 77379000) 
(75010000 - 75017000) 
(60960000 - 60968000) 
(60100000 - 6010E000) 
(603E0000 - 6041A000) 
(609A0000 - 609A7000) 
(60AB0000 - 60ABC000) 
(60120000 - 60132000) 
(60840000 - 608CE000) 
(60E40000 - 60E5F000) 
(601E0000 - 60300000) 
(607E0000 - 607EC000) 
(60480000 - 60489000) 
(60520000 - 60529000) 
(60830000 - 6083A000) 
(60D00000 - 60D11000) 
(60420000 - 60435000) 
(77820000 - 77827000) 
(759B0000 - 759B6000) 
(50390000 - 50397000) 
(502E0000 - 502FD000) 
(50300000 - 50316000) 
(60530000 - 60538000) 
(600B0000 - 600C3000) 
(60110000 - 6011B000) 
(605A0000 - 605A6000) 
(60060000 - 60090000) 
(605F0000 - 6062E000) 
(60D90000 - 60DB3000) 
(60AD0000 - 60AE1000) 
(60300000 - 603D9000) 
(60440000 - 60451000) 
(607B0000 - 607BC000) 
(606D0000 - 606F3000) 
(60700000 - 60724000) 
(60460000 - 60466000) 
(601D0000 - 601D5000) 
(60560000 - 60580000) 
(60030000 - 60058000) 
(60550000 - 60556000) 
(60930000 - 60936000) 
(60140000 - 60199000) 
(60980000 - 60987000) 
(60630000 - 6065D000) 
(60580000 - 6059A000) 
(607C0000 - 607C6000) 
(60660000 - 60671000) 
(78280000 - 7828C000) 
(777E0000 - 777E8000) 
(777F0000 - 777F5000) 
(605B0000 - 605B6000) 
(60990000 - 60999000) 
(60470000 - 60475000) 
(60C20000 - 60C35000) 
(601B0000 - 601BA000) 

State Dump for Thread Id 0x528

eax=0012f62c ebx=60d9106a ecx=04e641b8 edx=0012f66c esi=04e64198 edi=00000000
eip=605f1872 esp=0012f618 ebp=0012f630 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00200246


function: <nosymbols>
        605f185c 8365fc00         and   dword ptr [ebp+0xfc],0x0 
ss:00bdcc06=003d2e00
        605f1860 53               push    ebx
        605f1861 56               push    esi
        605f1862 8bf1             mov     esi,ecx
        605f1864 8d45fc           lea     eax,[ebp+0xfc]         
ss:00bdcc06=003d2e00
        605f1867 57               push    edi
        605f1868 8b7e70           mov     edi,[esi+0x70]         
ds:0591176e=????????
        605f186b 50               push    eax
        605f186c ff7508           push    dword ptr [ebp+0x8]    
ss:00bdcc06=003d2e00
        605f186f 8d4e20           lea     ecx,[esi+0x20]         
ds:0591176e=????????
FAULT ->605f1872 8b1f             mov     ebx,[edi]              
ds:00000000=????????
        605f1874 ff1594f16160                                    
ds:6061f194=60d91000
                        call dword ptr 
[nsGetInterface::operator=+0x1ba53 (6061f194)]
        605f187a 50               push    eax
        605f187b 57               push    edi
        605f187c ff5344           call    dword ptr [ebx+0x44]   
ds:6183e640=????????
        605f187f a900000080       test    eax,0x80000000
        605f1884 750f             jnz     NSGetModule+0x893 (60601795)
        605f1886 ff750c           push    dword ptr [ebp+0xc]    
ss:00bdcc06=003d2e00
        605f1889 8b7670           mov     esi,[esi+0x70]         
ds:0591176e=????????
        605f188c ff75fc           push    dword ptr [ebp+0xfc]   
ss:00bdcc06=003d2e00
        605f188f 8b06             mov     eax,[esi]              
ds:04e64198=60620c34
        605f1891 56               push    esi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0012F630 605F122F 00000640 0012F66C 04E641A0 02F69830 msgbase!<nosymbols> 
0012F658 6032BB58 05247DE8 00000640 05074BA0 00000000 msgbase!<nosymbols> 
0012F700 60348AB2 02F69830 00000640 04F577B8 0012F754 
gklayout!nsQueryReferent::nsQueryReferent 
0012F774 6035AF26 04FB0560 00000640 0000000F 018BD198 
gklayout!nsQueryReferent::nsQueryReferent 
0012F808 6032447E 00000640 018BD198 055E9B70 0012F874 
gklayout!NS_NewFrameImageLoader 
0012F830 60442FBB 00000000 02F69830 055E9B70 0012F874 
gklayout!nsStyleChangeList::~nsStyleChangeList 
0012F84C 60442DFA 018E400C 055E9B70 0012F874 00000080 gkview!<nosymbols> 
0012F8A4 60443B72 05759038 00000000 0012F994 0012F9F0 gkview!<nosymbols> 
0012F960 60443705 02F794D8 055E9B70 00000001 0012F9A4 gkview!<nosymbols> 
0012F9BC 60442846 02F794D8 055E9B70 0012F9E0 00000001 gkview!<nosymbols> 
0012FA14 60446EF4 41700000 0012FAB0 02F794D8 0012FAFC gkview!<nosymbols> 
0012FA30 60BF2591 018D5950 00000000 0012FAFC 60BF33E0 gkview!<nosymbols> 
0012FA40 60BF33E0 02E4650C 0012FAB0 0012FAFC 02E46508 gkwidget!<nosymbols>  
(FPO: [3,0,2])
0012FA54 60BF2A28 0012FAB0 0012FAFC 00000001 02E46508 gkwidget!<nosymbols>  
(FPO: [2,0,1])
0012FB0C 60BF165A 00000000 02E46508 0000000F 0012FB40 gkwidget!<nosymbols> 
0012FC6C 60BF13A9 0000000F 00000000 00000000 0012FC9C gkwidget!<nosymbols> 
0012FCA0 77E148DC 000502C6 0000000F 00000000 02E4650C gkwidget!<nosymbols> 
0012FCC0 77E163FB 60BF1300 000502C6 0000000F 00000000 user32!PtInRect 
0012FCDC 77E1643D 00536180 0000000F 00000000 00000000 user32!DefWindowProcW 
0012FD04 77F9F04B 0012FD14 00000018 00536180 0000000F user32!DefWindowProcW 
0012FDA4 77E266FD 0012FDC8 00000001 60BF6BBD 0012FDC8 
ntdll!KiUserCallbackDispatcher 
0012FDFC 60097438 01871CB0 004016EC 00AE9398 00000000 user32!DispatchMessageA 
0012FE04 004016EC 00AE9398 00000000 001338D1 00000000 
appshell!nsQueryReferent::nsQueryReferent  (FPO: [1,0,0])
0012FEF0 004011B8 00000001 002F3A68 002F3AA8 001338D1 
mozilla!nsGetInterface::operator= 
0012FF18 00402B92 00000001 002F3A68 00404A92 00400000 
mozilla!nsGetInterface::operator= 
0012FF24 00404A92 00400000 00000000 001338D1 00000001 
mozilla!nsGetInterface::operator=  (FPO: [4,0,0])
0012FFC0 77E992A6 00000008 00000002 7FFDF000 C0000005 
mozilla!nsGetInterface::operator= 
0012FFF0 00000000 0040495E 00000000 000000C8 00000100 kernel32!GetCommandLineW 

*----> Raw Stack Dump <----*
0012f618  40 06 00 00 2c f6 12 00 - 68 a8 f7 02 a0 41 e6 04  @...,...h....A..
0012f628  6a 10 d9 60 00 00 00 00 - 58 f6 12 00 2f 12 5f 60  j..`....X.../._`
0012f638  40 06 00 00 6c f6 12 00 - a0 41 e6 04 30 98 f6 02  @...l....A..0...
0012f648  b8 77 f5 04 00 00 00 00 - cc 41 e6 04 98 41 e6 04  .w.......A...A..
0012f658  00 f7 12 00 58 bb 32 60 - e8 7d 24 05 40 06 00 00  ....X.2`.}$.@...
0012f668  a0 4b 07 05 00 00 00 00 - 00 00 00 00 b8 77 f5 04  .K...........w..
0012f678  30 98 f6 02 0f 00 00 00 - 0f 00 00 00 0f 00 00 00  0...............
0012f688  00 00 00 00 00 00 00 00 - 01 00 00 00 b0 f6 12 00  ................
0012f698  dc f6 12 00 69 0c 1f 60 - 0f 00 00 00 0f 00 00 00  ....i..`........
0012f6a8  0f 00 00 00 0f 00 00 00 - 44 f7 12 00 34 0d 28 03  ........D...4.(.
0012f6b8  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0012f6c8  00 00 00 00 0f 00 00 00 - 0f 00 00 00 0f 00 00 00  ................
0012f6d8  0f 00 00 00 18 f7 12 00 - 8f da 39 60 60 05 fb 04  ..........9``...
0012f6e8  10 00 00 00 a8 0b 62 60 - 08 f7 12 00 0f 00 00 00  ......b`........
0012f6f8  0f 00 00 00 e1 00 00 00 - 74 f7 12 00 b2 8a 34 60  ........t.....4`
0012f708  30 98 f6 02 40 06 00 00 - b8 77 f5 04 54 f7 12 00  0...@....w..T...
0012f718  98 d1 8b 01 70 9b 5e 05 - 74 f8 12 00 00 00 00 00  ....p.^.t.......
0012f728  00 00 00 00 70 9b 5e 05 - 30 98 f6 02 00 00 00 00  ....p.^.0.......
0012f738  00 00 00 00 00 00 00 00 - 00 00 00 00 0f 00 00 00  ................
0012f748  0c 03 00 00 4a 01 00 00 - e1 00 00 00 0f 00 00 00  ....J...........

(Please do put the stacktrace in a attachment next time, thanks :)

I can't reproduce this. I tried by going to one of my newsgroups, and then
pressed 'n' a few times. When there were no new messages left, it asked me "Do
you want to advance to the next unread message in the next newsgroup?", I
clicked OK. It worked.

Is this crashing if going to the next newsgroup *server*?
QA Contact: esther → fenella
No - all newsgroups are from the same news server. I have since downloaded the
next 0.9.1 release {Build 2001043004} but keyboard shortcuts don't seem to work
at all (yet I hope). I'll resinstall the 0.9-latest and try again.

RE attachments. Sure thing. I'm still learning the etiquette. Maybe the Bugzilla
form could chanage to include "stack dumps" in the list of suggested attachments.
FWIW, I did try an attachment the first time, but after asking me to 'log in'
twice, Bugzilla responded that the attachment was blank  :( This was also using
Moz to report.

djc

Sorry for the clutter ...

It may be relevent that my /mail/ and /news/ hosts are different, but I only 
have a single news host.

The crash also happens in the same place when using the mouse to click on the 
'Next (unread message)' message on the toolbar. Note that it's not EVERY folder 
change, though I often have difficulty reading through more than 3 or 4 folders 
before it does crash. I also 'k'illed a number of threads in some of newsgroups 
... that may have something to do with it, though I can't determine anything 
consistent at this time.

The crashes occur immediately after either (clicking ok) or (hitting <return> or 
<space>) after the "Advance to next unread message in <newsgroup>' popup.

If I cancel the popup, select another newsgroup via the mouse, select the 
original newsgroup then repeat the 'n' action, there's no problem. Somewhat 
tedious though.

djc
I've seen this going from imap folder to imap folder, so I don't think it has
anything to do with certain newsgroups or news servers.  I've only seen it on
the daily release build, not in my debug build, or a release build I made
myself. I wonder if we're crashing because m_db is null for some reason. I'll
add an assert and a check for null.
moving to 0.9.2.  This crash is no longer showing up as a top crash and the last
time it occurred according to Talkback reports was 4/26.  It doesn't mean it's
gone but it appears to have become less severe.  Since we also can't reproduce
moving to 0.9.2 to evaluate later.
Target Milestone: mozilla0.9.1 → mozilla0.9.2
I've retried with the latest Build ID: 2001051704 and my crashes no longer occur.

Regards, djc
marking wfm based on djc comments.
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → WORKSFORME
Linux (2001-05-17-08 trunk)
Win32 (2001-05-17-10 trunk)
Mac (2001-05-17-08 trunk)
Verified it. Problem does not exist in these builds..
Status: RESOLVED → VERIFIED
Product: MailNews → Core
Product: Core → MailNews Core
Crash Signature: [@ nsMsgDBView::GetThreadContainingIndex]
You need to log in before you can comment on or make changes to this bug.