8755 - [BLOCKER] Clicking on a Messenger folder causes a crash

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect, P1)

Description

[scottputterman]

With this morning's build, I'm crashing when I click on a Messenger folder in
the folder pane.

This is the call stack:

js_SkipWhiteSpace(const unsigned short * 0x0358001c) line 2270 + 5 bytes
js_strtod(JSContext * 0x041c47b0, const unsigned short * 0x0358001c, const
unsigned short * * 0x0012dbd4, double * 0x0012dbd8) line 637 + 9 bytes
js_ValueToNumber(JSContext * 0x041c47b0, long 66074212, double * 0x0012e284)
line 477 + 24 bytes
js_Interpret(JSContext * 0x041c47b0, long * 0x0012e3b4) line 1851 + 318 bytes
js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes
js_Interpret(JSContext * 0x041c47b0, long * 0x0012eba0) line 2215 + 15 bytes
js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes
js_Interpret(JSContext * 0x041c47b0, long * 0x0012f38c) line 2215 + 15 bytes
js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes
js_CallFunctionValue(JSContext * 0x041c47b0, JSObject * 0x01273f48, long
19349328, unsigned int 1, long * 0x0012f4d0, long * 0x0012f4d8) line 749 + 15
bytes
JS_CallFunctionValue(JSContext * 0x041c47b0, JSObject * 0x01273f48, long
19349328, unsigned int 1, long * 0x0012f4d0, long * 0x0012f4d8) line 2568 + 29
bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x04caf4c0) line 97 + 34 bytes
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus &
nsEventStatus_eConsumeDoDefault) line 569 + 21 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042d8700, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2348
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042e3c40, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042eae80, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042ec110, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042f7c50, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042e7640, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042d74b0, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 1,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const
0x04303920, nsIPresContext & {...}, nsMouseEvent * 0x0012fbd4, nsEventStatus &
nsEventStatus_eConsumeDoDefault) line 632 + 31 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x04303920,
nsIPresContext & {...}, nsGUIEvent * 0x0012fbd4, nsIFrame * 0x04306340,
nsEventStatus & nsEventStatus_eConsumeDoDefault, nsIView * 0x041ec2a0) line 194
+ 24 bytes
PresShell::HandleEvent(PresShell * const 0x041edaa4, nsIView * 0x041ec2a0,
nsGUIEvent * 0x0012fbd4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line
2047 + 43 bytes
nsView::HandleEvent(nsView * const 0x041ec2a0, nsGUIEvent * 0x0012fbd4, unsigned
int 28, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 833
nsViewManager::DispatchEvent(nsViewManager * const 0x041ec4c0, nsGUIEvent *
0x0012fbd4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 1735
HandleEvent(nsGUIEvent * 0x0012fbd4) line 67
nsWindow::DispatchEvent(nsWindow * const 0x041ec184, nsGUIEvent * 0x0012fbd4,
nsEventStatus & nsEventStatus_eIgnore) line 419 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbd4) line 440
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=???
y=???}) line 3018 + 15 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=???
y=???}) line 3167
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 5177426, long *
0x0012fdc0) line 2380 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x000305bc, unsigned int 514, unsigned int 0, long
5177426) line 482 + 27 bytes
USER32! 77e71250()
004f0052()

Comment 1

[scottputterman]

*** Bug 8756 has been marked as a duplicate of this bug. ***

Comment 2

[scottputterman]

I can bring the browser up and I can also bring up Messenger without any
problem.  But, clicking on a folder causes this.

Comment 3

[Scott MacGregor]

Adding myself to the cc list.

Comment 4

[Scott Furman]

There are no obvious changes around the call sites on the stack.  There have
been no changes in the string-to-number conversion code either.

There has, however, been a change to the number-to-string conversion code, a bug
fix by Roger Lawrence for bug #7625.

Since I can't repro this bug, can someone on the cc list of this bug try backing
out just the most recent checkin to jsnum.c in their tree and report whether or
not it cures the crash ?

Comment 5

[scottputterman]

using rev 3.11 of jsnum.c I still get the crash.

Comment 6

[Scott Furman]

I'll need the path to someone's executable to repro the bug.  If I can't get a
handle on what's causing this before noon, I'll just back out all the JS engine
changes.

Comment 7

[Scott Furman]

After reviewing all the JS changes checked in during the period in
question, only a few files look like they could possibly be the culprit.
We've already eliminated jsnum.c.

It's not clear if the JS code in question makes use of regular expressions
(there's no regexp code in the call stack), but the bulk of the changes to the
JS engine were in jsregexp.c and jsregexp.h.

The only other likely cause would be Mike Shaver's change to jsinterp.c to fix
bug #8042.

Comment 8

[scottputterman]

It appears the problem is that I was subtracting Dates to get the current time
rather than using the function dateObj.GetTime().

Comment 9

[scottputterman]

I've been asked to reassign this bug to me so I can mark it fixed for mailnews.
If this date crash shouldn't be happening, we should open up another bug on
this.

Comment 10

[lchiang]

verified this in 6/24 (respun) builds on win32 and mac.  Unable to verify for
Linux due to bug 8849.  Will wait.

Comment 11

[lchiang]

6/25 Linux builds passed our build smoke test so this bug has been verified.