Regression: Crash on Send Later

VERIFIED FIXED in M12

Status

P3
normal
VERIFIED FIXED
20 years ago
2 years ago

People

(Reporter: fenella, Assigned: sfraser_bugs)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [PR1])

(Reporter)

Description

20 years ago
Linux (1999-07-19-11 m9)
1. Open Messenger from Tasks menu
2. Click on New Msg to open a compose window
3. Create a message and Select File|Send Later
Crash consistently occurs.  Here is the trace:

#0  0x40b05227 in nsDocument::~nsDocument ()
#1  0x40b05925 in nsDocument::Release ()
#2  0x4016117b in nsCOMPtr_base::~nsCOMPtr_base ()
#3  0x40da397c in nsTextEditor::~nsTextEditor ()
#4  0x40db5dfe in nsHTMLEditor::~nsHTMLEditor ()
#5  0x40d9a795 in nsEditor::Release ()
#6  0x40da3a1c in nsTextEditor::Release ()
#7  0x40db5e3c in nsHTMLEditor::Release ()
#8  0x4016117b in nsCOMPtr_base::~nsCOMPtr_base ()
#9  0x40dc4671 in nsEditorShell::~nsEditorShell ()
#10 0x40dc4711 in nsEditorShell::Release ()
#11 0x40bd5ce2 in nsXPCWrappedNative::~nsXPCWrappedNative ()
#12 0x40bd5767 in nsXPCWrappedNative::Release ()
#13 0x40bd5811 in nsXPCWrappedNative::JSObjectFinalized ()
#14 0x40bd846a in WrappedNative_CallMethod ()
#15 0x4042414e in js_FinalizeObject ()
#16 0x40415fe9 in js_GC ()
#17 0x40415aec in js_ForceGC ()
#18 0x403fff2a in JS_GC ()
#19 0x40389777 in nsJSContext::GC ()
#20 0x403897ab in nsJSContext::ScriptEvaluated ()
#21 0x403a6b3c in nsJSEventListener::HandleEvent ()
#22 0x409cc2ed in nsEventListenerManager::HandleEvent ()
#23 0x4079cf27 in RDFElementImpl::HandleDOMEvent ()
#24 0x4079d9df in RDFElementImpl::ExecuteJSCode ()
#25 0x4079d6ee in RDFElementImpl::ExecuteOnChangeHandler ()
#26 0x4079c319 in RDFElementImpl::SetAttribute ()
#27 0x407b03ac in RDFXULBuilderImpl::AddAttribute ()
#28 0x407acc02 in RDFXULBuilderImpl::OnChange ()
#29 0x4078749d in CompositeDataSourceImpl::OnChange ()
#30 0x40789335 in InMemoryDataSource::Change ()
#31 0x40786b10 in CompositeDataSourceImpl::Change ()
#32 0x407adbbf in RDFXULBuilderImpl::OnSetAttribute ()
#33 0x407b7353 in XULDocumentImpl::OnSetAttribute ()
#34 0x4079a69e in RDFElementImpl::SetAttribute ()
#35 0x407f0a64 in nsBrowserAppCore::SetWebShellWindow ()
#36 0x407f1264 in nsBrowserAppCore::OnStatusURLLoad ()
#37 0x40306b87 in nsWebShell::OnStatusURLLoad ()
#38 0x40300c9d in nsDocLoaderImpl::FireOnStatusURLLoad ()
#39 0x4030171a in nsDocumentBindInfo::OnStatus ()
#40 0x400e27c3 in stub_PromptUsernameAndPassword ()
#41 0x400c724e in NET_Progress ()
#42 0x400bbd02 in NET_FreeTCPConData ()
#43 0x400bc3d2 in NET_BeginConnect ()
#44 0x40015480 in NET_getInternetKeyword ()
#45 0x40018a82 in net_ResumeHTTP ()
#46 0x400189e1 in net_ResumeHTTP ()
#47 0x400bfa53 in NET_GetURL ()
#48 0x400dd09a in nsNetlibService::OpenStream ()
#49 0x40301564 in nsDocumentBindInfo::Bind ()
#50 0x4030093b in nsDocLoaderImpl::OpenStream ()
#51 0x400de05d in NS_OpenURL ()
#52 0x402cb3e3 in ImageNetContextImpl::GetURL ()
#53 0x4045ae0f in il_image_complete ()
#54 0x40459819 in ImgDCallbk::ImgDCBHaveImageAll ()
#55 0x40bfa229 in il_gif_write_ready ()
#56 0x40bfa289 in gif_delay_time_callback ()
#57 0x402cc2cb in ImageSystemServicesImpl::QueryInterface ()
#58 0x804db6a in main ()
#59 0x804de48 in nsTimerExpired ()
#60 0x4028e24b in g_main_set_poll_func ()
#61 0x4028d7d0 in g_get_current_time ()
#62 0x4028dc4b in g_get_current_time ()
#63 0x4028dd65 in g_main_run ()
#64 0x40231a3f in gtk_main ()
#65 0x401ec8e3 in nsAppShell::Run ()
#66 0x400fe21e in nsAppShellService::Run ()
#67 0x804d3d6 in main ()

Will test Mac and Win later.
(Reporter)

Updated

20 years ago
OS: Linux → All
Hardware: Other → All
Summary: Crash on Send Later → Regression: Crash on Send Later
(Reporter)

Comment 1

20 years ago
Win32(1999-07-19-12 m9)
The Send Later crash also occurs on Win_nt 4.0

Comment 2

20 years ago
I don't actually see this when I do Send Later, but when I shut down Messenger.
I get the following crash where mDoc is already destroyed:

nsEditor::GetDocument(nsEditor * const 0x02aca710, nsIDOMDocument * *
0x0012f55c) line 409 + 25 bytes
nsTextEditor::~nsTextEditor() line 161
nsHTMLEditor::~nsHTMLEditor() line 100 + 8 bytes
nsHTMLEditor::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsEditor::Release(nsEditor * const 0x02aca710) line 375 + 102 bytes
nsTextEditor::Release(nsTextEditor * const 0x02aca710) line 209
nsHTMLEditor::Release(nsHTMLEditor * const 0x02aca710) line 115
nsCOMPtr<nsISupports>::~nsCOMPtr<nsISupports>() line 387
nsEditorShell::~nsEditorShell() line 154 + 69 bytes
nsEditorShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes

reassigning to sfraser and cc'ing ducarroz

Comment 3

20 years ago
cc'ing ducarroz in case we're release Ender incorrectly.

Comment 4

20 years ago
What is the target milestone for this bug since it's a regression?  Thanks.
(Assignee)

Comment 5

20 years ago
This crash happens when the destruction order of the document and the editor
are wrong; the lifetime of the doc must be longer than that of the editor,
because the editor does not hold a reference to the doc. Perhaps it should, but
that might lead to circular references.

You should examine who holds the owning references to the doc and the editor,
and adjust accordingly.
(Assignee)

Updated

20 years ago
Status: NEW → ASSIGNED
(Assignee)

Comment 6

20 years ago
Should this be on M9?

Comment 7

20 years ago
I'm sorry - I just saw your comment, Simon.  It's too latr for M9.  Can you
target for M10?

Updated

20 years ago
Whiteboard: [PR1]

Comment 8

20 years ago
Sounds like this needs to be fixed for PR1, so I added a note to the Status
Whiteboard

Updated

20 years ago
Target Milestone: M12

Comment 9

20 years ago
could somebody please retest this?  there was a fairly significant
rearchitecting of the editor since this bug was submitted, and there's a good
chance this was already fixed.
(Reporter)

Updated

20 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 20 years ago
Resolution: --- → FIXED
(Reporter)

Comment 10

20 years ago
Linux (1999-09-13-08 m11)
Mac (1999-09-10-09 M11
Win_nt (1999-09-10-10 M11)
1. Create a message
2. Select File|Send Later, this no longer crashes.
(Reporter)

Updated

20 years ago
Status: RESOLVED → VERIFIED
Product: MailNews → Core
Product: Core → MailNews Core
You need to log in before you can comment on or make changes to this bug.