106654 - Crash hitting CTRL+M / new mail message

Status: VERIFIED DUPLICATE of bug 106646

(MailNews Core :: Composition, defect, P1)

Description

[Markus Gerstel]

Today is crash day ?

1. Open Mozilla 2001102504
2. Hit CTRL+M to bring up Mail Composition Window
3. 
(0,0,12132,3492)!nsWidget::~nsWidget() of toplevel: 26 widgets still exist.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 21386)]
0x415f14dc in nsXULDocument::ContentReplaced (this=0x88e14d8, aContainer=0x899e5f0,
    aOldChild=0x8a35fa0, aNewChild=0x8b78610, aIndexInContainer=1) at
nsXULDocument.cpp:2119
2119                                      aIndexInContainer);
(gdb) bt
#0  0x415f14dc in nsXULDocument::ContentReplaced (this=0x88e14d8,
aContainer=0x899e5f0,
    aOldChild=0x8a35fa0, aNewChild=0x8b78610, aIndexInContainer=1) at
nsXULDocument.cpp:2119
#1  0x415ca2e2 in nsXULElement::ReplaceChildAt (this=0x899e5f0, aKid=0x8b78610,
aIndex=1,
    aNotify=1, aDeepSetDocument=1) at nsXULElement.cpp:2322
#2  0x415c5670 in nsXULElement::ReplaceChild (this=0x899e5f0, aNewChild=0x8b78614,
    aOldChild=0x8a35fa4, aReturn=0xbfffc60c) at nsXULElement.cpp:1130
#3  0x402088e0 in XPTC_InvokeByIndex (that=0x899e5f4, methodIndex=16, paramCount=3,
    params=0xbfffc5ec) at xptcinvoke_unixish_x86.cpp:153
#4  0x40dc59fb in XPCWrappedNative::CallMethod (ccx=@0xbfffc6a4, mode=CALL_METHOD)
    at xpcwrappednative.cpp:1951
#5  0x40dce82e in XPC_WN_CallMethod (cx=0x8306948, obj=0x8809bd0, argc=2,
argv=0x8bd1cc8,
    vp=0xbfffc7d8) at xpcwrappednativejsops.cpp:1266
#6  0x40093b0b in js_Invoke (cx=0x8306948, argc=2, flags=0) at jsinterp.c:809
#7  0x400a2ee2 in js_Interpret (cx=0x8306948, result=0xbfffd364) at jsinterp.c:2768
#8  0x40093b88 in js_Invoke (cx=0x8306948, argc=0, flags=0) at jsinterp.c:826
#9  0x400a2ee2 in js_Interpret (cx=0x8306948, result=0xbfffdf24) at jsinterp.c:2768
#10 0x40093b88 in js_Invoke (cx=0x8306948, argc=0, flags=2) at jsinterp.c:826
#11 0x40dbe81b in nsXPCWrappedJSClass::CallMethod (this=0x8bb5540,
wrapper=0x884e190,
    methodIndex=3, info=0x8923470, nativeParams=0xbfffe480) at
xpcwrappedjsclass.cpp:1022
#12 0x40dbbe95 in nsXPCWrappedJS::CallMethod (this=0x884e190, methodIndex=3,
info=0x8923470,
    params=0xbfffe480) at xpcwrappedjs.cpp:429
#13 0x40208cd3 in PrepareAndDispatch (self=0x884e190, methodIndex=3,
args=0xbfffe558)
    at xptcstubs_unixish_x86.cpp:95
#14 0x40208d83 in nsXPTCStubBase::Stub3 (this=0x884e190)
    at ../../../../../../dist/include/xpcom/xptcstubsdef.inc:5
#15 0x42723d23 in nsMsgCompose::NotifyStateListeners (this=0x8b99488,
    aNotificationType=eComposeFieldsReady, aResult=0) at nsMsgCompose.cpp:2911
#16 0x427227b9 in nsMsgDocumentStateListener::NotifyDocumentCreated (this=0x8767470)
    at nsMsgCompose.cpp:2513
#17 0x424dcf66 in nsEditor::NotifyDocumentListeners (this=0x8b0daa8,
    aNotificationType=<incomplete type>) at nsEditor.cpp:2545
#18 0x424d3ac7 in nsEditor::PostCreate (this=0x8b0daa8) at nsEditor.cpp:362
#19 0x42432d39 in nsHTMLEditor::PostCreate (this=0x8b0daa8) at nsHTMLEditor.cpp:320
#20 0x429625b9 in nsEditorShell::PrepareDocumentForEditing (this=0x8b14ae8,
    aDOMWindow=0x8aeed8c, aUrl=0x8767550) at nsEditorShell.cpp:615
#21 0x42976b7a in nsEditorShell::EndPageLoad (this=0x8b14ae8, aDOMWindow=0x8aeed8c,
    aChannel=0x8767738, aStatus=0) at nsEditorShell.cpp:5232
#22 0x42975a2f in nsEditorShell::OnStateChange (this=0x8b14ae8, aProgress=0x8b13ed4,
    aRequest=0x8767738, aStateFlags=786448, aStatus=0) at nsEditorShell.cpp:5007
#23 0x41020c99 in nsDocLoaderImpl::FireOnStateChange (this=0x8b13ec0,
aProgress=0x8b13ed4,
    aRequest=0x8767738, aStateFlags=786448, aStatus=0) at nsDocLoader.cpp:1109
#24 0x4101fc89 in nsDocLoaderImpl::doStopDocumentLoad (this=0x8b13ec0,
request=0x8767738,
    aStatus=0) at nsDocLoader.cpp:749
#25 0x4101f968 in nsDocLoaderImpl::DocLoaderIsEmpty (this=0x8b13ec0) at
nsDocLoader.cpp:645
#26 0x4101f682 in nsDocLoaderImpl::OnStopRequest (this=0x8b13ec0,
aRequest=0x8767738,
    aCtxt=0x0, aStatus=0) at nsDocLoader.cpp:575
#27 0x40f094c1 in nsLoadGroup::RemoveRequest (this=0x8b13f70, request=0x8767738,
ctxt=0x0,
    aStatus=0) at nsLoadGroup.cpp:525
#28 0x40f02b6b in nsStreamIOChannel::OnStopRequest (this=0x8767738,
request=0x876759c,
    context=0x0, aStatus=0) at nsInputStreamChannel.cpp:479
#29 0x40f94a7c in nsOnStopRequestEvent::HandleEvent (this=0x8bb5260)
    at nsRequestObserverProxy.cpp:176
#30 0x40f0f639 in nsARequestObserverEvent::HandlePLEvent (plev=0x8bb5260)
    at nsRequestObserverProxy.cpp:79
#31 0x401e1cc4 in PL_HandleEvent (self=0x8bb5260) at plevent.c:590
#32 0x401e24bd in PL_ProcessEventsBeforeID (aSelf=0x8095ca0, aID=2960) at
plevent.c:1256
#33 0x410b7dd7 in processQueue (aElement=0x8095ca0, aData=0xb90) at
nsAppShell.cpp:479
#34 0x4019bc58 in nsVoidArray::EnumerateForwards (this=0x816d078,
    aFunc=0x410b7da8 <processQueue(void *, void *)>, aData=0xb90) at
nsVoidArray.cpp:652
#35 0x410b7e20 in nsAppShell::ProcessBeforeID (aID=2960) at nsAppShell.cpp:487
#36 0x410c0ea7 in handle_gdk_event (event=0x834c0b8, data=0x0) at
nsGtkEventHandler.cpp:1005
#37 0x40470127 in gdk_wm_protocols_filter () from /opt/gnome/lib/libgdk-1.2.so.0
#38 0x4049e308 in g_get_current_time () from /opt/gnome/lib/libglib-1.2.so.0
#39 0x4049e913 in g_get_current_time () from /opt/gnome/lib/libglib-1.2.so.0
#40 0x4049eaac in g_main_run () from /opt/gnome/lib/libglib-1.2.so.0
#41 0x403c17e7 in gtk_main () from /opt/gnome/lib/libgtk-1.2.so.0
#42 0x410b7a55 in nsAppShell::Run (this=0x8165ef0) at nsAppShell.cpp:364
#43 0x40c89582 in nsAppShellService::Run (this=0x816bdd8) at
nsAppShellService.cpp:302
#44 0x080593fa in main1 (argc=1, argv=0xbffff774, nativeApp=0x0) at
nsAppRunner.cpp:1285
#45 0x0805a253 in main (argc=1, argv=0xbffff774) at nsAppRunner.cpp:1607
#46 0x405d82eb in __libc_start_main (main=0x805a038 <main>, argc=1,
ubp_av=0xbffff774,
    init=0x8053c78 <_init>, fini=0x8064f40 <_fini>, rtld_fini=0x4000c130 <_dl_fini>,
    stack_end=0xbffff76c) at ../sysdeps/generic/libc-start.c:129

Comment 1

[Markus Gerstel]

probably related to 106645 (which is a crash on nsXULDocument::ContentRemoved)

Comment 2

[Jean-Francois Ducarroz]

over to varada

Comment 3

[Markus Gerstel]

*** Bug 106683 has been marked as a duplicate of this bug. ***

Comment 4

[Markus Gerstel]

From Bug 106683:
Talkback ID:  TB37170637Q
Build: 2001102503

Comment 5

[scottputterman]

It sounds like this could be related to
http://bugzilla.mozilla.org/show_bug.cgi?id=106646.  cc'ing hyatt. 
Jean-Francois and Varada, could you help look into this?

Comment 6

[Markus Gerstel]

See my comment in 106646, this is a dup

*** This bug has been marked as a duplicate of 106646 ***

Comment 7

[Sheela Ravindran]

verified as dup