Closed Bug 108922 Opened 23 years ago Closed 23 years ago

crash scrolling in filters editor [__strtol_internal] [nsHTMLInputElement::GetValue]

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED DUPLICATE of bug 118815

People

(Reporter: spam, Assigned: eric)

References

Details

(Keywords: crash, regression) 

Linux 2001110706

open edit/filters
select a filter
click "Edit"

As filter rule editor opens, I see around 30 lines of:
 Warning prev sibling is not in our list!!!

now wheelscroll down in pane displaying filters: it scrolls
wheelscroll up again: crash

non-debug 2001110706 linux seems to crash in
 __strtol_internal (nptr=0x8fc7130 "À\022&A0", endptr=0xbfffb338, base=0, 
    group=0) at eval.c:36

TB37702715Q
TB37702557H
Severity: normal → critical
Keywords: crash, regression
Summary: crash wheelscrolling filters editor → crash wheelscrolling filters editor [__strtol_internal]
modifying summary. Any kind of scroll dumps core.
Summary: crash wheelscrolling filters editor [__strtol_internal] → crash scrolling in filters editor [__strtol_internal]
Incident ID 37702557 
 Stack Signature
               0x00000000 76bf6eb3 
 Bug ID
 Trigger Time 
               2001-11-07 11:11:48 
 Email Address 
               dark@c2i.net 
 URL visited 
 User Comments 
               added a rule to a filter 
 Build ID
               2001110706 
 Product ID
               MozillaTrunk 
 Platform ID
               LinuxIntel 
 Trigger Reason
               SIGSEGV: Segmentation Fault: (signal 11) 
 Stack Trace

0x00000000 
nsHTMLInputElement::GetValue() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_GetterSetter() 
js_Invoke() 
js_InternalInvoke() 
js_GetProperty() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
js_GetProperty() 
js_Interpret() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
nsXPCWrappedJSClass::CallMethod() 
nsXPCWrappedJS::CallMethod() 
PrepareAndDispatch() 
nsXPTCStubBase::Stub3() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
PresShell::HandleDOMEventWithTarget() 
nsButtonBoxFrame::MouseClicked() 
nsButtonBoxFrame::HandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEventWithTarget() 
nsEventStateManager::CheckForAndDispatchClick() 
nsEventStateManager::PostHandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEvent() 
nsView::HandleEvent() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWidget::DispatchMouseEvent() 
nsWidget::OnButtonReleaseSignal() 
nsWindow::HandleGDKEvent() 
dispatch_superwin_event() 
handle_gdk_event() 
libgdk-1.2.so.0 + 0x1716b (0x4034d16b) 
libglib-1.2.so.0 + 0x10055 (0x4037e055) 
libglib-1.2.so.0 + 0x10659 (0x4037e659) 
libglib-1.2.so.0 + 0x10725 (0x4037e725) 
nsAppShell::DispatchNativeEvent() 
nsXULWindow::ShowModal() 
nsWebShellWindow::ShowModal() 
nsContentTreeOwner::ShowAsModal() 
nsWindowWatcher::OpenWindowJS() 
GlobalWindowImpl::OpenInternal() 
GlobalWindowImpl::OpenDialog() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_CallMethod() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
JS_CallFunctionValue() 
nsJSContext::CallEventHandler() 
nsJSEventListener::HandleEvent() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
PresShell::HandleDOMEventWithTarget() 
nsButtonBoxFrame::MouseClicked() 
nsButtonBoxFrame::HandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEventWithTarget() 
nsEventStateManager::CheckForAndDispatchClick() 
nsEventStateManager::PostHandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEvent() 
nsView::HandleEvent() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWidget::DispatchMouseEvent() 
nsWidget::OnButtonReleaseSignal() 
nsWindow::HandleGDKEvent() 
dispatch_superwin_event() 
handle_gdk_event() 
libgdk-1.2.so.0 + 0x1716b (0x4034d16b) 
libglib-1.2.so.0 + 0x10055 (0x4037e055) 
libglib-1.2.so.0 + 0x10659 (0x4037e659) 
libglib-1.2.so.0 + 0x107e8 (0x4037e7e8) 
libgtk-1.2.so.0 + 0x9165b (0x4029265b) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x1c627 (0x404c5627) 
stephend, do you know who could be the appropiate owner ?
jkeiser, jst?  Not sure why QA would know anything more than a dev would...
*** Bug 109370 has been marked as a duplicate of this bug. ***
OS: Linux → All
blizzard, can you take a look and reassign to appropriate person.
*** Bug 109919 has been marked as a duplicate of this bug. ***
Over to jst since it looks like a layout crash to me.
Assignee: naving → jst
Component: Filters → Layout
Product: MailNews → Browser
Jkeiser, ideas on this one? Is this related to your form control changes? I
haven't looked into this in any detail yet...
Keywords: nsbeta1
WORKSFORME.
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → WORKSFORME
Still occurs on the tip for me. REOPENING.

Talkback ID = TB38325901X
also TB38150591W, TB38150609W
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Still a problem for me with nov19-20 commercial trunk, linux rh6.2
also crashes on 0.9.6 as well as a 4 h. old CVS, linux.
I don't see this scrolling with the scrollbar, reassigning to bryner, this seems
to be a scrollwheel specific bug.
Assignee: jst → bryner
Status: REOPENED → NEW
Resize a New filter rules dialog down to where there is one criteria line and
click More -- crash.
This is not just scrollwheel specific.
As I see it, there are four ways to scroll:
1) Use the mousewheel - crash immediately
2) Click the up and down arrows on the scrollbar - seems to work fine
3) Click anywhere else on the scrollbar - crash immediately
4) Drag the scrollbar up and down with the mouse. - Seems to work at first, but
after dragging it up and down a few times without releasing the mouse it still
crashes consistently for me

This is on Win2k btw, built from the tip a few hours ago.
Just FYI -- Am hitting this a lot, too, with Search Messages UI, both with
scrollbar/slider and More button. Mac OS X, Win98, Linux rh6.2.
Hardware: PC → All
Keywords: mailtrack
yep, this has nothing to do with mousewheel scrolling.  back to layout.
Assignee: bryner → attinasi
QA Contact: laurel → petersen
Eric, do you have any ideas on this one?
Assignee: attinasi → evaughan
*** Bug 113411 has been marked as a duplicate of this bug. ***
adding nsHTMLInputElement::GetValue to summary
Summary: crash scrolling in filters editor [__strtol_internal] → crash scrolling in filters editor [__strtol_internal] [nsHTMLInputElement::GetValue]
bug 113251 also has an identical stack
nsHTMLInputElement::GetValue has null checks all over, it's hard to believe it
can crash. The only pointer that is not null-checked before being dereferenced is
445 formControlFrame->GetProperty(nsHTMLAtoms::value, aValue);
There is an if check for frameOwnsValue before this call, which will be true
only if formControlFrame is non-null, but is it possible that the
formControlFrame is deleted in between?
Apart from that...
Definitely not a simple NULL pointer problem.  As you see from Bug #113411, you
just have to add a bunch of items in the email TO fields and you'll get a crash.
 Shoot, I didn't even have to Scroll.  Just send the email sometimes and
everything disappears.

It's a list management problem.  Filter lists, email lists ... whatever lists,
it's got a problem.  Checkout making an Email Group List and you'll get some
real funky results.  I didn't want to add a new bug, cuz it's probably a dupe of
this one.  This points to one thing: Memory Leak in managing the lists.

Not sure how the QA > Memory Leak thingy works, but it may or may not pick
something up.
Duplicate Bug 113411 appears to be fixed in the latest nightly build.  Please
check your test cases for this bug.
Great! It doesn't crash anymore on Win2k.

can no longer reproduce original bug on a current CVS build, Linux.
*** Bug 112745 has been marked as a duplicate of this bug. ***
*** Bug 114634 has been marked as a duplicate of this bug. ***
Testing with a current linux CVS: Still unable to repro.
Whatever caused this must be fixed now. Resolving as WFM.
Status: NEW → RESOLVED
Closed: 23 years ago → 23 years ago
Resolution: --- → WORKSFORME
Reopening. This started crashing again. Tested with 2002010606 and it still
crashes in a current CVS. Some scrolling up and down in filter editors "add
filter" dialog will crash it, or when clicking OK after having added the filter.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
TB1568499W TB15558805W
If you cannot reproduce it, can you try the testcase I described in (pbobably
dupe of this one) bug 123300?
Just add those custom headers I mentioned there to your prefs.js, add the rule I
supplied to your rules.dat (properly modifying destination dirs to suit your
setup) and try to edit that rule.
*** Bug 123300 has been marked as a duplicate of this bug. ***
bug 118815, bug 122278 and bug 122803 seem to be the same crash.


Still crashes on Linux 2002020415.  I've filed talkback incident ID's
TB2558594M, TB2553141Z, both of which were caused after hitting 'OK' (not while
scrolling).
This *is* bug 118815 ... and that bug seems to become the main bug now. Let's
get some traction over there.

*** This bug has been marked as a duplicate of 118815 ***
Status: REOPENED → RESOLVED
Closed: 23 years ago → 23 years ago
Resolution: --- → DUPLICATE
verified dup.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.