108922 - crash scrolling in filters editor [__strtol_internal] [nsHTMLInputElement::GetValue]

Status: VERIFIED DUPLICATE of bug 118815

(Core :: Layout, defect)

Description

[R.K.Aa.]

Linux 2001110706

open edit/filters
select a filter
click "Edit"

As filter rule editor opens, I see around 30 lines of:
 Warning prev sibling is not in our list!!!

now wheelscroll down in pane displaying filters: it scrolls
wheelscroll up again: crash

non-debug 2001110706 linux seems to crash in
 __strtol_internal (nptr=0x8fc7130 "À\022&A0", endptr=0xbfffb338, base=0, 
    group=0) at eval.c:36

TB37702715Q
TB37702557H

Comment 1

[R.K.Aa.]

modifying summary. Any kind of scroll dumps core.

Comment 2

[[e-mail] (gone - use [e-mail] instead)]

Incident ID 37702557 
 Stack Signature
               0x00000000 76bf6eb3 
 Bug ID
 Trigger Time 
               2001-11-07 11:11:48 
 Email Address 
               [e-mail] 
 URL visited 
 User Comments 
               added a rule to a filter 
 Build ID
               2001110706 
 Product ID
               MozillaTrunk 
 Platform ID
               LinuxIntel 
 Trigger Reason
               SIGSEGV: Segmentation Fault: (signal 11) 
 Stack Trace

0x00000000 
nsHTMLInputElement::GetValue() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_GetterSetter() 
js_Invoke() 
js_InternalInvoke() 
js_GetProperty() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
js_GetProperty() 
js_Interpret() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
nsXPCWrappedJSClass::CallMethod() 
nsXPCWrappedJS::CallMethod() 
PrepareAndDispatch() 
nsXPTCStubBase::Stub3() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
PresShell::HandleDOMEventWithTarget() 
nsButtonBoxFrame::MouseClicked() 
nsButtonBoxFrame::HandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEventWithTarget() 
nsEventStateManager::CheckForAndDispatchClick() 
nsEventStateManager::PostHandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEvent() 
nsView::HandleEvent() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWidget::DispatchMouseEvent() 
nsWidget::OnButtonReleaseSignal() 
nsWindow::HandleGDKEvent() 
dispatch_superwin_event() 
handle_gdk_event() 
libgdk-1.2.so.0 + 0x1716b (0x4034d16b) 
libglib-1.2.so.0 + 0x10055 (0x4037e055) 
libglib-1.2.so.0 + 0x10659 (0x4037e659) 
libglib-1.2.so.0 + 0x10725 (0x4037e725) 
nsAppShell::DispatchNativeEvent() 
nsXULWindow::ShowModal() 
nsWebShellWindow::ShowModal() 
nsContentTreeOwner::ShowAsModal() 
nsWindowWatcher::OpenWindowJS() 
GlobalWindowImpl::OpenInternal() 
GlobalWindowImpl::OpenDialog() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_CallMethod() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
JS_CallFunctionValue() 
nsJSContext::CallEventHandler() 
nsJSEventListener::HandleEvent() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
PresShell::HandleDOMEventWithTarget() 
nsButtonBoxFrame::MouseClicked() 
nsButtonBoxFrame::HandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEventWithTarget() 
nsEventStateManager::CheckForAndDispatchClick() 
nsEventStateManager::PostHandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEvent() 
nsView::HandleEvent() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWidget::DispatchMouseEvent() 
nsWidget::OnButtonReleaseSignal() 
nsWindow::HandleGDKEvent() 
dispatch_superwin_event() 
handle_gdk_event() 
libgdk-1.2.so.0 + 0x1716b (0x4034d16b) 
libglib-1.2.so.0 + 0x10055 (0x4037e055) 
libglib-1.2.so.0 + 0x10659 (0x4037e659) 
libglib-1.2.so.0 + 0x107e8 (0x4037e7e8) 
libgtk-1.2.so.0 + 0x9165b (0x4029265b) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x1c627 (0x404c5627) 

Comment 3

[Navin Gupta]

stephend, do you know who could be the appropiate owner ?

Comment 4

[[e-mail] (gone - use [e-mail] instead)]

jkeiser, jst?  Not sure why QA would know anything more than a dev would...

Comment 5

[R.K.Aa.]

*** Bug 109370 has been marked as a duplicate of this bug. ***

Comment 6

[Navin Gupta]

blizzard, can you take a look and reassign to appropriate person.

Comment 7

[laurel]

*** Bug 109919 has been marked as a duplicate of this bug. ***

Comment 8

[Christopher Blizzard (:blizzard)]

Over to jst since it looks like a layout crash to me.

Comment 9

[Johnny Stenback (:jst)]

Jkeiser, ideas on this one? Is this related to your form control changes? I
haven't looked into this in any detail yet...

Comment 10

[Johnny Stenback (:jst)]

WORKSFORME.

Comment 11

[Arnoud Berendsen]

Still occurs on the tip for me. REOPENING.

Talkback ID = TB38325901X
also TB38150591W, TB38150609W

Comment 12

[laurel]

Still a problem for me with nov19-20 commercial trunk, linux rh6.2

Comment 13

[R.K.Aa.]

also crashes on 0.9.6 as well as a 4 h. old CVS, linux.

Comment 14

[Johnny Stenback (:jst)]

I don't see this scrolling with the scrollbar, reassigning to bryner, this seems
to be a scrollwheel specific bug.

Comment 15

[laurel]

Resize a New filter rules dialog down to where there is one criteria line and
click More -- crash.

Comment 16

[Arnoud Berendsen]

This is not just scrollwheel specific.
As I see it, there are four ways to scroll:
1) Use the mousewheel - crash immediately
2) Click the up and down arrows on the scrollbar - seems to work fine
3) Click anywhere else on the scrollbar - crash immediately
4) Drag the scrollbar up and down with the mouse. - Seems to work at first, but
after dragging it up and down a few times without releasing the mouse it still
crashes consistently for me

This is on Win2k btw, built from the tip a few hours ago.

Comment 17

[laurel]

Just FYI -- Am hitting this a lot, too, with Search Messages UI, both with
scrollbar/slider and More button. Mac OS X, Win98, Linux rh6.2.

Comment 18

[Brian Ryner (not reading)]

yep, this has nothing to do with mousewheel scrolling.  back to layout.

Comment 19

[Kevin McCluskey (gone)]

Eric, do you have any ideas on this one?

Comment 20

[Ashley Bischoff (blog at handcoding.com)]

*** Bug 113411 has been marked as a duplicate of this bug. ***

Comment 21

[R.K.Aa.]

adding nsHTMLInputElement::GetValue to summary

Comment 22

[R.K.Aa.]

bug 113251 also has an identical stack

Comment 23

[Fabian Guisset]

nsHTMLInputElement::GetValue has null checks all over, it's hard to believe it
can crash. The only pointer that is not null-checked before being dereferenced is
445 formControlFrame->GetProperty(nsHTMLAtoms::value, aValue);
There is an if check for frameOwnsValue before this call, which will be true
only if formControlFrame is non-null, but is it possible that the
formControlFrame is deleted in between?
Apart from that...

Comment 24

[Jeff Pitman]

Definitely not a simple NULL pointer problem.  As you see from Bug #113411, you
just have to add a bunch of items in the email TO fields and you'll get a crash.
 Shoot, I didn't even have to Scroll.  Just send the email sometimes and
everything disappears.

It's a list management problem.  Filter lists, email lists ... whatever lists,
it's got a problem.  Checkout making an Email Group List and you'll get some
real funky results.  I didn't want to add a new bug, cuz it's probably a dupe of
this one.  This points to one thing: Memory Leak in managing the lists.

Not sure how the QA > Memory Leak thingy works, but it may or may not pick
something up.

Comment 25

[Jeff Pitman]

Duplicate Bug 113411 appears to be fixed in the latest nightly build.  Please
check your test cases for this bug.

Comment 26

[Arnoud Berendsen]

Great! It doesn't crash anymore on Win2k.

Comment 27

[R.K.Aa.]

can no longer reproduce original bug on a current CVS build, Linux.

Comment 28

[Navin Gupta]

*** Bug 112745 has been marked as a duplicate of this bug. ***

Comment 29

[R.K.Aa.]

*** Bug 114634 has been marked as a duplicate of this bug. ***

Comment 30

[R.K.Aa.]

Testing with a current linux CVS: Still unable to repro.
Whatever caused this must be fixed now. Resolving as WFM.

Comment 31

[R.K.Aa.]

Reopening. This started crashing again. Tested with 2002010606 and it still
crashes in a current CVS. Some scrolling up and down in filter editors "add
filter" dialog will crash it, or when clicking OK after having added the filter.

Comment 32

[R.K.Aa.]

TB1568499W TB15558805W

Comment 33

[Aleksander Adamowski]

If you cannot reproduce it, can you try the testcase I described in (pbobably
dupe of this one) bug 123300?
Just add those custom headers I mentioned there to your prefs.js, add the rule I
supplied to your rules.dat (properly modifying destination dirs to suit your
setup) and try to edit that rule.

Comment 34

[R.K.Aa.]

*** Bug 123300 has been marked as a duplicate of this bug. ***

Comment 35

[R.K.Aa.]

bug 118815, bug 122278 and bug 122803 seem to be the same crash.

Comment 36

[Henry Throop]

Still crashes on Linux 2002020415.  I've filed talkback incident ID's
TB2558594M, TB2553141Z, both of which were caused after hitting 'OK' (not while
scrolling).

Comment 37

[Håkan Waara]

This *is* bug 118815 ... and that bug seems to become the main bug now. Let's
get some traction over there.

*** This bug has been marked as a duplicate of 118815 ***

Comment 38

[[e-mail] (gone - use [e-mail] instead)]

verified dup.