113639 - random crashes in mail

Status: VERIFIED DUPLICATE of bug 113719

(MailNews Core :: Networking, defect)

Description

[Tracy Walker [:tracy]]

seen on widnows 98 commercial trunk build:

-log in and use mail...periodically it crashes...

I can't seem to recreate any reproducable steps  it just crashes randomly.
and unfortunately I can't get to the talkback reports that were generated. :/

Comment 1

[Jon Granrose]

as an additional data point, I crashed about 5 times Monday on win98 w/20011127,
which made me try 20011130 yesterday which crashed about 5 times, and I switched
back to 6.2.  At this point I'm not trying the trunk again til 0.9.7 is cut.

Comment 2

[Scott MacGregor]

This is most likely a dup of 113618 or 113622 (we are crashing in the painting
code today in browser).

Although talkback is down so I can't look up the talkback reports.

Comment 3

[Scott MacGregor]

Tracy's mail crashes in todays builds are in tooltip code:

Joe Hewitt just landed tooltip changes last night which look like the likely
source. This seems like a high visibility crasher. Joe, it'd be great if you can
look at this soon. Thanks....

nsXULTooltipListener::GetTooltipFor
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 548]
nsXULTooltipListener::ShowTooltip
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 365]
nsTimer::Fire [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 211]
nsTimerManager::FireNextReadyTimer
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp, line 132]
nsAppShell::Run [d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp,
line 132]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303]
N

Comment 4

[Joe Hewitt (gone)]

looks like the tooltip source node is being destroyed while timers are active,
and the timer callback crashes trying to reference the tooltip source.  I just
need to cancel the timer from the listener destructor (which I thought I was
doing, but apparently am not.) Patch coming as soon as my build finishes and I
can test it..

Comment 5

[Joe Hewitt (gone)]

Attachment: this should fix it

Comment 6

[Scott MacGregor]

Comment on attachment 60548 [details] [diff] [review]
this should fix it

sr=mscott

Comment 7

[scottputterman]

*** Bug 113713 has been marked as a duplicate of this bug. ***

Comment 8

[Tracy Walker [:tracy]]

crashing random on all platforms (tough to repro though)

Comment 9

[marina]

i am crashing randomly as well .. though can not see the cause,here is a stack:
0x052785e3
nsXULTooltipListener::HideTooltip
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 500]
nsXULTooltipListener::~nsXULTooltipListener
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 74]
nsXULTooltipListener::`scalar deleting destructor'
nsXULTooltipListener::Release
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 84]
GenericListenersHashEnum
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
126]
PL_HashTableEnumerateEntries [../../../lib/ds/plhash.c, line 430]
nsHashtable::Enumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp,
line 362]
nsEventListenerManager::RemoveAllListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
172]
nsEventListenerManager::~nsEventListenerManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
141]
nsEventListenerManager::`scalar deleting destructor'
nsEventListenerManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
186]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsXULDocument::~nsXULDocument
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp]
nsXULDocument::`scalar deleting destructor'
nsXULDocument::Release
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 602]
nsEventStateManager::~nsEventStateManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 235]
nsEventStateManager::`scalar deleting destructor'
nsEventStateManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 307]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsPresContext::~nsPresContext
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresContext.cpp, line 121]
GalleyContext::`scalar deleting destructor'
nsPresContext::Release
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresContext.cpp, line 235]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
DocumentViewerImpl::~DocumentViewerImpl
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 926]
DocumentViewerImpl::Release
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 895]
nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 74]
nsWebShell::Destroy [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp,
line 1424]
nsXULWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 365]
nsWebShell::Destroy [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp,
line 1424]
nsXULWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 365]
nsWebShellWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp, line 1761]
nsChromeTreeOwner::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsChromeTreeOwner.cpp, line 224]
nsMsgCompose::CloseWindow
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 1133]
nsMsgComposeSendListener::OnStopCopy
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 2429]
nsMsgComposeAndSend::NotifyListenerOnStopCopy
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 3598]
CopyListener::OnStopCopy
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCopy.cpp, line 157]
nsImapMailFolder::OnStopRunningUrl
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 4073]
nsUrlListenerManager::BroadcastChange
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsUrlListenerManager.cpp, line 99]
nsUrlListenerManager::OnStopRunningUrl
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsUrlListenerManager.cpp, line 128]
nsMsgMailNewsUrl::SetUrlState
[d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgMailNewsUrl.cpp, line 131]
nsImapMailFolder::SetUrlState
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 4660]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 154]
EventHandler [d:\builds\seamonkey\mozilla\xpcom\proxy\src\nsProxyEvent.cpp, line
515]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303]
netscp6.exe + 0x169f (0x0040169f)
netscp6.exe + 0x121c (0x0040121c)
netscp6.exe + 0x324b (0x0040324b)
KERNEL32.DLL + 0x7903 (0x77e87903) 

Comment 10

[Nick Atkins]

FYI, build 2001120603 win2000, "send email" crashes every time when I click the
"Send" button (the tooptip issue I think).  Send works fine if I do File->Send now.

Comment 11

[Scott MacGregor]

should this be upgraded to a smoketest blocker? These random crashes in tooltips
are making it very hard to use. I haven't verified the crash when clicking the
send button yet. But if that's true, this definetly should be a blocker.

Comment 12

[marina]

actually i get the same stack in the crash bug i reported yesterday , # 113719
(crash when using tabulation in html mail)

Comment 13

[Scott MacGregor]

marina's crash looks equally as bad but different. I spun off 113850 to track
that.  

Comment 14

[Nick Atkins]

FYI, switching off "show tooltips" in prefs works around the problem.

Comment 15

[Joe Hewitt (gone)]

*blush* I suck.  

I'm holding weak refs to a bunch of content nodes so that I don't leak, but it
seems they are getting destroyed before I expected on a number of occasions,
thus causing these crashes.  I probably need to use strong refs in a few places.

Comment 16

[Joe Hewitt (gone)]

Attachment: patcho

This patch does 3 things:

1. fix the crash caused by not canceling the timer when the listener is
destroyed.f
2. fix the crash caused when the window is closed during the time the tooltip
is about to show
3. turn off titletips for now, since they are annoying people and I want to
take my time making them work correctly.

Comment 17

[Scott MacGregor]

Comment on attachment 60746 [details] [diff] [review]
patcho

r=mscott

Comment 18

[Joe Hewitt (gone)]

fix checked in.  I have not been able to reproduce this crash, so I can't verify
this patch works, but I am pretty sure it would prevent the crashes at the
stacks that people posted.

Comment 19

[eberry]

*** Bug 113931 has been marked as a duplicate of this bug. ***

Comment 20

[Tracy Walker [:tracy]]

didn't crash on windows or linux this morning, but did crash on mac.  since this 
is tough to reproduce consistantly, I am going to wait to verify this after 
further testing/use.

Comment 21

[[e-mail] (gone - use [e-mail] instead)]

*** Bug 114084 has been marked as a duplicate of this bug. ***

Comment 22

[[e-mail] (gone - use [e-mail] instead)]

Re-opening to DUP against the bug with talkback info and a better summary.

Comment 23

[[e-mail] (gone - use [e-mail] instead)]

*** This bug has been marked as a duplicate of 113719 ***

Comment 24

[Karen Huang]

Nerified as dup.

Comment 25

[Karen Huang]

Oops! I mean "Verified" as dup.

Comment 26

[Joe Hewitt (gone)]

*** Bug 113836 has been marked as a duplicate of this bug. ***