Closed Bug 113719 Opened 22 years ago Closed 22 years ago

Crash on sending mail when using tabulation in HTML mail compose - Trunk [@ nsXULTooltipListener::HideTooltip]

Categories

(MailNews Core :: Composition, defect)

Product:
MailNews Core
Component:
Composition
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: marina, Assigned: hewitt)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

Attachments

(1 file)

patch
2.69 KB, patch
jag+mozilla
: review+
hewitt
: superreview+
Details | Diff | Splinter Review 
*** observed with 2001-12-05-04 build ***
Steps to reproduce:
- open new mail composition;
- fill out the recipient field;
- using tab proceed to the Subject field;
- then to the mail body, tab more so that you won't start typing at the very
beginning;
- enter some text;
- click Send, observe the crash. it doesn't crash with plain text mail
mail is actually sent out despite the crash, here is a stack:
0x048ae01a
nsXULTooltipListener::HideTooltip
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 500]
nsXULTooltipListener::~nsXULTooltipListener
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 74]
nsXULTooltipListener::`scalar deleting destructor'
nsXULTooltipListener::Release
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 84]
GenericListenersHashEnum
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
125]
_hashEnumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 199]
PL_HashTableEnumerateEntries [../../../lib/ds/plhash.c, line 430]
nsHashtable::Enumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp,
line 362]
nsEventListenerManager::RemoveAllListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
171]
nsEventListenerManager::~nsEventListenerManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
140]
nsEventListenerManager::`scalar deleting destructor'
nsEventListenerManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
185]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsXULDocument::~nsXULDocument
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp]
nsXULDocument::`scalar deleting destructor'
nsXULDocument::Release
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 602]
nsEventStateManager::~nsEventStateManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 235]
nsEventStateManager::`scalar deleting destructor'
nsEventStateManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 307]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsPresContext::~nsPresContext
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresContext.cpp, line 121]
GalleyContext::`scalar deleting destructor'
nsPresContext::Release
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresContext.cpp, line 235]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
DocumentViewerImpl::~DocumentViewerImpl
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 926]
nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 74]
nsWebShell::Destroy [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp,
line 1424]
nsXULWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 365]
0x56077401
Severity: normal → major
Keywords: crash
I am using the same build on win98. I am not crashing in HTML compose window or
plain text compose.  I am following the steps that you mentioned but don't see
crash on win98 (2001-12-05-04)
Severity: major → critical
it happens to me all the time on Win2K
i crash today with 2001-12-06-03 build as well, it looks like the stack is the
same,incident ID:130678. By the way Tracy reported a random crash today, bug #
113639, they could be related
this bug should go to hewitt. More fall out from the tooltip landing.
Assignee: ducarroz → hewitt
Severity: critical → blocker
Keywords: nsbeta1, regression
*** Bug 113850 has been marked as a duplicate of this bug. ***
Summary: Crash on sending mail when using tabulation in HTML mail composition → Crash on sending mail when using tabulation in HTML mail compose [@ nsXULTooltipListener::HideTooltip]
*** Bug 113809 has been marked as a duplicate of this bug. ***
I crash in GKLAYOUT.DLL by just browsing.

TB134152Y
TB135420Y
Eugene, same crash:

Stack Signature  nsXULTooltipListener::GetTooltipFor af5e2186
Trigger Time 2001-12-06 11:58:24
Email Address
URL visited
User Comments
Build ID 2001120606
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
Stack Trace
nsXULTooltipListener::GetTooltipFor
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 548]
nsXULTooltipListener::ShowTooltip
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 365]
nsTimer::Fire [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 211]
FireTimeout [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 93]
KERNEL32.DLL + 0x2317 (0xbff72317)
FireTimeout [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 66]
USER32.DLL + 0x3bb5 (0xbff53bb5)
0x141c0003
0x74fffea9 
On today's linux build I saw the same crash using plain text compose too. 
Talkback id: 143012.
OS: Windows 2000 → All
Win98SE, I only see this crash when composing a news post/reply, never in email
for some reason.
fixed, I think.
Status: NEW → RESOLVED
Closed: 22 years ago
Resolution: --- → FIXED
*** Bug 113929 has been marked as a duplicate of this bug. ***
*** Bug 113940 has been marked as a duplicate of this bug. ***
*** Bug 113961 has been marked as a duplicate of this bug. ***
Adding topcrash keyword and [@ nsXULTooltipListener::GetTooltipFor] to
summary...this is a topcrasher with recent MozillaTrunk builds.  Looks like this
was just fixed, but here's the Talkback data anyway:

nsXULTooltipListener::GetTooltipFor   15 
BBID range: 74724 - 148333
Min/Max Seconds since last crash: 42 - 25262
Min/Max Runtime: 195 - 33860
Crash data range: 2001-12-05 to 2001-12-06
Build ID range: 2001120506 to 2001120609
Keyword List : 
Stack Trace: 

	 nsXULTooltipListener::GetTooltipFor
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp  line 548]
	 nsXULTooltipListener::ShowTooltip
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp  line 365]
	 nsTimer::Fire
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp  line 211]
	 nsTimerManager::FireNextReadyTimer
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp  line 132]
	 nsAppShell::Run
[d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp  line 132]
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 303]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1285]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1602]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1620]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x7903 (0x77e87903)
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/xul/base/src/nsXULTooltipListener.cpp
line : 548
     (148333)	Comments: closing windows
     (127340)	Comments: Posting a reply in secnews.netscape.com/netscape.communicator
     (123629)	URL: http://yellowtimes.org/article.php?sid=32&mode=thread&order=0
(119745)
Comments: was looking at the DOM object of a page in the side bar and mozilla
crashed in gklayout.dll
     (117175)	Comments: posting reply in secnews.communicator
     (112340)	Comments: I closed a Mozilla window.
     (99149)	Comments: Opening new news article on secnews
     (84033)	Comments: crash when trying to close the browser
     (74724)	Comments: crash in mail
Keywords: topcrash
Summary: Crash on sending mail when using tabulation in HTML mail compose [@ nsXULTooltipListener::HideTooltip] → Crash on sending mail when using tabulation in HTML mail compose - Trunk [@ nsXULTooltipListener::HideTooltip][@ nsXULTooltipListener::GetTooltipFor]
*** Bug 113639 has been marked as a duplicate of this bug. ***
I am re-opening this because I have had 2 crashes with today's
build (20011210 Win32 build) right after sending a mail msg:

http://climate/reports/SingleIncidentInfo.cfm?dynamicBBID=296453

======
Stack Signature  0x05252601 28dd0955
Trigger Time 2001-12-10 12:45:15
Email Address momoi@netscape.com
URL visited
User Comments
Build ID 2001121006
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
Stack Trace
0x05252601
nsXULTooltipListener::HideTooltip
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 506]
nsXULTooltipListener::~nsXULTooltipListener
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 77]
nsXULTooltipListener::`scalar deleting destructor'
nsXULTooltipListener::Release
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 87]
GenericListenersHashEnum
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
126]
PL_HashTableEnumerateEntries [../../../lib/ds/plhash.c, line 430]
nsHashtable::Enumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp,
line 362]
nsEventListenerManager::RemoveAllListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
172]
nsEventListenerManager::~nsEventListenerManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
141]
nsEventListenerManager::`scalar deleting destructor'
nsEventListenerManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
186]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsXULDocument::~nsXULDocument
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp]
nsXULDocument::`scalar deleting destructor'
nsXULDocument::Release
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 602]
nsEventStateManager::~nsEventStateManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 235]
nsEventStateManager::`scalar deleting destructor'
nsEventStateManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 307]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsPresContext::~nsPresContext
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresContext.cpp, line 121]
GalleyContext::`scalar deleting destructor'
nsPresContext::Release
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresContext.cpp, line 235]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
DocumentViewerImpl::~DocumentViewerImpl
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 926]
DocumentViewerImpl::`scalar deleting destructor'
DocumentViewerImpl::Release
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 895]
nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 74]
nsWebShell::Destroy [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp,
line 1444]
nsXULWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 365]
PR_Unlock [../../../../../pr/src/threads/combined/prulock.c, line 353]
nsWebShellWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp, line 1761]
appshell.dll + 0xc7a8 (0x600bc7a8)
nsAppShellService::AddRef
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 127]
0x85107d8b
======
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
*** Bug 114670 has been marked as a duplicate of this bug. ***
It looks like we posted 2 different crashes in this bug.  The original crash:
nsXULTooltipListener::HideTooltip
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 500]
is still happening, but now line nsXULTooltipListener.cpp, line 506.

I think the other crash reported here:
nsXULTooltipListener::GetTooltipFor
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 548]
which is also reported in bug 114043 has been fixed.  Taking [@
nsXULTooltipListener::GetTooltipFor] off the summary.
Summary: Crash on sending mail when using tabulation in HTML mail compose - Trunk [@ nsXULTooltipListener::HideTooltip][@ nsXULTooltipListener::GetTooltipFor] → Crash on sending mail when using tabulation in HTML mail compose - Trunk [@ nsXULTooltipListener::HideTooltip]
this gets me about 50% of the time I send mail. Someone please fix this. I'm
dying here. I'm still seeing it on the 2001-12-11-03 build on Win32, just look
at my talkback reports, it accounts for most of my crashes

I don't know if this helps, but I use a touchpad, which means my mouse probably
doesn't move when I click on the send button.. maybe some people don't see this
because they move thier mouse soon after they click the button?
Still seeing this in 2001121203 Win98Se
My understanding about the remaining crash problem is
that it occurs when the tooltip for the "Send" button
is lingering when the send process is taking place. 
I usually click on the Send button with a mouse and
often the tooltip is visible. When I can "trap" the tooltip
info in the manner I described, this crash is very easy to
reproduce. For using trunk builds for e-mail, this problem
is pretty near a blocker for me.
Blocks: 11445
Blocks: 114455
No longer blocks: 11445
Attached patch patch — — Splinter Review 
I thought I could get away with not owning the reference to the tooltip
content, but I guess I was wrong.  This patch makes it an owning reference.  It
shouldn't leak, the ref is only owned during the time the tooltip is open and
is also released when the listener is destroyed.
Comment on attachment 61626 [details] [diff] [review]
patch

hyatt sez sr=hyatt
Attachment #61626 - Flags: superreview+
Comment on attachment 61626 [details] [diff] [review]
patch

r=jag
Attachment #61626 - Flags: review+
Joe, can you petition this for the 097 branch? This makes mail look a bit more
unstable then I think we'd like for a milestone release....
Keywords: mozilla0.9.7
*** Bug 115244 has been marked as a duplicate of this bug. ***
*** Bug 115371 has been marked as a duplicate of this bug. ***
*** Bug 115235 has been marked as a duplicate of this bug. ***
This bug causes a nasty crash in 2001121405 on Mac OS X. To reproduce:
1. Open a mail message in a standalone window.
2. Move cursor over a toolbar button so that a tooltip is displayed.
3. Without moving cursor, close window using Command-w.

Does not crash if tooltips are disabled in preferences.

a=asa (on behalf of drivers) for checkin to 0.9.7
Keywords: mozilla0.9.7 → mozilla0.9.7+
fixed on trunk and branch
Status: REOPENED → RESOLVED
Closed: 22 years ago → 22 years ago
Resolution: --- → FIXED
No longer blocks: 114455
commercial build: 2002-01-03-06 win98, mac os x, linux rh 6.2
Verified by following the steps described below. Does not crash anymore.
Status: RESOLVED → VERIFIED
Product: MailNews → Core
Product: Core → MailNews Core
Crash Signature: [@ nsXULTooltipListener::HideTooltip]
You need to log in before you can comment on or make changes to this bug.