113850 - crash with new tooltip code [@ nsXULTooltipListener::HideTooltip]

Status: VERIFIED DUPLICATE of bug 113719

(Core :: XUL, defect)

Description

[Scott MacGregor]

Marina is reporting a new crash (different from 113693) when closing windows
that have shown tooltips. Looks like we are crashing when destroying the xul
window, trying to hide the tooltip:

i am crashing randomly as well .. though can not see the cause,here is a stack:
0x052785e3
nsXULTooltipListener::HideTooltip
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 500]
nsXULTooltipListener::~nsXULTooltipListener
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 74]
nsXULTooltipListener::`scalar deleting destructor'
nsXULTooltipListener::Release
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTooltipListener.cpp, line 84]
GenericListenersHashEnum
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
126]
PL_HashTableEnumerateEntries [../../../lib/ds/plhash.c, line 430]
nsHashtable::Enumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp,
line 362]
nsEventListenerManager::RemoveAllListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
172]
nsEventListenerManager::~nsEventListenerManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
141]
nsEventListenerManager::`scalar deleting destructor'
nsEventListenerManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
186]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsXULDocument::~nsXULDocument
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp]
nsXULDocument::`scalar deleting destructor'
nsXULDocument::Release
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 602]
nsEventStateManager::~nsEventStateManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 235]
nsEventStateManager::`scalar deleting destructor'
nsEventStateManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 307]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsPresContext::~nsPresContext
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresContext.cpp, line 121]
GalleyContext::`scalar deleting destructor'
nsPresContext::Release
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresContext.cpp, line 235]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
DocumentViewerImpl::~DocumentViewerImpl
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 926]
DocumentViewerImpl::Release
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 895]
nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 74]
nsWebShell::Destroy [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp,
line 1424]
nsXULWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 365]
nsWebShell::Destroy [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp,
line 1424]
nsXULWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 365]
nsWebShellWindow::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp, line 1761]
nsChromeTreeOwner::Destroy
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsChromeTreeOwner.cpp, line 224]
nsMsgCompose::CloseWindow
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 1133]
nsMsgComposeSendListener::OnStopCopy
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 2429]
nsMsgComposeAndSend::NotifyListenerOnStopCopy
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgSend.cpp, line 3598]
CopyListener::OnStopCopy
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCopy.cpp, line 157]
nsImapMailFolder::OnStopRunningUrl
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 4073]
nsUrlListenerManager::BroadcastChange
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsUrlListenerManager.cpp, line 99]
nsUrlListenerManager::OnStopRunningUrl
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsUrlListenerManager.cpp, line 128]
nsMsgMailNewsUrl::SetUrlState
[d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgMailNewsUrl.cpp, line 131]
nsImapMailFolder::SetUrlState
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 4660]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 154]
EventHandler [d:\builds\seamonkey\mozilla\xpcom\proxy\src\nsProxyEvent.cpp, line
515]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run

Comment 1

[Scott MacGregor]

keyword magic.

Comment 2

[Scott MacGregor]

marina already filed this as 113719. Sorry about that. duping. 

*** This bug has been marked as a duplicate of 113719 ***