122278 - crash adding condition to mail filter

Status: RESOLVED DUPLICATE of bug 118815

(Core :: Layout: Form Controls, defect)

Description

[Chris Waterson]

I'm consistently crashing adding a new condition to a mail filter. The filter
already has several conditions (like, maybe six), and I'm crashing adding the
next one. I'll attach a full stack trace, which winds up in the HTML form
controls calling QueryInterface on a dead frame. Here are the top few frames:

#0  0x0000101b in ?? ()
#1  0x414b0e6a in nsGenericHTMLElement::GetFormControlFrameFor (
    aContent=0x89180c0, aDocument=0x8c2ae48, aFlushContent=0)
    at
../../../../../mozilla/content/html/content/src/nsGenericHTMLElement.cpp:2805
#2  0x41732594 in nsGenericHTMLElement::GetFormControlFrame (this=0x89180c0, 
    aFlushContent=0)
    at
../../../../../mozilla/content/html/content/src/nsGenericHTMLElement.h:217
#3  0x414da259 in nsHTMLInputElement::GetValue (this=0x89180c0, 
    aValue=@0xbfffaeb8)
    at
../../../../../mozilla/content/html/content/src/nsHTMLInputElement.cpp:430
#4  0x4023a468 in XPTC_InvokeByIndex (that=0x89180ec, methodIndex=87, 
    paramCount=1, params=0xbfffaf68)
    at
../../../../../../../mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:153

Comment 1

[Chris Waterson]

Attachment: full stack trace

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I might have seen another bug like this.  Was there an assertion before the crash?

Comment 3

[R.K.Aa.]

bug 118815

Comment 4

[Chris Waterson]

Several of these assertions appear as the window comes up, and while the list is
scrolled:

###!!! ASSERTION: nsBox::ERROR!! Box info list count does not match frame
count!!: 'length == mChildCount', file
../../../../../mozilla/layout/xul/base/src/nsContainerBox.cpp, line 416

However, no assertions appear immediately before the crash.

Comment 5

[Alec Flett]

ack, why are we hitting HTML form controls here? these should be XUL menulists?
something is very screwy..

Comment 6

[R.K.Aa.]

How many of this bug is it practical to keep open?
Bug 108922 and bug 118815 seem to have identical or very similar stacks and in
all cases the crash happens when adding rules to filters.

Comment 7

[rods (gone)]

-->>

Comment 8

[R.K.Aa.]

also reported in bug 122803 and bug 123300.

Comment 9

[Brendan Eich [:brendan]]

I crashed adding a term to my spam filter, too.  I retried and didn't crash, not
sure what was different.  Both times, I was customizing the header list to add
X-Bugzilla-Reason (the first time, which crashed, the customization did not
persist).

/be

Comment 10

[Navin Gupta]

clicking on "more" crashes. I suspect scrolling is causing it. 

*** This bug has been marked as a duplicate of 118815 ***