123086 - crash at [@ nsHTMLSelectElement::SetOptionsSelectedByIndex]

Status: RESOLVED DUPLICATE of bug 122511

(Core :: Layout: Form Controls, defect)

Description

[scottputterman]

Unfortunately I can't tell how to reproduce this.  But while looking through
talkback reports for mail crashers, I came across this.  Since the 1/14 build
and as last as the 1/29 build so far, there have been 9 reported crashes here. 
At least 4 of them appear to be when displaying a message, though the rest
appear to be when displaying a web page. 

Here are some talkback id's and comments:

  2274337  http://10.169.102.152/dom/lib/jsunit/testRunner.html  crashed when
running DOM HTML testcases on 01-29 build

  2228771   I was reading mail, moving messages, and finishing a spamcop report
- in short, something I need to do about 6000 times a day!

  1739675   Crash using 'n' to advance to the next unread newsgroup

Here's one of the mail related stacks.  I've cc'd Jean-Francois since we get
there through MIME (but there are a number of stack that get to the crashing
place in other ways)

nsHTMLSelectElement::SetOptionsSelectedByIndex
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1343]
nsHTMLSelectElement::SetSelectedIndex
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 982]
nsHTMLSelectElement::SelectSomething
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1646]
nsHTMLSelectElement::CheckSelectSomething
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1616]
nsHTMLSelectElement::DoneAddingContent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1696]
SinkContext::CloseContainer
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 1605]
HTMLContentSink::CloseContainer
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3413]
CNavDTD::CloseContainer [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 3563]
CNavDTD::CloseContainersTo
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3598]
CNavDTD::CloseContainersTo
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3782]
CNavDTD::HandleEndToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 2004]
CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 895]
CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 534]
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1985]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1849]
nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2474]
nsDocumentOpenInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 243]
nsMimeBaseEmitter::Complete
[d:\builds\seamonkey\mozilla\mailnews\mime\emitters\src\nsMimeBaseEmitter.cpp,
line 895]
nsStreamConverter::OnStopRequest
[d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 1042]
nsDocumentOpenInfo::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 254]
nsStreamListenerTee::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 25]
nsOnStopRequestEvent0::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 321]
nsStreamListenerEvent0::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 122]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
KERNEL32.DLL + 0x24407 (0xbff94407)

Comment 1

[rods (gone)]

john, please take a look.

Comment 2

[Kevin McCluskey (gone)]

Marking nsbeta1+

Comment 3

[michael wendell]

I am not able to reproduce any of these problems on Win 2k or ME using recent 
trunk builds.  Does anyone know if this is still a problem?

Comment 4

[scottputterman]

Like I said, I've never been able to reproduce this.  I'm just reporting what
I'm seeing in talkback.  According to talkback, since I created this bug, this
also occurred on the 2/1, 2/2, and 2/4 builds.  So it's still happened pretty
recently.

Comment 5

[John Keiser (jkeiser)]

Pushing out until I can reproduce or find out what the real line #'s are.

Comment 6

[John Keiser (jkeiser)]

*** This bug has been marked as a duplicate of 122511 ***