127748 - Crash in nsAbMDBDirectory::DeleteCards deleting 2 Auto-Collected Cards

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Address Book & Contacts, defect)

Description

[[e-mail] (gone - use [e-mail] instead)]

Build ID: darin's URL patch build (see bug 124042 for more info).

I've had a hard time reproducing this in either his build or a current trunk 
again.

Summary: Crash in nsAbMDBDirectory::DeleteCards deleting 2 Auto-Collected Cards.

Steps to Reproduce:

This is hard to reproduce, but in case we can bullet-proof something here, I 
filed this.

1. Try to batch delete 2 or more Auto-Collected Address Book cards.

00f75c1b()
nsAbMDBDirectory::DeleteCards(nsAbMDBDirectory * const 0x00000000, 
nsISupportsArray * 0x0305bdc0) line 535
nsAbView::DeleteSelectedCards(nsAbView * const 0x0301cea8) line 1092 + 12 bytes
XPTC_InvokeByIndex(nsISupports * 0x0301cea8, unsigned int 12, unsigned int 0, 
nsXPTCVariant * 0x0012e2f8) line 106
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
49085728) line 2017 + 22 bytes
XPC_WN_CallMethod(JSContext * 0x02fd4968, JSObject * 0x02ecfd20, unsigned int 
0, long * 0x02ff140c, long * 0x02ff1388) line 1266 + 10 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 0, unsigned int 0) line 832 + 17 
bytes
js_Interpret(JSContext * 0x02fd4968, long * 0x0012e798) line 2802 + 13 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 849 + 10 
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x024db460, 
nsXPCWrappedJS * 0x01f5de38, unsigned short 5, const nsXPTMethodInfo * 
0x019147a8, nsXPTCMiniVariant * 0x0012ea30) line 1193 + 16 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x02f5de38, unsigned short 5, 
const nsXPTMethodInfo * 0x019147a8, nsXPTCMiniVariant * 0x0012ea30) line 430
PrepareAndDispatch(nsXPTCStubBase * 0x019147a8, unsigned int 5, unsigned int * 
0x0012eae8, unsigned int * 0x0012ead8) line 115 + 18 bytes
SharedStub() line 139
XPTC_InvokeByIndex(nsISupports * 0x02f5de38, unsigned int 5, unsigned int 1, 
nsXPTCVariant * 0x0012eb14) line 106
XPCWrappedNative::CallMethod(XPCCallContext & {...}, 
XPCWrappedNative::CallMode -1343107320) line 2017 + 22 bytes
XPC_WN_CallMethod(JSContext * 0x02fd4968, JSObject * 0x02f1cf08, unsigned int 
1, long * 0x047f68f0, long * 0x047f68c0) line 1266 + 10 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 0) line 832 + 17 
bytes
js_Interpret(JSContext * 0x02fd4968, long * 0x0012efb4) line 2802 + 13 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 849 + 10 
bytes
js_InternalInvoke(JSContext * 0x00000000, JSObject * 0x02dd0638, long 49402320, 
unsigned int 0, unsigned int 1, long * 0x0012f180, long * 0x0012f0d0) line 924 
+ 13 bytes
JS_CallFunctionValue(JSContext * 0x02fd4968, JSObject * 0x02dd0638, long 
49402320, unsigned int 1, long * 0x0012f180, long * 0x0012f0d0) line 3415 + 26 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x00f57bf0, void * 
0x02dd0638, void * 0x02f1d1d0, unsigned int 1, void * 0x0012f180, int * 
0x0012f19c, int 0) line 1016 + 25 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02fd4968, 
nsIDOMEvent * 0x030bf878) line 180 + 30 bytes
nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const 
0x01664a24 const  nsXULAttribute::`vftable'{for `nsIDOM3Node'}, 
nsListenerStruct * 0x02c7c118, nsIDOMEvent * 0x030bf880, nsIDOMEventTarget * 
0x0307b258, unsigned int 50153832, unsigned int 75735392) line 1217 + 9 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02c98040, 
nsIPresContext * 0x00000000, nsEvent * 0x0012f760, nsIDOMEvent * * 0x00000000, 
nsIDOMEventTarget * 0x0307b258, unsigned int 7, nsEventStatus * 0x0012f7b4) 
line 2207 + 16 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x02ce8338, nsEvent * 0x03083cc0, nsIDOMEvent * * 0x0012f5cc, unsigned int 1, 
nsEventStatus * 0x0012f7b4) line 3453
PresShell::HandleDOMEventWithTarget(PresShell * const 0x02ce8cf0, nsIContent * 
0x02ec5554, nsEvent * 0x0012f760, nsEventStatus * 0x0012f7b4) line 6052
nsButtonBoxFrame::MouseClicked(nsButtonBoxFrame * const 0x01664a24, 
nsIPresContext * 0x02ce8338, nsGUIEvent * 0x0012f8a0) line 195
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x048664d0, 
nsIPresContext * 0x02ce8338, nsGUIEvent * 0x0012f8a0, nsEventStatus * 
0x0012fa68) line 142
PresShell::HandleEventInternal(PresShell * const 0x01664a24, nsEvent * 
0x0312cd10, nsIView * 0x00000000, unsigned int 1, nsEventStatus * 0x0012fa68) 
line 6017 + 17 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x02ce8cf0, nsEvent * 
0x0012f8a0, nsIFrame * 0x048664d0, nsIContent * 0x0307b250, unsigned int 1, 
nsEventStatus * 0x0012fa68) line 5972
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 
0x02ce8cf0, nsIPresContext * 0x02ce8338, nsMouseEvent * 0x0012fb30, 
nsEventStatus * 0x0012fa68) line 2588
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x0312cd10, 
nsIPresContext * 0x02ce8338, nsEvent * 0x0012fb30, nsIFrame * 0x048664d0, 
nsEventStatus * 0x0012fa68, nsIView * 0x03109390) line 1668 + 17 bytes
PresShell::HandleEventInternal(PresShell * const 0x01664a24, nsEvent * 
0x0312cd10, nsIView * 0x03109390, unsigned int 1, nsEventStatus * 0x0012fa68) 
line 6022 + 23 bytes
PresShell::HandleEvent(PresShell * const 0x02ce8cf0, nsIView * 0x03109390, 
nsGUIEvent * 0x0012fb30, nsEventStatus * 0x0012fa68, int 1, int & 1) line 5925 
+ 17 bytes
nsViewManager::HandleEvent(nsViewManager * const 0x01664a24, nsView * 
0x00000000, nsGUIEvent * 0x00000000, int 1) line 2043
nsView::HandleEvent(nsView * const 0x01664a24, nsViewManager * 0x02b8be38, 
nsGUIEvent * 0x0012fb30, int 1) line 306
nsViewManager::DispatchEvent(nsViewManager * const 0x02b8be38, nsGUIEvent * 
0x03109390, nsEventStatus * 0x0012fae0) line 1857 + 30 bytes
HandleEvent(nsGUIEvent * 0x0012fb30) line 83
nsWindow::DispatchEvent(nsWindow * const 0x030a800c, nsGUIEvent * 0x0012fb30, 
nsEventStatus & nsEventStatus_eIgnore) line 856 + 6 bytes
nsWindow::DispatchWindowEvent(nsWindow * const 0x01664a24, nsGUIEvent * 
0x00000000) line 877
nsWindow::DispatchMouseEvent(nsWindow * const 0x01664a24, unsigned int 301, 
unsigned int 0, nsPoint * 0x00000000) line 4619
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x01664a24, unsigned int 
301, unsigned int 0, nsPoint * 0x00000000) line 4868 + 19 bytes
nsWindow::ProcessMessage(nsWindow * const 0x01664a24, unsigned int 514, 
unsigned int 0, long 3080525, long * 0x0012fda0) line 3544
nsWindow::WindowProc(HWND__ * 0x002d0230, unsigned int 514, unsigned int 0, 
long 51019788) line 1121 + 16 bytes
USER32! 77e11b60()
USER32! 77e11cca()
USER32! 77e183f1()
nsAppShellService::Run(nsAppShellService * const 0x00ff8828) line 308
main1(int 1, char * * 0x002625c0, nsISupports * 0x00262618) line 1285 + 9 bytes
main(int 1, char * * 0x002625c0) line 1625 + 26 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x00133d04, 
HINSTANCE__ * 0x00400000) line 1643 + 21 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e8d326()

Comment 1

[Darin Fisher]

nsAbMDBDirectory::DeleteCards doesn't appear to call into any of the URL code,
so i think my patch is probably not the culprit.

Comment 2

[(not reading, please use [e-mail] instead)]

the null nsAbMDBDirectory concerns me.  

I'll try to bullet proof and assert in AbView, until we can reproduce this.

Comment 3

[(not reading, please use [e-mail] instead)]

Attachment: bullet proof, for now.

a bullet proofer for now, until we get a reproducable case.

Comment 4

[David :Bienvenu]

Comment on attachment 71933 [details] [diff] [review]
bullet proof, for now.

sr=bienvenu

Comment 5

[racham]

Comment on attachment 71933 [details] [diff] [review]
bullet proof, for now.

r=bhuvan

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 71933 [details] [diff] [review]
bullet proof, for now.

a=roc+moz for 0.9.9

Comment 7

[(not reading, please use [e-mail] instead)]

marking fixed since the patch is in.

not worth for the 0.9.9 branch, removing keyword.

donner, if you find a way to reproduce this, let me know.

I'm hoping that we figure it out, and fix it for real for 1.0

Comment 8

[[e-mail] (gone - use [e-mail] instead)]

verified, I'll just file a new bug if I ever see this again.