138138 - [trunk] Crash in [@ nsProperties::ReleaseValues] clicking 'Compose'.

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect)

Description

[[e-mail] (gone - use [e-mail] instead)]

Build ID: 2002-04-17-18, Windows 2000 --TRUNK--.

Summary: Crash in [@ nsProperties::ReleaseValues] clicking 'Compose'.

Steps to Reproduce:

1. Click 'Compose' in Mail.

nsProperties::ReleaseValues
[d:\builds\seamonkey\mozilla\xpcom\ds\nsProperties.cpp, line 70] 
_hashEnumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 199] 
PL_HashTableEnumerateEntries [../../../lib/ds/plhash.c, line 430] 
nsHashtable::Enumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp,
line 362] 
nsSupportsHashtable::~nsSupportsHashtable
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 944] 
nsSupportsHashtable::`scalar deleting destructor' 
nsPresState::~nsPresState
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresState.cpp, line 57] 
nsPresState::`scalar deleting destructor' 
nsPresState::Release
[d:\builds\seamonkey\mozilla\layout\base\src\nsPresState.cpp, line 45] 
nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 74] 
nsXULDocument::SetBoxObjectFor
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 7286] 
nsXULDocument::SetBoxObjectFor
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 7286] 
nsXULElement::SetDocument
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2080] 
nsXULElement::ReplaceChildAt
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2308] 
nsXULElement::ReplaceChild
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 1102] 
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106] 
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2027] 
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1267] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2746] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2746] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] 
nsXPCWrappedJSClass::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 1195] 
nsXPCWrappedJS::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 430] 
PrepareAndDispatch
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 117] 
SharedStub
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 139] 
nsMsgCompose::NotifyStateListeners
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 3291] 
nsMsgDocumentStateListener::NotifyDocumentCreated
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 2877] 
nsMsgCompose::SetEditor
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 1243] 
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106] 
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2027] 
XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1291] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881] 
js_SetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2666] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2588] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] 
nsXPCWrappedJSClass::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 1195] 
nsXPCWrappedJS::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 430] 
PrepareAndDispatch
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 117] 
SharedStub
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 139] 
nsMsgComposeService::OpenWindow
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgComposeService.cpp, line
268] 
nsMsgComposeService::OpenComposeWindow
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgComposeService.cpp, line
486] 
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106] 
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2027] 
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1267] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2746] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3414] 
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1019] 
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 184] 
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1220] 
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
2212] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3461] 
PresShell::HandleDOMEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6037] 
nsButtonBoxFrame::MouseClicked
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 195] 
nsButtonBoxFrame::HandleEvent
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 142] 
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6006] 
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5957] 
nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2624] 
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1705] 


See http://bonsai.mozilla.org/cvslog.cgi?file=mozilla/xpcom/ds/nsProperties.cpp

For the bug: http://bugzilla.mozilla.org/show_bug.cgi?id=125881

Comment 1

[Ben Bucksch (:BenB)]

I don't know, why this is assigned to me.
- I changed only Has(). That appears nowhere in the stack, nor is it called by
  ReleaseValues().
- All I do is pass the value to Exists():
  +    *result = nsHashtable::Exists(&key);
  If Exists() crashes, that's not my fault.
- I have never seen the "Compose" command crash, IIRC.
- My change is 2 months old.

Sorry, but I know nothing new to add to this bug, either.

-> dougt.

Comment 2

[Jean-Francois Ducarroz]

cc'ing varada

Comment 3

[Doug Turner (:dougt)]

Try to reproduce this with my tree from a day or two ago and mail composition
works fine.  I am updating my tree now.  Stay tuned.

Comment 4

[Tracy Walker [:tracy]]

i am seeing something similar to this on mac os9 2002-04-18-03-trunk and windows 
2002-04-18-06-trunk.  initially i can get a compose window and send messages in 
plain text. then I switch to html and crashed..  a few more attempts to compose 
and send message and things start to work.

here is the talkback data for the mac crash:

Stack Signature
                 0x2f0f42a4 ca1f2bae
 Trigger Time
                 2002-04-18 09:07:21
 Email Address
                 [e-mail]
 URL visited
 Build ID
                 2002041803
 Product ID
                 MozillaTrunk
 Platform
 Operating System
                 MacOS
 Module
 Trigger Reason
                  PowerPC unmapped memory exception
 User Comments
                 crash sending html mail 
 Stack Trace

0x2f0f42a4 
_hashEnumerate() [nsHashtable.cpp, line 196] 
NSPR20 + 0x1290 (0x3d105450) 
nsHashtable::Enumerate() [nsHashtable.cpp, line 361] 
nsSupportsHashtable::~nsSupportsHashtable() [nsHashtable.cpp, line 943] 
nsPresState::~nsPresState() [nsPresState.cpp, line 56] 
nsPresState::Release() [nsPresState.cpp, line 45] 
nsCOMPtr_base::assign_with_AddRef() [nsCOMPtr.cpp, line 73] 
nsBoxObject::SetDocument() [nsBoxObject.cpp, line 144] 
nsXULDocument::SetBoxObjectFor() [nsXULDocument.cpp, line 7285] 
nsXULElement::SetDocument() [nsXULElement.cpp, line 2079] 
nsXULElement::SetDocument() [nsXULElement.cpp, line 2147] 
nsXULElement::SetDocument() [nsXULElement.cpp, line 2147] 
nsXULElement::SetDocument() [nsXULElement.cpp, line 2147] 
nsXULElement::SetDocument() [nsXULElement.cpp, line 2147] 
nsXULElement::SetDocument() [nsXULElement.cpp, line 2147] 
nsXULDocument::SetScriptGlobalObject() [nsXULDocument.cpp, line 1635] 
DocumentViewerImpl::Close() [nsDocumentViewer.cpp, line 1585] 
nsDocShell::Destroy() [nsDocShell.cpp, line 2712] 
nsWebShell::Destroy() [nsWebShell.cpp, line 1262] 
nsXULWindow::Destroy() [nsXULWindow.cpp, line 395] 
nsWebShellWindow::Destroy() [nsWebShellWindow.cpp, line 1739] 

Comment 5

[David :Bienvenu]

I see a similar crash when I cancel an edit draft - I can try backing out the 
nsProperties.cpp change - weren't there also a few editor changes recently?

Comment 6

[scottputterman]

Not being able to send mail is a smoketest blocker.

Comment 7

[Jean-Francois Ducarroz]

I am pulling a new tree too...

Comment 8

[Tracy Walker [:tracy]]

i was going to mark this a blocker whenI first encountered it. but I went back 
to mail after the crash, attempted to send mail again and it worked.  seems the 
workaround here is persistance. :-)

Comment 9

[Jean-Francois Ducarroz]

bug 138121 is another crasher when closing the compose window with a different
stack trace but probably related

Comment 10

[Tracy Walker [:tracy]]

this is happening on mac as well as windows...changing platform/os back to All

Comment 11

[Doug Turner (:dougt)]

I am only seeing the crasher during close of the compose window.

Comment 12

[Doug Turner (:dougt)]

I see the cause of the window close crasher now, but not sure what the catalyst
was which caused this to start crashing.  

What is happening is this:  

The nsPresState is an owner of a nsSupportsHashTable.  The nsBoxObject and
friends |put| properties in nsPresState hashtable.  These objects are frames
(and sometimes strings, but that is not the problem) which do not implement
addref or release.  One element - a listboxbody (or so that key says) - is being
put into the hash but is then deleted when the window is torn down.  The
nsPresState is left with a dangling hash entry.   The listboxbody is deleted
before the nsPresState.

I did make a change to nsPresState to optimize string key construction, but
backing that out has no effect.

We need to have someone with more experience with layout to look at this.

I am not sure if this is relevant, but I am seeing some debug output:

JavaScript error:
 line 0: uncaught exception: [Exception... "Component returned failure code: 0xc
1f30001 (NS_ERROR_NOT_INITIALIZED) [nsIMsgCompose.CloseWindow]"  nsresult: "0xc1
f30001 (NS_ERROR_NOT_INITIALIZED)"  location: "JS frame :: chrome://messenger/co
ntent/messengercompose/MsgComposeCommands.js :: MsgComposeCloseWindow :: line 20
89"  data: no]


ComposeUnload from XUL
WARNING: NS_ENSURE_TRUE(presShell) failed, file nsGenericHTMLElement.cpp, line 2
967

Comment 13

[David :Bienvenu]

given the stack trace, I suspect jst's checkin could have caused this - I'll try
backing him out locally.

Comment 14

[Vicente Salvador]

Also seen when trying to forward and reply mails (always opening the compose
window).

See Talkback cases:
- TB5347980M
- TB5346656G

Comment 15

[Doug Turner (:dougt)]

dbienvenu says he backed out jst and the problem went away....

Comment 16

[scottputterman]

removing Mach V markings since this only happens on the trunk.

Comment 17

[Johnny Stenback (:jst)]

Attachment: Fix crasher, clear the boxobject table when a frame containing a XUL document is hidden

Comment 18

[John Keiser (jkeiser)]

Comment on attachment 79847 [details] [diff] [review]
Fix crasher, clear the boxobject table when a frame containing a XUL document is hidden

r=jkeiser

Comment 19

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Comment on attachment 79847 [details] [diff] [review]
Fix crasher, clear the boxobject table when a frame containing a XUL document is hidden

sr=heikki

Comment 20

[Johnny Stenback (:jst)]

Fix checked in.

Comment 21

[Brad Roberts]

Looks like it caused a 24k increase in leaks on the 'brad' tinderbox (narrowed 
down further by the one on MozillaTest).

Comment 22

[Jay Patel [:jay]]

Adding topcrash keyword for future reference...I'll keep an eye out to see if
this crash goes away in the Talkback data.

Comment 23

[Johnny Stenback (:jst)]

Reopening since this caused bug 138663. Better fix on its way.

Comment 24

[Johnny Stenback (:jst)]

Attachment: Only clear presentation related box object data when hiding a document.

Comment 25

[John Keiser (jkeiser)]

Comment on attachment 80134 [details] [diff] [review]
Only clear presentation related box object data when hiding a document.

Just one thing: I do not think adding an OnHide() method to nsIDocument is
good, at least not for *this* reason.  Document is for non-layout stuff, even
if parts of it don't hold to that right now we need to keep that dependency
from creeping in.  I think having the method sit on the XUL document itself is
all right, though.

Other than that, it looks good.  I have not verified the other nsBoxObject
subclasses to see if they leak, though, so I trust you have.  It's a tricky
business.

I am also curious, in those places where you changed nsAutoString to
nsDependentString, why you could not just pass aPropertyName into the function
directly.  I think that would be clearer and smaller.

r=jkeiser with that.

Comment 26

[Ben Bucksch (:BenB)]

Are you sure that it's trunk only? I see it on the branch as well.

Comment 27

[Ben Bucksch (:BenB)]

To clarify: I see a bug /similar to this one/ on the branch. I have no stack
trace or similar.

Comment 28

[Johnny Stenback (:jst)]

None of the code related to what's being discussed here is checked in anywhere
other than on the trunk, so if there are similar problems on the branch, those
are due to other reasons, so file separate bugs on those problems...

Comment 29

[rbs]

> I see a bug /similar to this one/ on the branch.

C.f. comment #12, it has been around.

A cleaner/long-lasting fix would be to have a refcounted mediator.

===
BTW, I recollect that nsSliderFrame once had a similar crasher in bug 21571:
http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=nsSliderFrame.cpp&root=/cvsroot&subdir=mozilla/layout/xul/base/src&command=DIFF_FRAMESET&rev1=1.27&rev2=1.28

fixed here:
http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=nsSliderFrame.h&root=/cvsroot&subdir=mozilla/layout/xul/base/src&command=DIFF_FRAMESET&rev1=1.24&rev2=1.25
http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=nsSliderFrame.cpp&root=/cvsroot&subdir=mozilla/layout/xul/base/src&command=DIFF_FRAMESET&rev1=1.45&rev2=1.46

Comment 30

[Scott MacGregor]

Any chance of getting this patch into the trunk today so we can open up the tree? 

Comment 31

[Johnny Stenback (:jst)]

Comment on attachment 80134 [details] [diff] [review]
Only clear presentation related box object data when hiding a document.

I moved OnHide() into nsIXULDocument. I can't pass aPropertyName directly since
it's a const PRUnichar* and the methods accept const nsAString& types, so I
need to wrap it in a nsDependentString.

Rick says sr=rpotts.

Comment 32

[Johnny Stenback (:jst)]

This was checked in yesterday evening.

Comment 33

[Jay Patel [:jay]]

Reopening.  Although the checkin went in on 4/22, there are 3 crashes with
builds from 4/23.  Here is the most recent incident:

Incident ID 5541370
Stack Signature nsProperties::ReleaseValues e1429941
Email Address [e-mail]
Product ID MozillaTrunk
Build ID 2002042310
Trigger Time 2002-04-23 19:53:40
Platform Win32
Operating System Windows NT 5.0 build 2195
Module xpcom.dll
URL visited
User Comments
Trigger Reason Access violation
Source File Name d:\builds\seamonkey\mozilla\xpcom\ds\nsProperties.cpp
Trigger Line No. 70
Stack Trace
nsProperties::ReleaseValues
[d:\builds\seamonkey\mozilla\xpcom\ds\nsProperties.cpp, line 70]
_hashEnumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 199]
PL_HashTableEnumerateEntries [../../../lib/ds/plhash.c, line 430]
nsHashtable::Enumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp,
line 362]
nsSupportsHashtable::~nsSupportsHashtable
[d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 944]
nsSupportsHashtable::`scalar deleting destructor'
nsPresState::`scalar deleting destructor'
nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 74]
nsTreeBoxObject::SetDocument
[d:\builds\seamonkey\mozilla\layout\xul\base\src\tree\src\nsTreeBoxObject.cpp,
line 89]
nsTreeBoxObject::SetDocument
[d:\builds\seamonkey\mozilla\layout\xul\base\src\tree\src\nsTreeBoxObject.cpp,
line 89]
nsXULDocument::SetBoxObjectFor
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 7309]
nsXULElement::SetDocument
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2080]
nsGenericElement::SetDocumentInChildrenOf
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1421]
nsGenericElement::SetDocument
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1488]
nsXBLBinding::ChangeDocument
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLBinding.cpp, line 1144]
nsBindingManager::ChangeDocumentFor
[d:\builds\seamonkey\mozilla\content\xbl\src\nsBindingManager.cpp, line 552]
nsXULElement::SetDocument
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2078]
nsXULElement::SetDocument
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2151]
nsGenericElement::SetDocumentInChildrenOf
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1421]
nsGenericElement::SetDocument
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1488]
nsXBLBinding::ChangeDocument
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLBinding.cpp, line 1144]
nsBindingManager::ChangeDocumentFor
[d:\builds\seamonkey\mozilla\content\xbl\src\nsBindingManager.cpp, line 552]
nsXULElement::SetDocument
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2078]
nsXULElement::SetDocument
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2151]
nsXULElement::SetDocument
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2151]
nsXULElement::SetDocument
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2151]
nsXULElement::ReplaceChildAt
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2308]
nsXULElement::ReplaceChild
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 1102]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2027]
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1267]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2746]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2746]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806]
nsXPCWrappedJSClass::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 1195]
nsXPCWrappedJS::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 430]
PrepareAndDispatch
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 117]
SharedStub
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 139]
nsMsgCompose::NotifyStateListeners
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 3291]
nsMsgDocumentStateListener::NotifyDocumentCreated
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 2877]
nsMsgCompose::SetEditor
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgCompose.cpp, line 1243]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2027]
XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1291]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881]
js_SetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2666]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2588]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806]
nsXPCWrappedJSClass::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 1195]
nsXPCWrappedJS::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 430]
PrepareAndDispatch
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 117]
SharedStub
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 139]
nsMsgComposeService::OpenWindow
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgComposeService.cpp, line 267]
nsMsgComposeService::OpenComposeWindow
[d:\builds\seamonkey\mozilla\mailnews\compose\src\nsMsgComposeService.cpp, line 485]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2027]
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1267]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2746]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881] 

The stack signature is the same, but the stack looks a little different, so not
sure if this is the same crash or not.  Let me know if I need to log a new bug.

Comment 34

[Johnny Stenback (:jst)]

Attachment: Clean out more presentation stuff in the box object code...

Comment 35

[Johnny Stenback (:jst)]

Since I can't reproduce this I can't test that my patch actually fixes the
problem, the best we can do is check it in and wait n' see...

Comment 36

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Comment on attachment 80983 [details] [diff] [review]
Clean out more presentation stuff in the box object code...

sr=heikki

Comment 37

[Jan Varga [:janv]]

Comment on attachment 80983 [details] [diff] [review]
Clean out more presentation stuff in the box object code...

r=varga

Comment 38

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Checked in, marking fixed.

Comment 39

[esther]

stephen, I did not see this bug so you need to verify it on the trunk.

Comment 40

[[e-mail] (gone - use [e-mail] instead)]

The last crash on the trunk was on 4/25 - this is no longer occuring with the
2002-05-02 trunk builds, Mac OS X 10.1.4, Windows 2000, Mandrake 8.1

Verified FIXED.