142542 - Crash scrolling "CC" fields in the compose window M1RC2 Trunk [@ nsSupportsHashtable::Get]

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect)

Description

[Aleksey Nogin]

Reproducible: have not tried yet.

I had Mozilla (2002050205 trunk, RHLinux 7.3) crash on me today when I was
scrolling in the addressee pane of the message compose window. Not sure if this
is related to bug 110165 or not.

gdb says:

(gdb) bt
#0  0x40134866 in nsSupportsHashtable::Get () from /usr/lib/libxpcom.so
#1  0x41762c31 in nsPresState::GetStatePropertyAsSupports () from
/usr/lib/mozilla/components/libgklayout.so
#2  0x41718ffc in nsBoxObject::GetPropertyAsSupports () from
/usr/lib/mozilla/components/libgklayout.so
#3  0x41788c21 in nsTreeBoxObject::GetTreeBody () from
/usr/lib/mozilla/components/libgklayout.so
#4  0x4178eb46 in nsTreeColFrame::InvalidateColumnCache () from
/usr/lib/mozilla/components/libgklayout.so
#5  0x4178e460 in nsTreeColFrame::Init () from
/usr/lib/mozilla/components/libgklayout.so
#6  0x416cfc1e in nsCSSFrameConstructor::InitAndRestoreFrame ()
   from /usr/lib/mozilla/components/libgklayout.so
#7  0x416cdb50 in nsCSSFrameConstructor::ConstructXULFrame () from
/usr/lib/mozilla/components/libgklayout.so
#8  0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#9  0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from
/usr/lib/mozilla/components/libgklayout.so
#10 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from
/usr/lib/mozilla/components/libgklayout.so
#11 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from
/usr/lib/mozilla/components/libgklayout.so
#12 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#13 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from
/usr/lib/mozilla/components/libgklayout.so
#14 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from
/usr/lib/mozilla/components/libgklayout.so
#15 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from
/usr/lib/mozilla/components/libgklayout.so
#16 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#17 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from
/usr/lib/mozilla/components/libgklayout.so
#18 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from
/usr/lib/mozilla/components/libgklayout.so
#19 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from
/usr/lib/mozilla/components/libgklayout.so
#20 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#21 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from
/usr/lib/mozilla/components/libgklayout.so
#22 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from
/usr/lib/mozilla/components/libgklayout.so
#23 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from
/usr/lib/mozilla/components/libgklayout.so
#24 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#25 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from
/usr/lib/mozilla/components/libgklayout.so
#26 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from
/usr/lib/mozilla/components/libgklayout.so
#27 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from
/usr/lib/mozilla/components/libgklayout.so
#28 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#29 0x416d0a23 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#30 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from
/usr/lib/mozilla/components/libgklayout.so
#31 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from
/usr/lib/mozilla/components/libgklayout.so
#32 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from
/usr/lib/mozilla/components/libgklayout.so
#33 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#34 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from
/usr/lib/mozilla/components/libgklayout.so
#35 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from
/usr/lib/mozilla/components/libgklayout.so
#36 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from
/usr/lib/mozilla/components/libgklayout.so
#37 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal ()
   from /usr/lib/mozilla/components/libgklayout.so
#38 0x416dd13c in nsCSSFrameConstructor::CreateListBoxContent ()
   from /usr/lib/mozilla/components/libgklayout.so
#39 0x41754958 in nsListBoxBodyFrame::GetNextItemBox () from
/usr/lib/mozilla/components/libgklayout.so
#40 0x41754210 in nsListBoxBodyFrame::CreateRows () from
/usr/lib/mozilla/components/libgklayout.so
#41 0x41752980 in nsListBoxBodyFrame::ReflowFinished () from
/usr/lib/mozilla/components/libgklayout.so
#42 0x41680410 in PresShell::HandlePostedReflowCallbacks () from
/usr/lib/mozilla/components/libgklayout.so
#43 0x4168255d in PresShell::ProcessReflowCommands () from
/usr/lib/mozilla/components/libgklayout.so
#44 0x41680706 in PresShell::FlushPendingNotifications () from
/usr/lib/mozilla/components/libgklayout.so
#45 0x41753f05 in nsListBoxBodyFrame::InternalPositionChanged ()
   from /usr/lib/mozilla/components/libgklayout.so
#46 0x417528a8 in nsListBoxBodyFrame::PositionChanged () from
/usr/lib/mozilla/components/libgklayout.so
#47 0x41736c82 in nsSliderFrame::SetCurrentPosition () from
/usr/lib/mozilla/components/libgklayout.so
#48 0x41736336 in nsSliderFrame::HandleEvent () from
/usr/lib/mozilla/components/libgklayout.so
#49 0x41681e21 in PresShell::HandleEventInternal () from
/usr/lib/mozilla/components/libgklayout.so
#50 0x41681be9 in PresShell::HandleEvent () from
/usr/lib/mozilla/components/libgklayout.so
#51 0x41815b1c in nsViewManager::HandleEvent () from
/usr/lib/mozilla/components/libgkview.so
#52 0x4180ae57 in nsView::HandleEvent () from
/usr/lib/mozilla/components/libgkview.so
#53 0x4181517a in nsViewManager::DispatchEvent () from
/usr/lib/mozilla/components/libgkview.so
#54 0x4180a942 in HandleEvent () from /usr/lib/mozilla/components/libgkview.so
#55 0x4069cb41 in nsWidget::DispatchEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#56 0x4069ca37 in nsWidget::DispatchWindowEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#57 0x4069cbcf in nsWidget::DispatchMouseEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#58 0x4069d040 in nsWidget::OnMotionNotifySignal () from
/usr/lib/mozilla/components/libwidget_gtk.so
#59 0x406a0b13 in nsWindow::OnMotionNotifySignal () from
/usr/lib/mozilla/components/libwidget_gtk.so
#60 0x406a0fad in nsWindow::HandleGDKEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#61 0x4069739a in dispatch_superwin_event () from
/usr/lib/mozilla/components/libwidget_gtk.so
#62 0x4069716f in handle_gdk_event () from
/usr/lib/mozilla/components/libwidget_gtk.so
#63 0x40378d6f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#64 0x403aa773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#65 0x403aad39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#66 0x403aaeec in g_main_run () from /usr/lib/libglib-1.2.so.0
#67 0x402c72e3 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#68 0x4068fb69 in nsAppShell::Run () from
/usr/lib/mozilla/components/libwidget_gtk.so
#69 0x4066eba2 in nsAppShellService::Run () from
/usr/lib/mozilla/components/libnsappshell.so
#70 0x08053475 in getCountry ()
#71 0x08053dbb in main ()
#72 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6

Comment 1

[Antonio.Xu]

i will research it

Comment 2

[Peter Lubczynski]

This crash just ate my mail message! :(

Nominating nsbeta1

Here's my talkback:
http://climate.mcom.com/reports/SingleIncidentInfo.cfm?dynamicBBID=6077192

Comment 3

[Antonio.Xu]

i really can not reproduce this bug,my build is 2002/05/08 on windows2000

Comment 4

[Koike Kazuhiko]

Reproduced with 2002050806/Win2k. My talkback ID is TB6212471M.

Comment 5

[Jean-Francois Ducarroz]

-->varada

Comment 6

[varada]

Can someone who is able to reproduce this bug please post the steps to do so.

Comment 7

[scottputterman]

esther, are you able to reproduce this?

Comment 8

[greer]

This signature is showing up in the topcrash reports for M1RC2. Marking
"topcrash".   

Comment 9

[greer]

Attachment: Comments from users crashing with this signature

Attached are comments from users crashing at this signature on the Trunk and
M1RC2 to help find a reproducible case. There are a number of comments that
point to crashes related to print preview. That would indicate that this is not
a Mail/News bug specifically.

Comment 10

[varada]

I went thru all the talkback reports but unfortunately I am not able to
reproduce this problem - neither on the release builds nor on my debug builds.
Can anyone reproduce this all the time and if so I would like to see it on their
machine.

Comment 11

[Andrew Schultz]

*** Bug 148215 has been marked as a duplicate of this bug. ***

Comment 12

[Andrew Schultz]

I have been able to reproduce this crash with builds back to 2002042421, but not
2002042221.

steps to reproduce is to simply fill in a bunch of cc fields and scroll -- I
can't get it to happen all the time.  Also, if it doesn't crash on scrolling,
more scrolling probably won't make it crash.  Add or change fields and try
scrolling again.

I tried saving-as-draft something that crashed when I scrolled, but the draft
did not crash when I did edit-as-new.

Comment 13

[varada]

Reassigning to xpapps to assign to appropriate person. (hyatt, hewitt?)

Comment 14

[Peter Trudelle]

->hewitt. ADT1, since this continues to show up on recent builds.  We should at
least try to wallpaper/bulletproof this.

Comment 15

[hennessy]

I just triggered this on the talkback linux 1.0 final build, and submitted it..
 Used a longish list of bcc's and scrolled up real fast, blammo...

Comment 16

[Brian Ryner (not reading)]

hewitt is fairly doomed for machv.  I'll take this one.

Comment 17

[Brian Ryner (not reading)]

Attachment: stack from incident TB6212471M

This stack has line numbers.

Comment 18

[Brian Ryner (not reading)]

The problem is that sometimes when TreeBodyFrames are deleted, they don't get
removed from the BoxObject/PresState property hashtable.  This can happen if we
have never needed to access the BoxObject from the BodyFrame.  Then, when the
"treebody" property is fetched later, we crash trying to addref the deleted object.

Fix is simply to call EnsureBoxObject from nsTreeBodyFrame::Destroy, to make
absolutely sure we remove ourself from the property table.

Comment 19

[Brian Ryner (not reading)]

Attachment: patch

Comment 20

[jag (Peter Annema)]

Comment on attachment 86916 [details] [diff] [review]
patch

sr=jag

Comment 21

[Brian Ryner (not reading)]

Attachment: patch #2

Ok, that patch causes a crash closing the mail compose window.	I bulletproofed
EnsureBoxObject a bit to handle the case where it's called and there's no
document around (as will happen during window teardown).

Comment 22

[Brian Ryner (not reading)]

Comment on attachment 86918 [details] [diff] [review]
patch #2

carrying over sr=jag (he said it was ok)

Comment 23

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 86918 [details] [diff] [review]
patch #2

r=[e-mail]

Comment 24

[Asa Dotzler [:asa]]

Comment on attachment 86918 [details] [diff] [review]
patch #2

a=asa (on behalf of drivers) for checkin to the 1.1 trunk.

Comment 25

[Brian Ryner (not reading)]

Checked into the trunk.  I'll let it bake there a couple of days before
requesting 1.0 branch approval.

Comment 26

[Brian Ryner (not reading)]

Actually, this should be pretty safe.  Nominating for branch approval.

Comment 27

[Jaime Rodriguez, Jr.]

esther - can you pls verify this on the trunk as fixed? thanks!

Comment 28

[scottputterman]

adding adt1.0.1+.  Please get drivers approval for the branch before checking in.

Comment 29

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 30

[Brian Ryner (not reading)]

Checked into the 1.0.1 branch.

Comment 31

[esther]

Sorry, I can't verify what I can reproduce.  Hopefully the reporter and others
who experienced this can verify they don't see it with a build that has the fix.
 Also, if the talkback reports stop with build that include the fix then we can
use that info to to verify this.  Need time for this feedback to determine if
it's fixed.

Comment 32

[Brian Ryner (not reading)]

When trying to reproduce this, it's important to drag slow enough so that the
scroll smoother doesn't kick in. (When the scroll smoother kicks in, it will
stop updating the display until you let go of the scrollbar thumb).  This worked
reliably for me to reproduce it:

- Enter several recipients (say, 7 or so).  I made the first one a To recipient
and the rest Cc:, but I'm not convinced that it matters.

- You should now be at the bottom of the list.  Drag the scrollbar slowly up to
the top.

- Now start dragging the scrollbar down again, slowly.

This reproduced the crash for me quite nicely.

Comment 33

[esther]

thanks for the additional info Brian, I was able to crash with a 6-10 build
before the fix, but I could only crash once.  I will try to crash again, but
after trying again I can't.  I will test this on a fixed build as soon as I can
get better at crashing this (hopefully within the hour).

Comment 34

[esther]

I found a Mail 100% reproducible case confirming the bug on linux, mac and win
and can now verify the fix.  
Reproducible case.
1. Launch mail
2. Open a Compose window
3. For ease of testing I will use "one" through "ten" in addressing field):  
Address the 1st recipient "one" (let it autocomplete with domain or finish the
address). Address 2nd address changing the field to CC, type in "two" let it
autocomplete. Continue with cc's using "three" through "ten".   You will have 10
addresses now.
3. Using the scroll grabber, scroll to the top of the addressing list.
4. Click and drag over the 4th address and hit backspace, Click and hold over
the third address and hit backspace.  You should have 2 blank lines where these
2 addresses were.
5. Using the scroll grabber, scroll down to the bottom and then back up to the
top again.  This is where I crash with the same talkback info on all 4 platforms. 

Now-Using branch build 20020614 on winxp, linux and mac 9.1 and os10.1 this
doesn't crash anymore.  Verified 

Comment 35

[esther]

Note, this was also verified fixed on trunk builds 20020613 on winxp, mac 9.1
mac os10.1 and linux. 

Comment 36

[Shiva Thirumazhusai]

Just for the records. Adding marking topcrash+ and adding testcase keyword.