145974 - repeatable crash replying to yahoo-mail

Status: VERIFIED DUPLICATE of bug 141054

(MailNews Core :: Composition, defect)

Description

[crawdad]

Repeatable crash:
1 - receive e-mail from yahoo-mail.
2 - reply to it...
3 - in middle of quoted text, press "ENTER"key - boom!
4 - Moz crashes every time!!

(win 2K Pro, Moz 1.0 rc2  (rc1 did same)

Comment 1

[Oliver Klee]

Could you post the Talkback ID of the crash? Thanks!

Comment 2

[Jean-Francois Ducarroz]

Also, can you attach an email message to this bug report to reproduce the
problem. From the Mail window, select the message and do file/save as/file. Then
attach the saved file to this bug report. Thanks

Comment 3

[crawdad]

Attachment: Crashing Email ....

This message causes Moz to crash EVERY TIME I 
1 - reply, then
2 - press enter while in quoted block
Crashes immediately upon pressing enter.
Does this repeatably in : Win 98, Win2kPro, RC1, RC2

Comment 4

[Jean-Francois Ducarroz]

I can reproduce the crash using the test case message and a recent trunk debug
build on Win2K. Here is the stack trace:

FrameManager::ReResolveStyleContext(nsIPresContext * 0x05f05c38, nsIFrame *
0x061dd2fc, nsIContent * 0x05855460, int 0xffffffff, nsIAtom * 0x00000000 {???},
nsStyleChangeList & {...}, int 0x00000005, int & 0x00000000) line 1707 + 9 bytes
FrameManager::ReResolveStyleContext(nsIPresContext * 0x05f05c38, nsIFrame *
0x060dbce8, nsIContent * 0x060fc3f0, int 0xffffffff, nsIAtom * 0x00000000 {???},
nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) line 1863
FrameManager::ReResolveStyleContext(nsIPresContext * 0x05f05c38, nsIFrame *
0x060db880, nsIContent * 0x061c1bd0, int 0xffffffff, nsIAtom * 0x00000000 {???},
nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) line 1863
FrameManager::ReResolveStyleContext(nsIPresContext * 0x05f05c38, nsIFrame *
0x060d8f28, nsIContent * 0x061c1bd0, int 0xffffffff, nsIAtom * 0x00000000 {???},
nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) line 1863
FrameManager::ReResolveStyleContext(nsIPresContext * 0x05f05c38, nsIFrame *
0x060c3180, nsIContent * 0x061c1bd0, int 0xffffffff, nsIAtom * 0x00000000 {???},
nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) line 1863
FrameManager::ReResolveStyleContext(nsIPresContext * 0x05f05c38, nsIFrame *
0x060c35ec, nsIContent * 0x061c1bd0, int 0xffffffff, nsIAtom * 0x00000000 {???},
nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) line 1863
FrameManager::ReResolveStyleContext(nsIPresContext * 0x05f05c38, nsIFrame *
0x060c33f4, nsIContent * 0x00000000, int 0xffffffff, nsIAtom * 0x00000000 {???},
nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) line 1863
FrameManager::ReResolveStyleContext(nsIPresContext * 0x05f05c38, nsIFrame *
0x060c3144, nsIContent * 0x00000000, int 0xffffffff, nsIAtom * 0x00000000 {???},
nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) line 1863
FrameManager::ComputeStyleChangeFor(FrameManager * const 0x061cb8f0,
nsIPresContext * 0x05f05c38, nsIFrame * 0x060c3144, int 0xffffffff, nsIAtom *
0x00000000 {???}, nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000)
line 1905
PresShell::ReconstructStyleData(PresShell * const 0x0604ead8, int 0x00000000)
line 5495
PresShell::StyleSheetAdded(PresShell * const 0x0604eae0, nsIDocument *
0x06119748, nsIStyleSheet * 0x060da938) line 5519
nsDocument::InsertStyleSheetAt(nsDocument * const 0x06119748, nsIStyleSheet *
0x060da938, int 0x00000000, int 0x00000001) line 1633
CSSLoaderImpl::InsertSheetInDoc(nsICSSStyleSheet * 0x060da938, int 0x00000002,
nsIContent * 0x061e19d8, int 0x00000001, nsICSSLoaderObserver * 0x00000000) line
1191
InsertPendingSheet(void * 0x060dae18, void * 0x061c1830) line 757
nsVoidArray::EnumerateForwards(int (void *, void *)* 0x01f98550
InsertPendingSheet(void *, void *), void * 0x061c1830) line 660 + 21 bytes
CSSLoaderImpl::Cleanup(URLKey & {...}, SheetLoadData * 0x060c4828) line 821
CSSLoaderImpl::SheetComplete(nsICSSStyleSheet * 0x00000000, SheetLoadData *
0x060c4828) line 914
CSSLoaderImpl::ParseSheet(nsIUnicharInputStream * 0x061e4b48, SheetLoadData *
0x060c4828, int & 0x00000001, nsICSSStyleSheet * & 0x060da938) line 949
CSSLoaderImpl::LoadInlineStyle(CSSLoaderImpl * const 0x061c1830, nsIContent *
0x061e19d8, nsIUnicharInputStream * 0x061e4b48, const nsString & {""}, const
nsString & {""}, int 0xffffffff, int 0x00000002, nsIParser * 0x00000000, int &
0x00000001, nsICSSLoaderObserver * 0x00000000) line 1383 + 24 bytes
nsStyleLinkElement::UpdateStyleSheet(nsStyleLinkElement * const 0x061e1a08,
nsIDocument * 0x00000000, int 0xffffffff) line 378 + 133 bytes
nsHTMLStyleElement::SetDocument(nsHTMLStyleElement * const 0x061e19d8,
nsIDocument * 0x06119748, int 0x00000001, int 0x00000001) line 126
nsGenericHTMLContainerElement::InsertChildAt(nsGenericHTMLContainerElement *
const 0x05e87ab0, nsIContent * 0x061e19d8, int 0x00000000, int 0x00000001, int
0x00000001) line 3987
nsGenericElement::doInsertBefore(nsIDOMNode * 0x061e1a00, nsIDOMNode *
0x061e1a7c, nsIDOMNode * * 0x0012e874) line 2481 + 35 bytes
nsGenericHTMLContainerElement::InsertBefore(nsGenericHTMLContainerElement *
const 0x05e87ab0, nsIDOMNode * 0x061e1a00, nsIDOMNode * 0x061e1a7c, nsIDOMNode *
* 0x0012e874) line 616
nsHTMLQuoteElement::InsertBefore(nsHTMLQuoteElement * const 0x05e87ad8,
nsIDOMNode * 0x061e1a00, nsIDOMNode * 0x061e1a7c, nsIDOMNode * * 0x0012e874)
line 60 + 27 bytes
nsEditor::SplitNodeImpl(nsIDOMNode * 0x05855488, int 0x0000000c, nsIDOMNode *
0x05e87ad8, nsIDOMNode * 0x060fc418) line 2720 + 63 bytes
SplitElementTxn::DoTransaction(SplitElementTxn * const 0x05dd20d8) line 96 + 54
bytes
nsTransactionItem::DoTransaction() line 181 + 18 bytes
nsTransactionManager::BeginTransaction(nsITransaction * 0x05dd20d8) line 1076 +
11 bytes
nsTransactionManager::DoTransaction(nsTransactionManager * const 0x05f060c8,
nsITransaction * 0x05dd20d8) line 137 + 18 bytes
nsEditor::Do(nsEditor * const 0x05f06d88, nsITransaction * 0x05dd20d8) line 493
+ 30 bytes
nsEditor::SplitNode(nsEditor * const 0x05f06d88, nsIDOMNode * 0x05855488, int
0x0000000c, nsIDOMNode * * 0x0012ea3c) line 1194 + 16 bytes
nsEditor::SplitNodeDeep(nsIDOMNode * 0x05855488, nsIDOMNode * 0x061e3d1c, int
0x00000020, int * 0x0012eb5c, int 0x00000001, nsCOMPtr<nsIDOMNode> * 0x0012eb60,
nsCOMPtr<nsIDOMNode> * 0x0012eb4c) line 4063 + 52 bytes
nsHTMLEditRules::WillInsertBreak(nsISelection * 0x05f06c00, int * 0x0012ec64,
int * 0x0012eca4) line 1466 + 68 bytes
nsHTMLEditRules::WillDoAction(nsHTMLEditRules * const 0x0601748c, nsISelection *
0x05f06c00, nsRulesInfo * 0x0012ec68, int * 0x0012ec64, int * 0x0012eca4) line
490 + 23 bytes
nsPlaintextEditor::InsertLineBreak(nsPlaintextEditor * const 0x05f06e20) line
1014 + 56 bytes
nsHTMLEditorLog::InsertLineBreak(nsHTMLEditorLog * const 0x05f06e20) line 194 +
9 bytes
nsPlaintextEditor::TypedText(nsPlaintextEditor * const 0x05f06d88, const
nsAString & {...}, int 0x00000002) line 556 + 22 bytes
nsHTMLEditor::TypedText(nsHTMLEditor * const 0x05f06d88, const nsAString &
{...}, int 0x00000002) line 1261 + 17 bytes
nsHTMLEditor::HandleKeyPress(nsHTMLEditor * const 0x05f06e20, nsIDOMKeyEvent *
0x06134448) line 1224 + 34 bytes
nsTextEditorKeyListener::KeyPress(nsTextEditorKeyListener * const 0x05f00dd0,
nsIDOMEvent * 0x06134450) line 285
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x061cc0d0,
nsIPresContext * 0x05f05c38, nsEvent * 0x0012f8c0, nsIDOMEvent * * 0x0012f5c0,
nsIDOMEventTarget * 0x06119778, unsigned int 0x00000002, nsEventStatus *
0x0012f70c) line 1650 + 41 bytes
nsDocument::HandleDOMEvent(nsDocument * const 0x06119748, nsIPresContext *
0x05f05c38, nsEvent * 0x0012f8c0, nsIDOMEvent * * 0x0012f5c0, unsigned int
0x00000002, nsEventStatus * 0x0012f70c) line 3464
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x061c1bd0,
nsIPresContext * 0x05f05c38, nsEvent * 0x0012f8c0, nsIDOMEvent * * 0x0012f5c0,
unsigned int 0x00000001, nsEventStatus * 0x0012f70c) line 1865 + 39 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f8c0, nsIView * 0x05f06f70,
unsigned int 0x00000001, nsEventStatus * 0x0012f70c) line 6115 + 44 bytes
PresShell::HandleEvent(PresShell * const 0x0604eadc, nsIView * 0x05f06f70,
nsGUIEvent * 0x0012f8c0, nsEventStatus * 0x0012f70c, int 0x00000001, int &
0x00000001) line 6038 + 25 bytes
nsViewManager::HandleEvent(nsView * 0x05f06f70, nsGUIEvent * 0x0012f8c0, int
0x00000000) line 2030
nsView::HandleEvent(nsViewManager * 0x05f038a0, nsGUIEvent * 0x0012f8c0, int
0x00000000) line 306
nsViewManager::DispatchEvent(nsViewManager * const 0x05f038a0, nsGUIEvent *
0x0012f8c0, nsEventStatus * 0x0012f830) line 1881 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f8c0) line 83
nsWindow::DispatchEvent(nsWindow * const 0x0585459c, nsGUIEvent * 0x0012f8c0,
nsEventStatus & nsEventStatus_eIgnore) line 889 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f8c0) line 910
nsWindow::DispatchKeyEvent(unsigned int 0x00000083, unsigned short 0x0000,
unsigned int 0x0000000d, long 0x00000000) line 2687 + 15 bytes
nsWindow::OnChar(unsigned int 0x0000000d, unsigned int 0x0000000d, unsigned char
0x01) line 2838
nsWindow::ProcessMessage(unsigned int 0x00000102, unsigned int 0x0000000d, long
0x001c0001, long * 0x0012fcec) line 3470 + 52 bytes
nsWindow::WindowProc(HWND__ * 0x0007036e, unsigned int 0x00000102, unsigned int
0x0000000d, long 0x001c0001) line 1154 + 27 bytes
USER32! 77e11b60()
USER32! 77e11cca()
USER32! 77e183f1()
nsAppShellService::Run(nsAppShellService * const 0x016b6578) line 451
main1(int 0x00000001, char * * 0x00304fc0, nsISupports * 0x00000000) line 1456 +
32 bytes
main(int 0x00000001, char * * 0x00304fc0) line 1805 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e8d326()

We crash on the following line because oldColor is null:
        if(oldColor->mBackgroundImage.Length() > 0 &&
          oldColor->mBackgroundImage != newColor->mBackgroundImage ){

Comment 5

[Jean-Francois Ducarroz]

I have a fix to prevent the crash despite I don't know if it ok to not have a
background style (nsnull). Patch coming...

cc'ing some layout guys for the review.

Comment 6

[Jean-Francois Ducarroz]

Attachment: Proposed fix, v1

The patch will take care os cases where oldColor and/or newColor is null.

Comment 7

[Jean-Francois Ducarroz]

Nominating nsbeta1

Comment 8

[Marc Attinasi]

Comment on attachment 84510 [details] [diff] [review]
Proposed fix, v1

well, there should NOT be a null style struct in the context, so the real
problem is there. But, for wallpaper, this will work :)

If you have time, can you try to figure out why the context has a null struct?
I really never should...

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I'm amazed this fixes the problem and you don't crash in 50 other places with
the same thing.  I'd expect this is a duplicate of bug 141054.  Does the style
context in question have an mPseudoTag pointing to a ":before" or ":after" atom
and is the frame's content node an nsHTMLHRElement?

Comment 10

[Johnny Stenback (:jst)]

Comment on attachment 84510 [details] [diff] [review]
Proposed fix, v1

If this is something we need to fix for RTM, then I'm fine with this wallpaper
fix, but I really rather not see this on the trunk.

sr=jst for the branch, but please leave this out of the trunk.

Comment 11

[Jean-Francois Ducarroz]

I am not reall the right person to perform a deep debugging of the matter. I
just did this null pointer check and the problem went away for me, I can edit
and sent the reply.

Can somebody in layout investigate the real problem?

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Well, I just checked and it is the :after pseudo-frame for an HR element, so
this looks like a duplicate of bug 141054, which I understand, but is a bit of
work to fix.

Comment 13

[Michael Buckland]

Discussed in mail news bug meeting.  Decided to plus this bug.

Comment 14

[scottputterman]

getting on adt and drivers radar.

Comment 15

[Jean-Francois Ducarroz]

as this problem should goes away once the fix for bug 141054 is fixed (it has a
patch which as been reviewd), I am waiting to see if I really need to check this
fix as well...

Comment 16

[Jean-Francois Ducarroz]

Since bug 141054 has been fixed, I cannot reproduce this problem.

*** This bug has been marked as a duplicate of 141054 ***

Comment 17

[Jaime Rodriguez, Jr.]

removing adt1.0.1, since is resolved as a dupe.

Comment 18

[esther]

verified dup