147132 - Crash in [@ morkNode::CutWeakRef] on sorting/completion of sorting in some newsgroups with 30,000+ articles

Status: VERIFIED DUPLICATE of bug 123677

(MailNews Core :: Networking: NNTP, defect)

Description

[Ian Ballantyne]

Mozilla News crashes almost always when I download all headers in newsgroups
with 30,000 or more articles (note this number is not exact!)  In particular, I
have had problems in the alt.binaries.sounds.mp3.dance (70,000+ articles) and
alt.binaries.sounds.mp3.holland (40,000+ articles) newsgroups which I have not
been able to read at all.  All headers are successfully downloaded.  The crash
occurs either during or shortly after (< 1 second) the completion of sorting the
articles.  I have access to several news servers, and the crash occurs
regardless of which server I use.  These servers have retentions of more than
one week for the mentioned groups.  I have a tgz file of the
alt.binaries.sounds.mp3.dance.msf (50Mb compressed) file which I would like to
send as when Mozilla loads this file and tries to sort it, the crash also
happens.  I will search for where to send this file, but would appreciate being
informed of an email address where I can send it to.  I can also make this file
available from my web server for download if required.  I have filled out the
quality assurance agent on several crashes.

Comment 1

[[e-mail] (gone - use [e-mail] instead)]

Here's the stack.  I haven't previously subscribe to this newsgroup, so it's
only showing me 1001 articles.  I'm sure new postings will add up rapidly.

Confirming bug, based on stack and build ID grepped from Talkback report.

find()
morkMap::Get()
morkRowMap::GetOid()
morkStore::GetRow()
morkStore::GetRow()
nsMsgDatabase::GetMsgHdrForKey()
nsMsgDBView::GetMsgHdrForViewIndex()
nsMsgDBView::GetRowProperties()
nsTreeBodyFrame::PaintRow()
nsTreeBodyFrame::Paint()
PresShell::Paint()
nsView::Paint()
nsViewManager::RenderDisplayListElement()
nsViewManager::RenderViews()
nsViewManager::Refresh()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWindow::DoPaint()
nsWindow::Update()
nsWindow::UpdateIdle()
libglib-1.2.so.0 + 0x11d4f (0x4039ed4f)
libglib-1.2.so.0 + 0x10c46 (0x4039dc46)
libglib-1.2.so.0 + 0x11273 (0x4039e273)
libglib-1.2.so.0 + 0x1143c (0x4039e43c)
libgtk-1.2.so.0 + 0x9276c (0x402b676c)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1d7ee (0x404eb7ee) 

Comment 2

[Ian Ballantyne]

Attachment: It is the cache file of one of the newsgroups that crashes mozilla

This is the cache file that mozilla has written to my News directory
(/home/ian/.mozilla/default/9sqlfu67.slt/News/news.atnet.at/alt.binaries.sounds.mp3.dance.msf)

I have gzipped it for space saving, but it is still 5Mb  On my system, when
mozilla loads this file, sither near the end or shortly after completion of
sorting the file, mozilla crashes.  This crash occurs without fail on my system
and ocurs regardless of if I load the file, or start out completely fresh by
removing my .mozilla directory and my .netscape directory (well, actually
rename them both to something different).  With this file, the entry for the
dance group is empty (alt.binaries.sounds.mp3.dance: ) with no numbers listed
in it that would indicate some of the articles have been read, although I have
found that the contents of the rc file seem to be irrelevant.
Addenum: The upload is failing because of the file size.  Please go to
midori.shacknet.nu/mozilla for the file.  It is password protected
(mozilla/news).  Please advise me when you have taken it so I can remove it.

Comment 3

[[e-mail] (gone - use [e-mail] instead)]

adding david; I'll keep trying to reproduce this (by getting your file)

Comment 4

[[e-mail] (gone - use [e-mail] instead)]

I think we have a morkNode::CutWeakRef crash still outstanding; I'll double-check.

Stack Signature 0x002f02e0 1a55ea87 
Email Address [e-mail] 
Product ID Gecko1.0 
Build ID 2002052508 
Trigger Time 2002-05-25 23:59:06 
Platform Win32 
Operating System Windows NT 5.0 build 2195 
Module  
URL visited http://n/a 
User Comments Bug 147132  
Trigger Reason Unknown exception 0xc000001e 
Source File Name  
Trigger Line No.  
Stack Trace  
0x002f02e0 
morkNode::CutWeakRef [d:\builds\seamonkey\mozilla\db\mork\src\morkNode.cpp, line
648] 
morkNode::SlotWeakNode [d:\builds\seamonkey\mozilla\db\mork\src\morkNode.cpp,
line 505] 
morkTable::CloseTable [d:\builds\seamonkey\mozilla\db\mork\src\morkTable.cpp,
line 193] 
morkTable::CloseMorkNode [d:\builds\seamonkey\mozilla\db\mork\src\morkTable.cpp,
line 100] 
morkTable::~morkTable [d:\builds\seamonkey\mozilla\db\mork\src\morkTable.cpp,
line 108] 
morkTable::`scalar deleting destructor' 
morkObject::Release [d:\builds\seamonkey\mozilla\db\mork\src\morkObject.cpp,
line 68] 
morkThumb::Release [d:\builds\seamonkey\mozilla\db\mork\src\morkThumb.cpp, line
145] 
morkTable::CutStrongRef [d:\builds\seamonkey\mozilla\db\mork\src\morkTable.cpp,
line 996] 
morkBeadMap::CutAllBeads [d:\builds\seamonkey\mozilla\db\mork\src\morkBead.cpp,
line 256] 
morkBeadMap::CloseBeadMap [d:\builds\seamonkey\mozilla\db\mork\src\morkBead.cpp,
line 172] 
morkBeadMap::CloseMorkNode
[d:\builds\seamonkey\mozilla\db\mork\src\morkBead.cpp, line 144] 
morkRowSpace::CloseRowSpace
[d:\builds\seamonkey\mozilla\db\mork\src\morkRowSpace.cpp, line 171] 
morkRowSpace::CloseMorkNode
[d:\builds\seamonkey\mozilla\db\mork\src\morkRowSpace.cpp, line 111] 
morkNode::cut_use_count [d:\builds\seamonkey\mozilla\db\mork\src\morkNode.cpp,
line 572] 
morkNode::CutStrongRef [d:\builds\seamonkey\mozilla\db\mork\src\morkNode.cpp,
line 589] 
morkNode::SlotStrongNode [d:\builds\seamonkey\mozilla\db\mork\src\morkNode.cpp,
line 484] 
morkPortTableCursor::ClosePortTableCursor
[d:\builds\seamonkey\mozilla\db\mork\src\morkPortTableCursor.cpp, line 156] 
morkPortTableCursor::CloseMorkNode
[d:\builds\seamonkey\mozilla\db\mork\src\morkPortTableCursor.cpp, line 79] 
morkPortTableCursor::~morkPortTableCursor
[d:\builds\seamonkey\mozilla\db\mork\src\morkPortTableCursor.cpp, line 87] 
morkPortTableCursor::`scalar deleting destructor' 
morkObject::Release [d:\builds\seamonkey\mozilla\db\mork\src\morkObject.cpp,
line 68] 
morkThumb::Release [d:\builds\seamonkey\mozilla\db\mork\src\morkThumb.cpp, line
145] 
morkPortTableCursor::Release
[d:\builds\seamonkey\mozilla\db\mork\src\morkPortTableCursor.cpp, line 127] 
nsMsgDBThreadEnumerator::~nsMsgDBThreadEnumerator
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgDatabase.cpp, line 2470] 
nsMsgDBThreadEnumerator::`scalar deleting destructor' 
nsMsgThreadEnumerator::Release
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgThread.cpp, line 707] 
nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 74] 
nsMsgThreadedDBView::InitThreadedView
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgThreadedDBView.cpp, line 171] 
nsMsgThreadedDBView::InitThreadedView
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgThreadedDBView.cpp, line 171] 
nsMsgThreadedDBView::Open
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgThreadedDBView.cpp, line 95] 
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106] 
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2028] 
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1267] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2744] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3426] 
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1019] 
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 182] 
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1220] 
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1830] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3461] 
nsTreeSelection::FireOnSelectHandler
[d:\builds\seamonkey\mozilla\layout\xul\base\src\tree\src\nsTreeSelection.cpp,
line 743] 
nsTreeSelection::Select
[d:\builds\seamonkey\mozilla\layout\xul\base\src\tree\src\nsTreeSelection.cpp,
line 369] 
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106] 
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2028] 
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1267] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2744] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3426] 
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1019] 
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 182] 
nsXBLPrototypeHandler::ExecuteHandler
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp, line 448] 
DoMouse [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseHandler.cpp, line
118] 
nsXBLMouseHandler::MouseDown
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseHandler.cpp, line 124] 
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1316] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3461] 
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6110] 
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6028] 

Comment 5

[[e-mail] (gone - use [e-mail] instead)]

Okay; this looks like a bug I filed, bug 123677.  David, based on the stack, you
agree?

Comment 6

[[e-mail] (gone - use [e-mail] instead)]

Note:  stacks in http://bugzilla.mozilla.org/show_bug.cgi?id=147132#c1 and
http://bugzilla.mozilla.org/show_bug.cgi?id=147132#c4 differ.

To achieve the stack in http://bugzilla.mozilla.org/show_bug.cgi?id=147132#c4, I
simply unzipped and copied Ian's .msf and replaced my much smaller (40k) one
with his large one.   So, on second thought, this might not be an outright DUP.

I'll have to let my profile keep gathering headers and wait for it, perhaps.

Comment 7

[David :Bienvenu]

yes, I would say it's a dup.

Comment 8

[[e-mail] (gone - use [e-mail] instead)]

Okay, I did exactly the same thing on Linux that I did on Win32 - copy the .msf
into my News/host-news directory and tried to open that newsgroup.

My stack was identical to http://bugzilla.mozilla.org/show_bug.cgi?id=147132#c1,
meaning this is indeed a dup of bug 123677.  Odd that doing the same thing on
each OS produces slightly different stacks.

Here is the link to the full incident:

http://climate.netscape.com/reports/SingleIncidentInfo.cfm?dynamicBBID=6698164

*** This bug has been marked as a duplicate of 123677 ***

Comment 9

[[e-mail] (gone - use [e-mail] instead)]

verified dup