15683 - Closing Account Setup window crashes apprunner

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Account Configuration, defect, P1)

Description

[fenella]

Linux (1999-10-06-08 M11)
1. From Messenger
2. Select Edit|Account Setup to open the Account Settings dialog
3. Click on the OK button (or X)
Actual result: Apprunner crashes with a core file
Expected result: It should not crash apprunner

Have not tried other platforms yet.

Comment 1

[fenella]

MAC (1999-10-06-09-M11)
Win32(1999-10-06-08 M11)
This is a all platform bug. It occurs on Mac and Win_nt 4.0 as well.

Comment 2

[Alec Flett]

stack trace?

Comment 3

[Alec Flett]

Here's a stack trace. Looks like layout, probably XUL.
Note that the stack trace looks probably recursive... in gdb the stack is
thousands of frames deep... I'm only showing the first few lines.

Upping to blocker and reassigning to trudelle for triage and CC'ing waterson,
rjc, and rods because I have a feeling this relates to using templates to
construct <select> widgets.

This is very easily reproducable. Just open mail, then open the account setup
dialog, then close it using the OK or Cancel button.

#0  0x40c61c69 in nsGenericElement::GetParentNode (this=0x9668a70,
    aParentNode=0xbfe02040) at nsGenericElement.cpp:261
#1  0x40b547df in nsHTMLOptionElement::GetParentNode (this=0x9668a58,
    aParentNode=0xbfe02040) at nsHTMLOptionElement.cpp:76
#2  0x40b5389f in nsHTMLOptionElement::GetSelect (this=0x9668a58,
    aSelectElement=@0xbfe0206c) at nsHTMLOptionElement.cpp:500
#3  0x40b52deb in nsHTMLOptionElement::SetParent (this=0x9668a58, aParent=0x0)
    at nsHTMLOptionElement.cpp:193
#4  0x4075bf6d in RDFElementImpl::~RDFElementImpl (this=0x9668818, __in_chrg=3)
    at nsRDFElement.cpp:696
#5  0x4075c4ea in RDFElementImpl::Release (this=0x9668818)
    at nsRDFElement.cpp:777
#6  0x40b53985 in nsHTMLOptionElement::GetSelect (this=0x9668a58,
    aSelectElement=@0xbfe02130) at nsHTMLOptionElement.cpp:527
#7  0x40b52deb in nsHTMLOptionElement::SetParent (this=0x9668a58, aParent=0x0)
    at nsHTMLOptionElement.cpp:193
#8  0x4075bf6d in RDFElementImpl::~RDFElementImpl (this=0x9668818, __in_chrg=3)
    at nsRDFElement.cpp:696
#9  0x4075c4ea in RDFElementImpl::Release (this=0x9668818)
    at nsRDFElement.cpp:777
#10 0x40b53985 in nsHTMLOptionElement::GetSelect (this=0x9668a58,
    aSelectElement=@0xbfe021f4) at nsHTMLOptionElement.cpp:527
#11 0x40b52deb in nsHTMLOptionElement::SetParent (this=0x9668a58, aParent=0x0)
---Type <return> to continue, or q <return> to quit---
    at nsHTMLOptionElement.cpp:193
#12 0x4075bf6d in RDFElementImpl::~RDFElementImpl (this=0x9668818, __in_chrg=3)
    at nsRDFElement.cpp:696
#13 0x4075c4ea in RDFElementImpl::Release (this=0x9668818)
    at nsRDFElement.cpp:777
#14 0x40b53985 in nsHTMLOptionElement::GetSelect (this=0x9668a58,
    aSelectElement=@0xbfe022b8) at nsHTMLOptionElement.cpp:527
#15 0x40b52deb in nsHTMLOptionElement::SetParent (this=0x9668a58, aParent=0x0)
    at nsHTMLOptionElement.cpp:193
#16 0x4075bf6d in RDFElementImpl::~RDFElementImpl (this=0x9668818, __in_chrg=3)
    at nsRDFElement.cpp:696
#17 0x4075c4ea in RDFElementImpl::Release (this=0x9668818)
    at nsRDFElement.cpp:777
#18 0x40b53985 in nsHTMLOptionElement::GetSelect (this=0x9668a58,
    aSelectElement=@0xbfe0237c) at nsHTMLOptionElement.cpp:527
#19 0x40b52deb in nsHTMLOptionElement::SetParent (this=0x9668a58, aParent=0x0)
    at nsHTMLOptionElement.cpp:193
#20 0x4075bf6d in RDFElementImpl::~RDFElementImpl (this=0x9668818, __in_chrg=3)
    at nsRDFElement.cpp:696
#21 0x4075c4ea in RDFElementImpl::Release (this=0x9668818)
    at nsRDFElement.cpp:777
#22 0x40b53985 in nsHTMLOptionElement::GetSelect (this=0x9668a58,
    aSelectElement=@0xbfe02440) at nsHTMLOptionElement.cpp:527

Comment 4

[Alec Flett]

more information
Indeed it is the combo boxes with templates
Just load chrome://messenger/content/am-copies.xul and then go to any other
page. crashes viewer and apprunner.

Comment 5

[Peter Trudelle]

Those are HTML Forms Controls, not XPToolkit widgets. reassigning to kmcclusk

Comment 6

[leger]

Setting to M11.  Not in M10 builds. Affecting testing.

Comment 7

[lchiang]

The effect this has on QA is that when the crash occurs, the changes made in
Account Setup don't get saved to prefs file.

Comment 8

[Jon Granrose]

this is a blocker, tree stays closed today until there is traction or a fix
checked in.  anyone tested today's build yet?

added self to cc

Comment 9

[lchiang]

We'll try in M11 builds from today.  I would think that the problem is still
there since alecf tried it just early this morning.

Comment 10

[fenella]

Linux (1999-10-07-08 M11)
Win32 (1999-10-07-09 M11)
Mac (1999-10-07-08 M11) mozilla
This problem still exists in today's M11 builds

Comment 11

[rods (gone)]

My guess is this is a Eric Pollmann bug.

Comment 12

[Chris Waterson]

workaround hack checked in.

Comment 13

[Eric Pollmann]

Yes, I wrote the code responsible for this bug back in March.  I'm rewriting
GetSelect now to manage refcounting a little better...  :S

Comment 14

[lchiang]

Fenella, when there are new M11 builds, can you verify this bug fix?  Thanks.

Comment 15

[Jon Granrose]

respinning all platforms with this fix.  linux just finished, mac and win32
pending.

Comment 16

[fenella]

Linux (1999-10-11-14 M11) commercial
Win32 (1999-10-11-15-M11) commercial
Mac (1999-10-11-08 M11)
closing Account Setup dialog crash has been fixed.