158360 - crash when deleting addresses in mail composer

Status: VERIFIED DUPLICATE of bug 158202

(MailNews Core :: Composition, defect)

Description

[Greg Onufer]

Mozilla crashes when replying to messages with multiple recipients and then
deleting one or more of the recipients.  Sometimes deleting a recipient works
but deleting the next recipient causes the crash.

Repeat by:
-Reply-All to a message with several recipients
-double-click on a recipient in the list (I was not deleting the
 first or last but rather a recipient in the middle in case it
 matters)
-type backspace to clear the recipient
-type backspace again to remove the blank "cc" line from the list

This is reproducible.

SPARC adb stack trace:

adb: fork1 detected: follow (p)arent or (c)hild? p
adb: target forked child process 3005 (debugger following parent)
adb: stop on SIGSEGV
adb: target stopped at:
libgkcontent.so`__1cMnsXULElementQGetOwnerDocument6MppnOnsIDOMDocument__I_+0x88:
ld        [%l0], %g1

$c
libgkcontent.so`__1cMnsXULElementQGetOwnerDocument6MppnOnsIDOMDocument__I_+0x88(
16ee490, ffbfd488, ffbfd4f8, ffbfd7e4, 0, 479d54)
libxpcom.so`XPTC_InvokeByIndex+0x48(16ee494, e, 1, ffbfd488, 4, 6000)
libxpconnect.so`__1cQXPCWrappedNativeKCallMethod6FrnOXPCCallContext_n0AICallMode
__i_+0xc80(ffbfd57c, ffbfd488, 0, ffbfd488, ffbfd3ba, 0)
libxpconnect.so`__1cTXPC_WN_GetterSetter6FpnJJSContext_pnIJSObject_Ipl4_i_+0x188
(bb94f8, 1441498, 0, 179a604, ffbfd688, fe585948)
libmozjs.so`js_Invoke+0x678(bb94f8, 0, 0, fe55e3a0, 0, fe55e3a0)
libmozjs.so`js_InternalInvoke+0xe8(bb94f8, 1441498, 303270, 0, 0, 0)
libmozjs.so`js_GetProperty+0x498(bb94f8, 80000001, 1441498, ffbfdae0, 476e78, 
ffffffff)
libmozjs.so`js_Interpret+0x63ac(bb94f8, 2, 476e78, 179a5f0, 0, 1)
libmozjs.so`js_Invoke+0x6d4(bb94f8, 3, c, 0, 179a5e4, 5ecfd0)
libmozjs.so`js_InternalInvoke+0xe8(bb94f8, aa4f40, 56b380, 0, 3, 1792f88)
libmozjs.so`JS_CallFunctionValue+0x1c(bb94f8, aa4f40, 56b380, 3, 1792f88, 
ffbfdd3c)
libjsdom.so`__1cLnsJSContextQCallEventHandler6Mpv1I1pii_I_+0x1a0(ba4948, aa4f40
, 56b380, 3, 1792f88, ffbfde14)
libjsdom.so`__1cQGlobalWindowImplKRunTimeout6MpnNnsTimeoutImpl__v_+0x38c(bb93c8
, c81fc0, 0, c81fc0, 1, 0)
libjsdom.so`__1cQGlobalWindowImplNTimerCallback6FpnInsITimer_pv_v_+0x14(1691510
, c81fc0, 64, 59, 5a, 1)
libxpcom.so`__1cLnsTimerImplEFire6M_v_+0xac(0, 1691510, 1, 7e7d4, ab4, 7e66c)
libxpcom.so`__1cQhandleTimerEvent6FpnOTimerEventType__pv_+0xe0(14bf220, 1, 1, 
76b3c, 1, 0)
libxpcom.so`PL_HandleEvent+0x14(14bf220, 0, 0, 0, 0, 0)
libxpcom.so`PL_ProcessPendingEvents+0x7c(76b38, 0, 0, 0, 0, 0)
libxpcom.so`__1cQnsEventQdDueueImplUProcessPendingEvents6M_I_+0x34(bf6f0, 6, 1, 
1, 0, 0)
0xfe1ae764(2b9e20, 1, 2be258, fed9fea8, 1, abc)
libglib-1.2.so.0.0.10`g_io_unix_dispatch+0x18(2b9008, ffbfe3b0, 2be258, fed9fea8
, 23, feda0010)
libglib-1.2.so.0.0.10`g_main_dispatch+0x11c(0, fed9fe10, ab4, aac, ab4, aac)
libglib-1.2.so.0.0.10`g_main_iterate+0x6c0(ab4, 1, 800, abc, ab4, aac)
libglib-1.2.so.0.0.10`g_main_run+0x3c(2be268, 0, fed9fe30, 0, 0, 28)
libgtk-1.2.so.0.9.1`gtk_main+0x10c(2c00, 0, 10, bf6f0, 620, fe1f51b0)
libwidget_gtk.so`__1cKnsAppShellDRun6M_I_+0x3c(280d68, fd25a9f0, fd243920, 0, a0
, 2260b)
0x1a284(0, 0, 0, ffbfe5d8, ffbfe5b8, ffbfe5f8)
main+0x160(3, ffbfe744, ffbfe754, 66400, 0, 0)
_start+0x108(0, 0, 0, 0, 0, 0)

Comment 1

[Greg Onufer]

I was using 2002071818 trunk build.  This seems to be a fairly recent (less than
a few days to a week) regression.

Comment 2

[Greg Onufer]

I just noticed 158202 which has a very similar stack trace.  I've brought over
the current trunk and am building it now to see if this problem goes away.

Comment 3

[Greg Onufer]

No longer reproducible with 2002071912.  Likely to be a dup of 158202.

Comment 4

[Boris Zbarsky [:bzbarsky]]

same stack, so....

*** This bug has been marked as a duplicate of 158202 ***

Comment 5

[Vedran Miletic]

v