202847 - Mozilla crashed while moving cursor with arrow keys in message [@ free_list_remove_ptr]

Status: RESOLVED WORKSFORME

(MailNews Core :: Composition, defect)

Description

[Greg K.]

FizzillaMach/2003-04-21-08-trunk crashes at free_list_remove_ptr when the
down-arrow key is pressed when the text cursor is in a certain position in an
e-mail message composition window. 

The crash goes unreported by TalkBack, so blocking bug 201894.

The crash is reproducible, but thus far only on a certain e-mail message which
shall remain private. I will try to make it generic and formulate generic
reproducible steps.

Comment 1

[Greg K.]

Attachment: Crash report generated by FizzillaMach/2003-04-21-08-trunk showing crash at free_list_remove_ptr

Comment 2

[Wayne Mery (:wsmwk)]

Greg,
Do you still see the problem?

Top of stack from attachment:
Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0xbff82fd0
Thread 0 Crashed:
 #0   0x90004238 in free_list_remove_ptr
 #1   0x90004cec in szone_malloc
 #2   0x90004a64 in malloc_zone_malloc
 #3   0x0136d214 in operator new(unsigned long)
 #4   0x00ff693c in nsBlockFrame::QueryInterface(nsID const&, void**)
 #5   0x0100d9a4 in nsFrame::PeekOffset(nsIPresContext*, nsPeekOffsetStruct*)
 #6   0x0100d0dc in nsFrame::GetNextPrevLineFromeBlockFrame(nsIPresContext*, nsPeekOffsetStruct*, nsIFrame*, int, signed char)
 #

Comment 3

[Wayne Mery (:wsmwk)]

Magnus,

reporter gone, no other bug reports for free_list_remove_ptr

no trunk crashes in past 3 months.
no thunderbrd crashes on talkback in past month (but reporters said talkback wasn't getting invoked)

3 FF crashes on talkback in past month:

TB40949606 free_list_remove_ptr() 1398cf1b MozillaOrgFirefox2MacOSX2007112718 	http://www.glumbert.com I was loading a video on glumbert.com when Firefox quit and this came up. I jad just reopened firefox from force quitting because it froze up on me.

TB 40832815 free_list_remove_ptr() e2f54317 MozillaOrgFirefox2MacOSX2007112718 	

TB40737427 free_list_remove_ptr() 787b4791 MozillaOrgFirefox2MacOSX2007112718 	yahoo playing games

Comment 4

[Wayne Mery (:wsmwk)]

since we don't have a testcase, the question remains (comment 2) is the problem still seen? 

then, it may be interesting ti know of it happens in both suite and thunderbird, and whether the FF crashes are in any way related.

Comment 5

[Wayne Mery (:wsmwk)]

not seeing this in 2 weeks of trunk crash stats, either as top of stack, or part of stack. So closing WFM

Comment 6

[Greg K.]

I’m sure the code which caused this was superseded five years ago.