203431 - crash on quit, nsTreeSelection::FireOnSelectHandler, deleted boxObject

Status: RESOLVED FIXED

(SeaMonkey :: MailNews: Message Display, defect)

Description

[(not reading, please use [e-mail] instead)]

crash on quit, nsTreeSelection::FireOnSelectHandler, null boxObject

nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012fb80) line 47 +
20 bytes
nsCOMPtr<nsIBoxObject>::assign_from_helper(const nsCOMPtr_helper & {...}, const
nsID & {...}) line 988 + 18 bytes
nsCOMPtr<nsIBoxObject>::nsCOMPtr<nsIBoxObject>(const nsQueryInterface & {...})
line 573
nsTreeSelection::FireOnSelectHandler() line 732
nsTreeSelection::ClearSelection(nsTreeSelection * const 0x03b2b680) line 490
nsMsgDBView::OnAnnouncerGoingAway(nsMsgDBView * const 0x0495460c,
nsIDBChangeAnnouncer * 0x03f3e200) line 4427
nsMsgDatabase::NotifyAnnouncerGoingAway(nsMsgDatabase * const 0x03f3e200) line
601 + 27 bytes
nsMsgDatabase::ForceClosed(nsMsgDatabase * const 0x03f3e200) line 1094
nsMailDatabase::ForceClosed(nsMailDatabase * const 0x03f3e200) line 196
nsMsgDatabase::CleanupCache() line 641
msgDBModuleDtor(nsIModule * 0x03c1b2c8) line 78
nsGenericModule::Shutdown() line 368 + 10 bytes
nsGenericModule::~nsGenericModule() line 251
nsGenericModule::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsGenericModule::Release(nsGenericModule * const 0x03c1b2c8) line 253 + 145 bytes
nsDll::Shutdown() line 362 + 18 bytes
nsFreeLibrary(nsDll * 0x00f70660, nsIServiceManager * 0x00000000, int 3) line 285
nsFreeLibraryEnum(nsHashKey * 0x00f70540, void * 0x00f70660, void * 0x0012fe80)
line 354 + 64 bytes
hashEnumerate(PLDHashTable * 0x0026db28, PLDHashEntryHdr * 0x00eeb6f8, unsigned
int 39, void * 0x0012fe64) line 115 + 26 bytes
PL_DHashTableEnumerate(PLDHashTable * 0x0026db28, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x1001c010 hashEnumerate(PLDHashTable
*, PLDHashEntryHdr *, unsigned int, void *), void * 0x0012fe64) line 594 + 34 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x100698d0
nsFreeLibraryEnum(nsHashKey *, void *, void *), void * 0x0012fe80) line 303 + 21
bytes
nsNativeComponentLoader::UnloadAll(nsNativeComponentLoader * const 0x0026dac8,
int 3) line 964
nsComponentManagerImpl::UnloadLibraries(nsIServiceManager * 0x00000000, int 3)
line 3129 + 22 bytes
nsComponentManagerImpl::Shutdown() line 901
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 733 + 11 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 144 + 13 bytes
GRE_Shutdown() line 255 + 7 bytes
main(int 2, char * * 0x00271e70) line 1655 + 5 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77ea847c()

I got a fix, at least some wall paper.

Comment 1

[(not reading, please use [e-mail] instead)]

Attachment: patch

Comment 2

[(not reading, please use [e-mail] instead)]

similar to stack in http://bugzilla.mozilla.org/show_bug.cgi?id=137815#c16

Comment 3

[Jan Varga [:janv]]

Comment on attachment 121761 [details] [diff] [review]
patch

r=varga, although I think it should be changed to a weak ref as a long term
solution

Comment 4

[(not reading, please use [e-mail] instead)]

fix checked in, better to assert than crash.

varga, do you want me to log another bug about using weak refs?

Comment 5

[Jan Varga [:janv]]

yeah, good idea
thanks

Comment 6

[[e-mail]]

Well no wonder the reference dangles, nobody ever bothers to null it out.

Comment 7

[(not reading, please use [e-mail] instead)]

re-opening, even with my lame bulletproofing, I see the crash.

nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012fb7c) line 47 +
23 bytes
nsCOMPtr<nsIBoxObject>::assign_from_helper(const nsCOMPtr_helper & {...}, const
nsID & {...}) line 988 + 18 bytes
nsCOMPtr<nsIBoxObject>::nsCOMPtr<nsIBoxObject>(const nsQueryInterface & {...})
line 573
nsTreeSelection::FireOnSelectHandler() line 732
nsTreeSelection::ClearSelection(nsTreeSelection * const 0x04fafad0) line 490
nsMsgDBView::OnAnnouncerGoingAway(nsMsgDBView * const 0x04faf35c,
nsIDBChangeAnnouncer * 0x03f5e9d8) line 4427
nsMsgDatabase::NotifyAnnouncerGoingAway(nsMsgDatabase * const 0x03f5e9d8) line
601 + 27 bytes
nsMsgDatabase::ForceClosed(nsMsgDatabase * const 0x03f5e9d8) line 1094
nsMailDatabase::ForceClosed(nsMailDatabase * const 0x03f5e9d8) line 196
nsMsgDatabase::CleanupCache() line 641
msgDBModuleDtor(nsIModule * 0x03aa9fd8) line 78
nsGenericModule::Shutdown() line 368 + 10 bytes
nsGenericModule::~nsGenericModule() line 251
nsGenericModule::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsGenericModule::Release(nsGenericModule * const 0x03aa9fd8) line 253 + 145 bytes
nsDll::Shutdown() line 362 + 18 bytes
nsFreeLibrary(nsDll * 0x00f6b4c8, nsIServiceManager * 0x00000000, int 3) line 285
nsFreeLibraryEnum(nsHashKey * 0x00f6b3a8, void * 0x00f6b4c8, void * 0x0012fe80)
line 354 + 64 bytes
hashEnumerate(PLDHashTable * 0x0026db28, PLDHashEntryHdr * 0x00eeb6f8, unsigned
int 39, void * 0x0012fe64) line 115 + 26 bytes
PL_DHashTableEnumerate(PLDHashTable * 0x0026db28, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x1001c010 hashEnumerate(PLDHashTable
*, PLDHashEntryHdr *, unsigned int, void *), void * 0x0012fe64) line 594 + 34 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x100698d0
nsFreeLibraryEnum(nsHashKey *, void *, void *), void * 0x0012fe80) line 303 + 21
bytes
nsNativeComponentLoader::UnloadAll(nsNativeComponentLoader * const 0x0026dac8,
int 3) line 964
nsComponentManagerImpl::UnloadLibraries(nsIServiceManager * 0x00000000, int 3)
line 3129 + 22 bytes
nsComponentManagerImpl::Shutdown() line 901
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 733 + 11 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 144 + 13 bytes
GRE_Shutdown() line 255 + 7 bytes
main(int 2, char * * 0x00271e70) line 1655 + 5 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77ea847c()

Comment 8

[(not reading, please use [e-mail] instead)]

if I can continue to reproduce this, I may have a shot a fixing it.

Comment 9

[Wayne Mery (:wsmwk)]

perhaps fixed by Bug 305023?

Comment 10

[Mats Palmgren (inactive)]

The patch was checked in 2003-04-26
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/tree/src/nsTreeSelection.cpp&rev=1.57&root=/cvsroot&mark=817-819#810

-> FIXED