crash on quit, nsTreeSelection::FireOnSelectHandler, deleted boxObject

RESOLVED FIXED in mozilla1.4beta

Status

SeaMonkey
MailNews: Message Display
--
critical
RESOLVED FIXED
16 years ago
11 years ago

People

(Reporter: (not reading, please use seth@sspitzer.org instead), Unassigned)

Tracking

({crash})

Trunk
mozilla1.4beta
x86
Windows 2000
crash

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

crash on quit, nsTreeSelection::FireOnSelectHandler, null boxObject

nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012fb80) line 47 +
20 bytes
nsCOMPtr<nsIBoxObject>::assign_from_helper(const nsCOMPtr_helper & {...}, const
nsID & {...}) line 988 + 18 bytes
nsCOMPtr<nsIBoxObject>::nsCOMPtr<nsIBoxObject>(const nsQueryInterface & {...})
line 573
nsTreeSelection::FireOnSelectHandler() line 732
nsTreeSelection::ClearSelection(nsTreeSelection * const 0x03b2b680) line 490
nsMsgDBView::OnAnnouncerGoingAway(nsMsgDBView * const 0x0495460c,
nsIDBChangeAnnouncer * 0x03f3e200) line 4427
nsMsgDatabase::NotifyAnnouncerGoingAway(nsMsgDatabase * const 0x03f3e200) line
601 + 27 bytes
nsMsgDatabase::ForceClosed(nsMsgDatabase * const 0x03f3e200) line 1094
nsMailDatabase::ForceClosed(nsMailDatabase * const 0x03f3e200) line 196
nsMsgDatabase::CleanupCache() line 641
msgDBModuleDtor(nsIModule * 0x03c1b2c8) line 78
nsGenericModule::Shutdown() line 368 + 10 bytes
nsGenericModule::~nsGenericModule() line 251
nsGenericModule::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsGenericModule::Release(nsGenericModule * const 0x03c1b2c8) line 253 + 145 bytes
nsDll::Shutdown() line 362 + 18 bytes
nsFreeLibrary(nsDll * 0x00f70660, nsIServiceManager * 0x00000000, int 3) line 285
nsFreeLibraryEnum(nsHashKey * 0x00f70540, void * 0x00f70660, void * 0x0012fe80)
line 354 + 64 bytes
hashEnumerate(PLDHashTable * 0x0026db28, PLDHashEntryHdr * 0x00eeb6f8, unsigned
int 39, void * 0x0012fe64) line 115 + 26 bytes
PL_DHashTableEnumerate(PLDHashTable * 0x0026db28, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x1001c010 hashEnumerate(PLDHashTable
*, PLDHashEntryHdr *, unsigned int, void *), void * 0x0012fe64) line 594 + 34 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x100698d0
nsFreeLibraryEnum(nsHashKey *, void *, void *), void * 0x0012fe80) line 303 + 21
bytes
nsNativeComponentLoader::UnloadAll(nsNativeComponentLoader * const 0x0026dac8,
int 3) line 964
nsComponentManagerImpl::UnloadLibraries(nsIServiceManager * 0x00000000, int 3)
line 3129 + 22 bytes
nsComponentManagerImpl::Shutdown() line 901
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 733 + 11 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 144 + 13 bytes
GRE_Shutdown() line 255 + 7 bytes
main(int 2, char * * 0x00271e70) line 1655 + 5 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77ea847c()

I got a fix, at least some wall paper.
Attachment #121761 - Flags: review?(varga)

Comment 3

16 years ago
Comment on attachment 121761 [details] [diff] [review]
patch

r=varga, although I think it should be changed to a weak ref as a long term
solution
Attachment #121761 - Flags: review?(varga) → review+
fix checked in, better to assert than crash.

varga, do you want me to log another bug about using weak refs?
Status: NEW → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → FIXED

Comment 5

16 years ago
yeah, good idea
thanks

Updated

16 years ago
Severity: normal → critical
Keywords: crash

Comment 6

16 years ago
Well no wonder the reference dangles, nobody ever bothers to null it out.
re-opening, even with my lame bulletproofing, I see the crash.

nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012fb7c) line 47 +
23 bytes
nsCOMPtr<nsIBoxObject>::assign_from_helper(const nsCOMPtr_helper & {...}, const
nsID & {...}) line 988 + 18 bytes
nsCOMPtr<nsIBoxObject>::nsCOMPtr<nsIBoxObject>(const nsQueryInterface & {...})
line 573
nsTreeSelection::FireOnSelectHandler() line 732
nsTreeSelection::ClearSelection(nsTreeSelection * const 0x04fafad0) line 490
nsMsgDBView::OnAnnouncerGoingAway(nsMsgDBView * const 0x04faf35c,
nsIDBChangeAnnouncer * 0x03f5e9d8) line 4427
nsMsgDatabase::NotifyAnnouncerGoingAway(nsMsgDatabase * const 0x03f5e9d8) line
601 + 27 bytes
nsMsgDatabase::ForceClosed(nsMsgDatabase * const 0x03f5e9d8) line 1094
nsMailDatabase::ForceClosed(nsMailDatabase * const 0x03f5e9d8) line 196
nsMsgDatabase::CleanupCache() line 641
msgDBModuleDtor(nsIModule * 0x03aa9fd8) line 78
nsGenericModule::Shutdown() line 368 + 10 bytes
nsGenericModule::~nsGenericModule() line 251
nsGenericModule::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsGenericModule::Release(nsGenericModule * const 0x03aa9fd8) line 253 + 145 bytes
nsDll::Shutdown() line 362 + 18 bytes
nsFreeLibrary(nsDll * 0x00f6b4c8, nsIServiceManager * 0x00000000, int 3) line 285
nsFreeLibraryEnum(nsHashKey * 0x00f6b3a8, void * 0x00f6b4c8, void * 0x0012fe80)
line 354 + 64 bytes
hashEnumerate(PLDHashTable * 0x0026db28, PLDHashEntryHdr * 0x00eeb6f8, unsigned
int 39, void * 0x0012fe64) line 115 + 26 bytes
PL_DHashTableEnumerate(PLDHashTable * 0x0026db28, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x1001c010 hashEnumerate(PLDHashTable
*, PLDHashEntryHdr *, unsigned int, void *), void * 0x0012fe64) line 594 + 34 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x100698d0
nsFreeLibraryEnum(nsHashKey *, void *, void *), void * 0x0012fe80) line 303 + 21
bytes
nsNativeComponentLoader::UnloadAll(nsNativeComponentLoader * const 0x0026dac8,
int 3) line 964
nsComponentManagerImpl::UnloadLibraries(nsIServiceManager * 0x00000000, int 3)
line 3129 + 22 bytes
nsComponentManagerImpl::Shutdown() line 901
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 733 + 11 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 144 + 13 bytes
GRE_Shutdown() line 255 + 7 bytes
main(int 2, char * * 0x00271e70) line 1655 + 5 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77ea847c()
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
if I can continue to reproduce this, I may have a shot a fixing it.
Summary: crash on quit, nsTreeSelection::FireOnSelectHandler, null boxObject → crash on quit, nsTreeSelection::FireOnSelectHandler, deleted boxObject
Target Milestone: --- → mozilla1.4beta
Product: Browser → Seamonkey

Updated

13 years ago
Assignee: sspitzer → mail
Status: REOPENED → NEW

Comment 9

12 years ago
perhaps fixed by Bug 305023?
QA Contact: esther
The patch was checked in 2003-04-26
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/tree/src/nsTreeSelection.cpp&rev=1.57&root=/cvsroot&mark=817-819#810

-> FIXED
Status: NEW → RESOLVED
Last Resolved: 16 years ago11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.