245459 - Shift-Del in History causes Firefox to crash [@ nsXULTreeBuilder::GetTemplateActionCellFor ]

Status: RESOLVED DUPLICATE of bug 274808

(Firefox :: Bookmarks & History, defect)

Description

[Noam Avnery]

User-Agent:       Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.8a2) Gecko/20040531 Firefox/0.8.0+
Build Identifier: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.8a2) Gecko/20040531 Firefox/0.8.0+

When you select an item from History and click Shift-Del, Firefox crashes.
Happens both for Win/ME and Win/2000.

Reproducible: Always
Steps to Reproduce:
1. Ctrl-H
2. Select an item from the History list
3. Shift-Del

Actual Results:  
Firefox crashes. The popup is different for Win/Me and Win/2000.

Win/ME: "Firefox has caused an error in FIREFOX.EXE. Firefox will now close.
If you continue..."

Win/2000: "The instruction at "0x0051bd66" referenced memory at "0x0000000". The
memory could not be read.
Click on OK..."

Comment 1

[Mike Connor [:mconnor]]

Works for me using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7)
Gecko/20040602 Firefox/0.8.0+

Crashes for me on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a2)
Gecko/20040602 Firefox/0.8.0+, totally clean install.

ccing jst since he was the one who added this.  jst, since we don't have
talkback on trunk, would you have a debug trunk build to check this out with?

Comment 2

[Charles Fenwick]

From current cvs trunk build on Linux:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1084216320 (LWP 24737)]
0x415125f0 in nsXULTreeBuilder::GetTemplateActionCellFor (this=0x89a72a8,
aRow=10, aCol=0x0, aResult=0xbfffb0bc) at
/home/clfenwi/firebird/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp:1478
/home/clfenwi/firebird/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp:1478:44282:beg:0x415125f0
(gdb) bt
#0  0x415125f0 in nsXULTreeBuilder::GetTemplateActionCellFor (this=0x89a72a8,
aRow=10, aCol=0x0, aResult=0xbfffb0bc) at
/home/clfenwi/firebird/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp:1478
#1  0x4150fff8 in nsXULTreeBuilder::GetCellText (this=0x89a72a8, aRow=10,
aCol=0x0, aResult=@0xbfffb210) at
/home/clfenwi/firebird/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp:763
#2  0x40194591 in XPTC_InvokeByIndex () at
/home/clfenwi/firebird/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
#3  0x40b7d775 in XPCWrappedNative::CallMethod (ccx=@0xbfffb370,
mode=CALL_METHOD) at
/home/clfenwi/firebird/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2026
#4  0x40b857ea in XPC_WN_CallMethod (cx=0x81fe8b8, obj=0x8259650, argc=2,
argv=Variable "argv" is not available.
) at
/home/clfenwi/firebird/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1287
#5  0x40052065 in js_Invoke (cx=0x81fe8b8, argc=2, flags=0) at
/home/clfenwi/firebird/mozilla/js/src/jsinterp.c:1281
#6  0x4005d435 in js_Interpret (cx=0x81fe8b8, result=0xbfffb72c) at
/home/clfenwi/firebird/mozilla/js/src/jsinterp.c:3370
#7  0x400520c8 in js_Invoke (cx=0x81fe8b8, argc=1, flags=2) at
/home/clfenwi/firebird/mozilla/js/src/jsinterp.c:1301
#8  0x40b77578 in nsXPCWrappedJSClass::CallMethod (this=0x86afda8,
wrapper=0x8926360, methodIndex=5, info=0x822c5b0, nativeParams=0xbfffbb20) at
/home/clfenwi/firebird/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1336
#9  0x40b71d71 in nsXPCWrappedJS::CallMethod (this=0x8926360,
methodIndex=Variable "methodIndex" is not available.
) at /home/clfenwi/firebird/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:449
#10 0x40194844 in PrepareAndDispatch (methodIndex=Variable "methodIndex" is not
available.
) at
/home/clfenwi/firebird/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:100
#11 0x41437e98 in nsXBLPrototypeHandler::ExecuteHandler (this=0x82d97a0,
aReceiver=0x812f850, aEvent=0x886af10) at
/home/clfenwi/firebird/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp:347
#12 0x41435af8 in nsXBLWindowHandler::WalkHandlersInternal (this=0x844cd1c,
aEvent=0x886af10, aEventType=0x8099908, aHandler=0x82ec748) at
/home/clfenwi/firebird/mozilla/content/xbl/src/nsXBLWindowHandler.cpp:324
#13 0x414368f4 in nsXBLWindowKeyHandler::WalkHandlers (this=0x844cd18,
aKeyEvent=0x886af10, aEventType=0x8099908) at
/home/clfenwi/firebird/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp:152
#14 0x414369d9 in nsXBLWindowKeyHandler::KeyPress (this=0x401bd228,
aKeyEvent=0x886af10) at
/home/clfenwi/firebird/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp:176
#15 0x41318601 in DispatchToInterface (aEvent=0x886af10, aListener=0x409fd464,
aMethod=Variable "aMethod" is not available.
) at
/home/clfenwi/firebird/mozilla/content/events/src/nsEventListenerManager.cpp:128
#16 0x4131b459 in nsEventListenerManager::HandleEvent (this=0x8236c10,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c,
aCurrentTarget=0x812f850, aFlags=514, aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/events/src/nsEventListenerManager.cpp:1544
#17 0x414a92ef in nsWindowRoot::HandleChromeEvent (this=0x812f850,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/dom/src/base/nsWindowRoot.cpp:227
#18 0x4148605c in GlobalWindowImpl::HandleDOMEvent (this=0x8105600,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/dom/src/base/nsGlobalWindow.cpp:892
#19 0x4144f345 in nsXULDocument::HandleDOMEvent (this=0x830b2f0,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/document/src/nsXULDocument.cpp:1244
#20 0x414eed1c in nsXULElement::HandleDOMEvent (this=0x8343130,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/content/src/nsXULElement.cpp:2810
#21 0x414eece8 in nsXULElement::HandleDOMEvent (this=0x848fd20,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/content/src/nsXULElement.cpp:2804
#22 0x414eece8 in nsXULElement::HandleDOMEvent (this=0x848fd58,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/content/src/nsXULElement.cpp:2804
#23 0x414eece8 in nsXULElement::HandleDOMEvent (this=0x8490240,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/content/src/nsXULElement.cpp:2804
#24 0x414f1c28 in nsXULElement::HandleChromeEvent (this=0x8490240,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/content/src/nsXULElement.cpp:3872
#25 0x4148605c in GlobalWindowImpl::HandleDOMEvent (this=0x88661e8,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/dom/src/base/nsGlobalWindow.cpp:892
#26 0x4144f345 in nsXULDocument::HandleDOMEvent (this=0x896dd08,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/document/src/nsXULDocument.cpp:1244
#27 0x414eed1c in nsXULElement::HandleDOMEvent (this=0x87f4ee0,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=514,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/content/src/nsXULElement.cpp:2810
#28 0x414eece8 in nsXULElement::HandleDOMEvent (this=0x894de00,
aPresContext=0x8968cb8, aEvent=0xbfffe0a0, aDOMEvent=0xbfffd91c, aFlags=519,
aEventStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/content/xul/content/src/nsXULElement.cpp:2804
#29 0x4115d061 in PresShell::HandleEventInternal (this=0x8651700,
aEvent=0xbfffe0a0, aView=0x896cbd8, aFlags=1, aStatus=0xbfffde08) at
/home/clfenwi/firebird/mozilla/layout/html/base/src/nsPresShell.cpp:6110
#30 0x4115caf0 in PresShell::HandleEvent (this=0x8651700, aView=0x896cbd8,
aEvent=0xbfffe0a0, aEventStatus=0xbfffde08, aForceHandle=1,
aHandled=@0xbfffde0c) at
/home/clfenwi/firebird/mozilla/layout/html/base/src/nsPresShell.cpp:5979
#31 0x414751da in nsViewManager::HandleEvent (this=0x82b32d8, aView=0x896cbd8,
aEvent=0xbfffe0a0, aCaptured=0) at
/home/clfenwi/firebird/mozilla/view/src/nsViewManager.cpp:2164
#32 0x41474ba4 in nsViewManager::DispatchEvent (this=0x82b32d8, aEvent=Variable
"aEvent" is not available.
) at /home/clfenwi/firebird/mozilla/view/src/nsViewManager.cpp:1952
#33 0x4146ca78 in HandleEvent (aEvent=0xbfffe0a0) at
/home/clfenwi/firebird/mozilla/view/src/nsView.cpp:76
#34 0x41a35e34 in nsCommonWidget::DispatchEvent (this=0x896cc30,
aEvent=0xbfffe0a0, aStatus=@0xbfffe04c) at
/home/clfenwi/firebird/mozilla/widget/src/gtk2/nsCommonWidget.cpp:215
#35 0x41a2a447 in nsWindow::OnKeyPressEvent (this=0x896cc30, aWidget=0x8199c28,
aEvent=0xbfffe0a0) at
/home/clfenwi/firebird/mozilla/widget/src/gtk2/nsWindow.cpp:1593
#36 0x41a2dcac in key_press_event_cb (widget=0x8199c28, event=0x83032a0) at
/home/clfenwi/firebird/mozilla/widget/src/gtk2/nsWindow.cpp:3390
#37 0x40305264 in _gtk_marshal_BOOLEAN__BOXED () from
/opt/gnome/lib/libgtk-x11-2.0.so.0
#38 0x4057f4db in g_closure_invoke () from /opt/gnome/lib/libgobject-2.0.so.0
#39 0x4058ef95 in signal_emit_unlocked_R () from /opt/gnome/lib/libgobject-2.0.so.0
#40 0x4059010f in g_signal_emit_valist () from /opt/gnome/lib/libgobject-2.0.so.0
#41 0x40590652 in g_signal_emit () from /opt/gnome/lib/libgobject-2.0.so.0
#42 0x403e19b4 in gtk_widget_event_internal () from
/opt/gnome/lib/libgtk-x11-2.0.so.0
#43 0x403f4542 in gtk_window_key_press_event () from
/opt/gnome/lib/libgtk-x11-2.0.so.0
#44 0x40305264 in _gtk_marshal_BOOLEAN__BOXED () from
/opt/gnome/lib/libgtk-x11-2.0.so.0
#45 0x4057f1a7 in g_type_class_meta_marshal () from
/opt/gnome/lib/libgobject-2.0.so.0
#46 0x4057f4db in g_closure_invoke () from /opt/gnome/lib/libgobject-2.0.so.0
#47 0x4058f36b in signal_emit_unlocked_R () from /opt/gnome/lib/libgobject-2.0.so.0
#48 0x4059010f in g_signal_emit_valist () from /opt/gnome/lib/libgobject-2.0.so.0
#49 0x40590652 in g_signal_emit () from /opt/gnome/lib/libgobject-2.0.so.0
#50 0x403e19b4 in gtk_widget_event_internal () from
/opt/gnome/lib/libgtk-x11-2.0.so.0
#51 0x402ff872 in gtk_propagate_event () from /opt/gnome/lib/libgtk-x11-2.0.so.0
#52 0x40300c51 in gtk_main_do_event () from /opt/gnome/lib/libgtk-x11-2.0.so.0
#53 0x404bca91 in gdk_event_dispatch () from /opt/gnome/lib/libgdk-x11-2.0.so.0
#54 0x405d39ca in g_main_context_dispatch () from /opt/gnome/lib/libglib-2.0.so.0
#55 0x405d5adb in g_main_context_iterate () from /opt/gnome/lib/libglib-2.0.so.0
#56 0x405d5d07 in g_main_loop_run () from /opt/gnome/lib/libglib-2.0.so.0
#57 0x4030111f in gtk_main () from /opt/gnome/lib/libgtk-x11-2.0.so.0
#58 0x08125b10 in ?? ()
#59 0x00000000 in ?? ()
#60 0x00000000 in ?? ()
#61 0x41a0d3ec in ?? () from
/home/clfenwi/firebird/mozilla/firegtk2/dist/bin/components/libwidget_gtk2.so
#62 0x08125b10 in ?? ()
#63 0x00000000 in ?? ()
#64 0x41a16409 in ?? () from
/home/clfenwi/firebird/mozilla/firegtk2/dist/bin/components/libwidget_gtk2.so
#65 0x4023b498 in ?? () from /opt/gnome/lib/libgtk-x11-2.0.so.0
#66 0x41a56528 in __JCR_LIST__ () from
/home/clfenwi/firebird/mozilla/firegtk2/dist/bin/components/libwidget_gtk2.so
#67 0x08147c78 in ?? ()
#68 0xbfffec50 in ?? ()
#69 0xbfffebe8 in ?? ()
#70 0x4000ca40 in _dl_runtime_resolve () from /lib/ld-linux.so.2
#71 0x41a33c64 in nsAppShell::Run (this=0x8147c78) at
/home/clfenwi/firebird/mozilla/widget/src/gtk2/nsAppShell.cpp:142

Comment 3

[Noam Avnery]

Suggesting Blocking 0.9 since it's a crash

Comment 4

[Steffen Wilberg]

Not blocking 0.9 since it doesn't happen on the branch.

Comment 5

[timeless]

*** Bug 274948 has been marked as a duplicate of this bug. ***

Comment 6

[timeless]

*** This bug has been marked as a duplicate of 274808 ***