262244 - Crash when pressing Enter in Compose window header field

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect)

Description

[Stefan Borggraefe]

Tested with a Linux Gtk2 debug trunk build compiled 4 hours ago.

Steps to reproduce:

1. Open a Message Compose window (HTML or Plain text doesn't matter)
2. Type something into the To: field.
3. Press Enter

Result: Crash :-(

Could this be another issue introduced by bug 258513?

Stack:
#0  0x4f33d52c in nanosleep () from /lib/tls/libc.so.6
#1  0x4f33d368 in sleep () from /lib/tls/libc.so.6
#2  0x0806c69d in ah_crap_handler (signum=11) at nsSigHandlers.cpp:133
#3  0x41b89464 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:208
#4  <signal handler called>
#5  0x4146bb00 in nsListBoxBodyFrame::OnContentRemoved (this=0x8e70354,
    aPresContext=0x8aa2388, aChildFrame=0x8f76548, aIndex=2)
    at nsListBoxBodyFrame.cpp:1365
#6  0x413c7db7 in NotifyListBoxBody (aPresContext=0x8aa2388,
    aContainer=0x8ed6c30, aChild=0x8fc0d50, aIndexInContainer=2,
    aDocument=0x8a42ab8, aChildFrame=0x8f76548, aUseXBLForms=0,
    aOperation=CONTENT_REMOVED) at nsCSSFrameConstructor.cpp:8751
#7  0x413c9708 in nsCSSFrameConstructor::ContentRemoved (this=0x8a46a38,
    aPresContext=0x8aa2388, aContainer=0x8ed6c30, aChild=0x8fc0d50,
    aIndexInContainer=2, aInReinsertContent=0)
    at nsCSSFrameConstructor.cpp:9411
#8  0x41351a8b in PresShell::ContentRemoved (this=0x8a6e050,
    aDocument=0x8a42ab8, aContainer=0x8ed6c30, aChild=0x8fc0d50,
    aIndexInContainer=2) at nsPresShell.cpp:5133
#9  0x414bb780 in nsDocument::ContentRemoved (this=0x8a42ab8,
    aContainer=0x8ed6c30, aChild=0x8fc0d50, aIndexInContainer=2)
    at nsDocument.cpp:2112
#10 0x416efb81 in nsXULDocument::ContentRemoved (this=0x8a42ab8,
    aContainer=0x8ed6c30, aChild=0x8fc0d50, aIndexInContainer=2)
    at nsXULDocument.cpp:1197
#11 0x417af891 in nsXULElement::RemoveChildAt (this=0x8ed6c30, aIndex=2,
    aNotify=1) at nsXULElement.cpp:1924
#12 0x414f9a51 in nsGenericElement::doReplaceChild (aElement=0x8ed6c30,
    aNewChild=0x9007088, aOldChild=0x8fc0d58, aReturn=0xbfffb8e0)
    at nsGenericElement.cpp:3027
#13 0x417abb4c in nsXULElement::ReplaceChild (this=0x8ed6c30,
    aNewChild=0x9007088, aOldChild=0x8fc0d58, aReturn=0xbfffb8e0)
    at nsXULElement.cpp:848
#14 0x402b3245 in XPTC_InvokeByIndex () at xptcinvoke_gcc_x86_unix.cpp:69
#15 0x403b129a in XPCWrappedNative::CallMethod (ccx=@0xbfffb9b0,
    mode=CALL_METHOD) at xpcwrappednative.cpp:2027
#16 0x403bb845 in XPC_WN_CallMethod (cx=0x8b89ae0, obj=0x8e1aa58, argc=2,
    argv=0x8ff99fc, vp=0xbfffbb60) at xpcwrappednativejsops.cpp:1287
#17 0x4004f517 in js_Invoke (cx=0x8b89ae0, argc=2, flags=0) at jsinterp.c:1280
#18 0x4005ee9e in js_Interpret (cx=0x8b89ae0, result=0xbfffc24c)
    at jsinterp.c:3372
#19 0x4004f591 in js_Invoke (cx=0x8b89ae0, argc=2, flags=6) at jsinterp.c:1300
#20 0x40048821 in fun_apply (cx=0x8b89ae0, obj=0x8e1ac60, argc=2,
    argv=0x8ff9818, rval=0xbfffc480) at jsfun.c:1529
#21 0x4004f517 in js_Invoke (cx=0x8b89ae0, argc=2, flags=0) at jsinterp.c:1280
#22 0x4005ee9e in js_Interpret (cx=0x8b89ae0, result=0xbfffcb6c)
    at jsinterp.c:3372
#23 0x4004f591 in js_Invoke (cx=0x8b89ae0, argc=1, flags=2) at jsinterp.c:1300
#24 0x4004f930 in js_InternalInvoke (cx=0x8b89ae0, obj=0x8e1ac60,
    fval=150850936, flags=0, argc=1, argv=0xbfffced8, rval=0xbfffcdbc)
    at jsinterp.c:1377
#25 0x4001bf76 in JS_CallFunctionValue (cx=0x8b89ae0, obj=0x8e1ac60,
    fval=150850936, argc=1, argv=0xbfffced8, rval=0xbfffcdbc) at jsapi.c:3711
#26 0x4172cbe6 in nsJSContext::CallEventHandler (this=0x8a4e908,
    aTarget=0x8e1ac60, aHandler=0x8fdcd78, argc=1, argv=0xbfffced8,
    rval=0xbfffcdbc) at nsJSEnvironment.cpp:1343
#27 0x417830c3 in nsJSEventListener::HandleEvent (this=0x9006120,
    aEvent=0x9005f68) at nsJSEventListener.cpp:174
#28 0x416d59c9 in nsXBLPrototypeHandler::ExecuteHandler (this=0x8f24ca0,
    aReceiver=0x9005fb0, aEvent=0x9005f68) at nsXBLPrototypeHandler.cpp:490
#29 0x416d08c9 in nsXBLKeyEventHandler::HandleEvent (this=0x8f0c240,
    aEvent=0x9005f68) at nsXBLEventHandler.cpp:143
#30 0x41578a2c in nsEventListenerManager::HandleEventSubType (this=0x8fc9cf8,
    aListenerStruct=0x8fbf1b0, aDOMEvent=0x9005f68, aCurrentTarget=0x9005fb0,
    aSubType=4, aPhaseFlags=4) at nsEventListenerManager.cpp:1512
#31 0x41578e17 in nsEventListenerManager::HandleEvent (this=0x8fc9cf8,
    aPresContext=0x8aa2388, aEvent=0xbfffe700, aDOMEvent=0xbfffdf6c,
    aCurrentTarget=0x9005fb0, aFlags=4, aEventStatus=0xbfffe55c)
    at nsEventListenerManager.cpp:1602
#32 0x417b2f34 in nsXULElement::HandleDOMEvent (this=0x8fbd648,
    aPresContext=0x8aa2388, aEvent=0xbfffe700, aDOMEvent=0xbfffdf6c, aFlags=4,
    aEventStatus=0xbfffe55c) at nsXULElement.cpp:2819
#33 0x417b2da7 in nsXULElement::HandleDOMEvent (this=0x8fbe7a8,
    aPresContext=0x8aa2388, aEvent=0xbfffe700, aDOMEvent=0xbfffdf6c, aFlags=4,
    aEventStatus=0xbfffe55c) at nsXULElement.cpp:2798
#34 0x417b2da7 in nsXULElement::HandleDOMEvent (this=0x8fbe870,
    aPresContext=0x8aa2388, aEvent=0xbfffe700, aDOMEvent=0xbfffdf6c, aFlags=4,
    aEventStatus=0xbfffe55c) at nsXULElement.cpp:2798
#35 0x414f6ec8 in nsGenericElement::HandleDOMEvent (this=0x8fbe920,
    aPresContext=0x8aa2388, aEvent=0xbfffe700, aDOMEvent=0xbfffdf6c, aFlags=7,
    aEventStatus=0xbfffe55c) at nsGenericElement.cpp:1933
#36 0x415d753a in nsHTMLInputElement::HandleDOMEvent (this=0x8fbe920,
    aPresContext=0x8aa2388, aEvent=0xbfffe700, aDOMEvent=0x0, aFlags=1,
    aEventStatus=0xbfffe55c) at nsHTMLInputElement.cpp:1345
#37 0x41353d43 in PresShell::HandleEventInternal (this=0x8a6e050,
    aEvent=0xbfffe700, aView=0x8a8a028, aFlags=1, aStatus=0xbfffe55c)
    at nsPresShell.cpp:5932
#38 0x41353694 in PresShell::HandleEvent (this=0x8a6e050, aView=0x8a8a028,
    aEvent=0xbfffe700, aEventStatus=0xbfffe55c, aForceHandle=1,
    aHandled=@0xbfffe558) at nsPresShell.cpp:5787
#39 0x4171fd25 in nsViewManager::HandleEvent (this=0x8a89fc0, aView=0x8a8a028,
    aEvent=0xbfffe700, aCaptured=0) at nsViewManager.cpp:2253
#40 0x4171f51e in nsViewManager::DispatchEvent (this=0x8a89fc0,
    aEvent=0xbfffe700, aStatus=0xbfffe660) at nsViewManager.cpp:2029
#41 0x41714a65 in HandleEvent (aEvent=0xbfffe700) at nsView.cpp:165
#42 0x41b0497a in nsCommonWidget::DispatchEvent (this=0x8a465e0,
    aEvent=0xbfffe700, aStatus=@0xbfffe75c) at nsCommonWidget.cpp:218
#43 0x41af56ac in nsWindow::OnKeyPressEvent (this=0x8a465e0,
    aWidget=0x8ab5650, aEvent=0x82eec88) at nsWindow.cpp:1603
#44 0x41afa752 in key_press_event_cb (widget=0x8ab5650, event=0x82eec88)
    at nsWindow.cpp:3653
#45 0x4eca7664 in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#46 0x4f7c9c20 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#47 0x4f7ddc25 in g_signal_emit_by_name () from /usr/lib/libgobject-2.0.so.0
#48 0x4f7dc9be in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#49 0x4f7dcee4 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#50 0x4eda6367 in gtk_widget_send_expose () from /usr/lib/libgtk-x11-2.0.so.0
#51 0x4edb43df in gtk_window_propagate_key_event ()
   from /usr/lib/libgtk-x11-2.0.so.0
#52 0x4edb447c in gtk_window_propagate_key_event ()
   from /usr/lib/libgtk-x11-2.0.so.0
#53 0x4eca7664 in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#54 0x4f7c9fb7 in g_cclosure_new_swap () from /usr/lib/libgobject-2.0.so.0
#55 0x4f7c9c20 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#56 0x4f7dd655 in g_signal_emit_by_name () from /usr/lib/libgobject-2.0.so.0
#57 0x4f7dc9be in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#58 0x4f7dcee4 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#59 0x4eda6367 in gtk_widget_send_expose () from /usr/lib/libgtk-x11-2.0.so.0
#60 0x4eca5cae in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#61 0x4eca4956 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#62 0x4eea4195 in _gdk_events_queue () from /usr/lib/libgdk-x11-2.0.so.0
#63 0x4f745932 in g_main_depth () from /usr/lib/libglib-2.0.so.0
#64 0x4f746a28 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#65 0x4f746d60 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#66 0x4f7473a3 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#67 0x4eca4213 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#68 0x41b0145a in nsAppShell::Run (this=0x81a5078) at nsAppShell.cpp:142
#69 0x41aa7410 in nsAppShellService::Run (this=0x81a4e50)
    at nsAppShellService.cpp:488
#70 0x08063b9e in main1 (argc=4, argv=0xbffff464, nativeApp=0x810cfa0)
    at nsAppRunner.cpp:1321
#71 0x080648ce in main (argc=4, argv=0xbffff464) at nsAppRunner.cpp:1799

Comment 1

[Calum Mackay]

I can reproduce merely by clicking in the header of the Compose window.
Thunderbird linux/x86 20040930.

Comment 2

[Scott MacGregor]

this sure looks related. making this a blocker since you can't send a message
with this bug. 

Comment 3

[Brian Ryner (not reading)]

Attachment: patch

Don't try to destroy the frame twice.

Comment 4

[Brian Ryner (not reading)]

checked in

Comment 5

[David :Bienvenu]

*** Bug 262289 has been marked as a duplicate of this bug. ***

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED with the 2004-10-01-05 Windows XP Seamonkey build.