264341 - crash [@ nsTreeRange::Invalidate ]

Status: RESOLVED DUPLICATE of bug 305023

(Core :: XUL, defect)

Description

[Adam Hauner]

2004101006/trunk/W2K

While switching folders with filtered view.

TB1299394:
nsTreeRange::Invalidate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/tree/src/nsTreeSelection.cpp,
line 216]
0xffffffff
nsMsgQuickSearchDBView::Sort 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/mailnews/base/src/nsMsgQuickSearchDBView.cpp,
line 215]
nsMsgQuickSearchDBView::OnSearchDone 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/mailnews/base/src/nsMsgQuickSearchDBView.cpp,
line 189]
nsMsgSearchSession::NotifyListenersDone 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/mailnews/base/search/src/nsMsgSearchSession.cpp,
line 594]
nsMsgSearchSession::TimerCallback 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/mailnews/base/search/src/nsMsgSearchSession.cpp,
line 527]
xpcom.dll + 0x295df (0x610b95df)
xpcom.dll + 0x299ac (0x610b99ac)
nsAppShell::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 142]
nsAppShellService::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 489]
main1 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1331]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1802]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1828]
WinMainCRTStartup()
KERNEL32.DLL + 0x2893d (0x796f893d)

Trunk incidents with this signature (5):
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsTreeRange%3A%3AInvalidate&vendor=All&product=MozillaTrunk&platform=All&buildid=&sdate=&stime=&edate=&etime=

All incidents with this signature (114) - but not all have same stack:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsTreeRange%3A%3AInvalidate&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=

Comment 1

[Mitch]

Attachment: Stack from Solaris thunderbird

We're seeing a similar stack on Solaris. This is not windows specific.

Comment 2

[Adam Hauner]

Note: Actual data from Talkback doesn't show any incident for MozillaTrunk,
around 70 incidents for Aviary, mostly for Firefox.

Comment 3

[Asa Dotzler [:asa]]

This is crashing me somewhat regularly on the trunk. 

Comment 4

[Wayne Mery (:wsmwk)]

anyone still see this crash?


there are several on talkback for TB20014 (Thunderbird2). spot checking 5 - none have same stack as thsi bug

=================================================================================
TB45002645
Stack Signature	nsTreeRange::Invalidate 906bd749
Product ID	Thunderbird2
Build ID	2008042104
Trigger Time	2008-05-10 23:40:59.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	thunderbird.exe + (0031774d)
URL visited	
User Comments	Thunderbird was in the background, had just alerted that new emails had arrived
Since Last Crash	637564 sec
Total Uptime	637564 sec
Trigger Reason	Access violation
Source File, Line No.	e:/builds/tinderbox/Tb-Mozilla1.8-Release/WINNT_5.0_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeSelection.cpp, line 216
Stack Trace 	
nsTreeRange::Invalidate  [mozilla/layout/xul/base/src/tree/src/nsTreeSelection.cpp, line 216]
nsMsgDBView::RestoreSelection  [mozilla/mailnews/base/src/nsMsgDBView.cpp, line 820]
nsMsgGroupView::HandleDayChange  [mozilla/mailnews/base/src/nsMsgGroupView.cpp, line 431]
nsMsgGroupView::OnHdrChange  [mozilla/mailnews/base/src/nsMsgGroupView.cpp, line 525]
nsMsgDatabase::NotifyHdrChangeAll  [mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 619]
nsMsgDatabase::SetStringProperty  [mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 2242]
nsMsgLocalMailFolder::OnMessageClassified  [mozilla/mailnews/local/src/nsLocalMailFolder.cpp, line 3696]
nsBayesianFilter::classifyMessage  [mozilla/mailnews/extensions/bayesian-spam-filter/src/nsBayesianFilter.cpp, line 1203]
MessageClassifier::analyzeTokens  [mozilla/mailnews/extensions/bayesian-spam-filter/src/nsBayesianFilter.cpp, line 1012]
nsMsgProtocol::OnStopRequest  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 392]
nsMailboxProtocol::OnStopRequest  [mozilla/mailnews/local/src/nsMailboxProtocol.cpp, line 395]
nsInputStreamPump::OnStateStop  [mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 564]
0x0737c860
nsMailboxProtocol::`vftable'
nsResProtocolHandler::AddRef  [mozilla/netwerk/protocol/res/src/nsResProtocolHandler.cpp, line 189]
0x8b560c45
====================================================================
TB6859821
Stack Signature	nsTreeRange::Invalidate 1497c112
Product ID	Thunderbird2
Build ID	2008042104
Trigger Time	2008-06-23 20:40:25.0
Platform	Win32
Operating System	Windows NT 6.0 build 6000
Module	thunderbird.exe + (0031774d)
URL visited	
User Comments	Checking for new messages with POP mail.
Since Last Crash	171438 sec
Total Uptime	1263276 sec
Trigger Reason	Access violation
Source File, Line No.	e:/builds/tinderbox/Tb-Mozilla1.8-Release/WINNT_5.0_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeSelection.cpp, line 216
Stack Trace 	
nsTreeRange::Invalidate  [mozilla/layout/xul/base/src/tree/src/nsTreeSelection.cpp, line 216]
nsMsgDBView::RestoreSelection  [mozilla/mailnews/base/src/nsMsgDBView.cpp, line 820]
nsMsgGroupView::HandleDayChange  [mozilla/mailnews/base/src/nsMsgGroupView.cpp, line 431]
nsMsgGroupView::OnNewHeader  [mozilla/mailnews/base/src/nsMsgGroupView.cpp, line 442]
nsMsgDBView::OnHdrAdded  [mozilla/mailnews/base/src/nsMsgDBView.cpp, line 4720]
nsMsgDatabase::AddNewHdrToDB  [mozilla/mailnews/db/msgdb/src/nsMsgDatabase.cpp, line 3100]
nsPop3Sink::IncorporateComplete  [mozilla/mailnews/local/src/nsPop3Sink.cpp, line 863]
nsPop3Protocol::HandleLine  [mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3430]
nsPop3Protocol::RetrResponse  [mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3207]
nsPop3Protocol::ProcessProtocolState  [mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3861]
nsMsgProtocol::OnDataAvailable  [mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 494]
nsInputStreamPump::OnInputStreamReady  [mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 398]
nsInputStreamReadyEvent::EventHandler  [mozilla/xpcom/io/nsStreamUtils.cpp, line 217]
ntdll.dll + 0x100c24 (0x778b0c24)
0x2e02e804
nsWebBrowserFind::SetSelectionAndScroll  [mozilla/embedding/components/find/src/nsWebBrowserFind.cpp, line 473]
nsHTMLInputElement::SetSize  [mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 668]
0x0020006e
nsDocShell::FindItemWithName  [mozilla/docshell/base/nsDocShell.cpp, line 2237]
nsRuleNode::ComputeTextResetData  [mozilla/layout/style/nsRuleNode.cpp, line 2381]
nsFrameList::GetNextVisualFor  [mozilla/layout/generic/nsFrameList.cpp, line 632]
nsFrameList::GetNextVisualFor  [mozilla/layout/generic/nsFrameList.cpp, line 641]
HTMLContentSink::OpenBody  [mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2602]
0x00200064
nsParser::DetectMetaTag  [mozilla/parser/htmlparser/src/nsParser.cpp, line 2523]
nsHTMLInputElement::GetSize  [mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 653]
HTMLContentSink::OpenBody  [mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2605]
nsRuleNode::ComputeTextResetData  [mozilla/layout/style/nsRuleNode.cpp, line 2390]
nsTableOuterFrame::OuterReflowChild  [mozilla/layout/tables/nsTableOuterFrame.cpp, line 1239]
nsWebBrowserFind::SetSelectionAndScroll  [mozilla/embedding/components/find/src/nsWebBrowserFind.cpp, line 477]
nsXBLProtoImplProperty::InstallMember  [mozilla/content/xbl/src/nsXBLProtoImplProperty.cpp, line 177]
nsWebBrowserFind::SetSelectionAndScroll  [mozilla/embedding/components/find/src/nsWebBrowserFind.cpp, line 473]
nsWebBrowserFind::SetSelectionAndScroll  [mozilla/embedding/components/find/src/nsWebBrowserFind.cpp, line 473]
nsXBLProtoImplProperty::InstallMember  [mozilla/content/xbl/src/nsXBLProtoImplProperty.cpp, line 177]
Area::GetArea  [mozilla/layout/generic/nsImageMap.cpp, line 125]
nsTableOuterFrame::OuterReflowChild  [mozilla/layout/tables/nsTableOuterFrame.cpp, line 1239]
nsXBLBinding::InstallEventHandlers  [mozilla/content/xbl/src/nsXBLBinding.cpp, line 736]
nsHTMLInputElement::GetSize  [mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 653]
0x0020006e
nsScriptNameSpaceManager::LookupName  [mozilla/dom/src/base/nsScriptNameSpaceManager.cpp, line 537]
0x00200065
HTMLContentSink::CloseHead  [mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2582]
nsSplitterFrameInner::MouseUp  [mozilla/layout/xul/base/src/nsSplitterFrame.cpp, line 513]
Area::GetArea  [mozilla/layout/generic/nsImageMap.cpp, line 126]
nsPluginInstanceOwner::EnsureCachedAttrParamArrays  [mozilla/layout/generic/nsObjectFrame.cpp, line 3257]
nsISO2022CNToUnicode::Convert  [mozilla/intl/uconv/ucvcn/nsISO2022CNToUnicode.cpp, line 522]
Area::GetArea  [mozilla/layout/generic/nsImageMap.cpp, line 126]
HTMLContentSink::OpenBody  [mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2605]
nsWebBrowserFind::SetSelectionAndScroll  [mozilla/embedding/components/find/src/nsWebBrowserFind.cpp, line 473]
nsHTMLInputElement::SetSize  [mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 668]
0x002e006e
0x000a000d

Comment 5

[Jesse Ruderman]

smaug, is this stack trace useful?  If it's not, please resolve as WFM or INCO.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Well, at least Talkback shows these crashes with TB2.x
Probably a dup of Bug 305023.

Comment 7

[Jesse Ruderman]

Thanks.