29562 - crash in tree control after deleting last message in list of messages

Status: VERIFIED DUPLICATE of bug 29556

(MailNews Core :: Backend, defect, P3)

Description

[David :Bienvenu]

Here's the stack trace. This is not easily reproducible but I hit it a 
few times a day. There's something weird going on with aChildFrame - it seems to 
be just an nsISupports in GetRowStartAndCount (though nsIFrame isn't really an 
interface, is it?) anyway...

00000000()
GetRowStartAndCount(nsIFrame * 0x034f28d8, int & -1, int & 0) line 67
nsTreeRowGroupFrame::OnContentRemoved(nsIPresContext * 0x027774b0, nsIFrame * 
0x034f28d8, int 4334) line 1534 + 23 bytes
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x02811b50, 
nsIPresContext * 0x027774b0, nsIContent * 0x04a2aec0, nsIContent * 0x052e33f0, 
int 4334) line 6974
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x02811bf0, nsIPresContext * 
0x027774b0, nsIContent * 0x04a2aec0, nsIContent * 0x052e33f0, int 4334) line 985
PresShell::ContentRemoved(PresShell * const 0x02811948, nsIDocument * 
0x02394970, nsIContent * 0x04a2aec0, nsIContent * 0x052e33f0, int 4334) line 
2644 + 50 bytes
nsXULDocument::ContentRemoved(nsXULDocument * const 0x02394970, nsIContent * 
0x04a2aec0, nsIContent * 0x052e33f0, int 4334) line 1582
nsXULElement::RemoveChildAt(nsXULElement * const 0x04a2aec0, int 4334, int 1) 
line 2377
RDFGenericBuilderImpl::RemoveWidgetItem(nsIContent * 0x02d77ad0, nsIRDFResource 
* 0x03011ef0, nsIRDFResource * 0x052e3500, int 1) line 2385 + 38 bytes
RDFGenericBuilderImpl::OnUnassert(RDFGenericBuilderImpl * const 0x02f02e74, 
nsIRDFResource * 0x033af160, nsIRDFResource * 0x03011ef0, nsIRDFNode * 
0x052e3500) line 1125 + 35 bytes
CompositeDataSourceImpl::OnUnassert(CompositeDataSourceImpl * const 0x02f01114, 
nsIRDFResource * 0x033af160, nsIRDFResource * 0x03011ef0, nsIRDFNode * 
0x052e3500) line 1447
nsMsgRDFDataSource::unassertEnumFunc(nsISupports * 0x02f01114, void * 
0x0012f8d8) line 409
nsSupportsArray::EnumerateForwards(nsSupportsArray * const 0x0308c190, int 
(nsISupports *, void *)* 0x02921520 
nsMsgRDFDataSource::unassertEnumFunc(nsISupports *, void *), void * 0x0012f8d8) 
line 357 + 20 bytes
nsMsgRDFDataSource::NotifyObservers(nsIRDFResource * 0x033af160, nsIRDFResource 
* 0x03011ef0, nsIRDFNode * 0x052e3500, int 0, int 0) line 385
nsMsgFolderDataSource::OnItemAddedOrRemoved(nsISupports * 0x033af160, 
nsISupports * 0x052e3500, const char * 0x029a876c, int 0) line 745
nsMsgFolderDataSource::OnItemRemoved(nsMsgFolderDataSource * const 0x03013b4c, 
nsISupports * 0x033af160, nsISupports * 0x052e3500, const char * 0x029a876c) 
line 706
nsMsgMailSession::NotifyFolderItemDeleted(nsMsgMailSession * const 0x03013aa0, 
nsISupports * 0x033af160, nsISupports * 0x052e3500, const char * 0x029a876c) 
line 238
nsMsgFolder::NotifyItemDeleted(nsISupports * 0x033af160, nsISupports * 
0x052e3500, const char * 0x029a876c) line 2093
nsMsgDBFolder::OnKeyAddedOrDeleted(unsigned int 35628, unsigned int 4294967295, 
int 25, nsIDBChangeListener * 0x00000000, int 0, int 1, int 1) line 600
nsMsgDBFolder::OnKeyDeleted(nsMsgDBFolder * const 0x033af1e0, unsigned int 
35628, unsigned int 4294967295, int 25, nsIDBChangeListener * 0x00000000) line 
561
nsMsgDatabase::NotifyKeyDeletedAll(nsMsgDatabase * const 0x04119490, unsigned 
int 35628, unsigned int 4294967295, int 25, nsIDBChangeListener * 0x00000000) 
line 218 + 28 bytes
nsMsgDatabase::DeleteHeader(nsMsgDatabase * const 0x04119490, nsIMsgDBHdr * 
0x052e3660, nsIDBChangeListener * 0x00000000, int 1, int 1) line 1127
nsMsgDatabase::DeleteMessages(nsMsgDatabase * const 0x04119490, nsMsgKeyArray * 
0x0012fc18, nsIDBChangeListener * 0x00000000) line 1069 + 43 bytes
nsMailDatabase::DeleteMessages(nsMailDatabase * const 0x04119490, nsMsgKeyArray 
* 0x0012fc18, nsIDBChangeListener * 0x00000000) line 183 + 17 bytes
nsImapMailFolder::OnStopRunningUrl(nsImapMailFolder * const 0x03321b24, nsIURI * 
0x04061a34, unsigned int 0) line 3016
nsUrlListenerManager::BroadcastChange(nsIURI * 0x04061a34, nsUrlNotifyType 
nsUrlNotifyStopRunning, unsigned int 0) line 97
nsUrlListenerManager::OnStopRunningUrl(nsUrlListenerManager * const 0x04065d00, 
nsIMsgMailNewsUrl * 0x04061a34, unsigned int 0) line 110 + 18 bytes
nsMsgMailNewsUrl::SetUrlState(nsMsgMailNewsUrl * const 0x04061a34, int 0, 
unsigned int 0) line 105
nsImapMailFolder::SetUrlState(nsImapMailFolder * const 0x033af218, 
nsIImapProtocol * 0x036f3028, nsIMsgMailNewsUrl * 0x04061a34, int 0, unsigned 
int 0) line 3454 + 23 bytes
SetUrlStateProxyEvent::HandleEvent(SetUrlStateProxyEvent * const 0x04077ae0) 
line 1493 + 60 bytes
nsImapEvent::imap_event_handler(PLEvent * 0x04077ae4) line 75
PL_HandleEvent(PLEvent * 0x04077ae4) line 526 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x01418060) line 487 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00940664, unsigned int 49487, unsigned int 0, 
long 21069920) line 975 + 9 bytes
USER32! 77e71820()

Comment 1

[lchiang]

same as http://bugzilla.mozilla.org/show_bug.cgi?id=29556?

Comment 2

[David Hyatt]

*** This bug has been marked as a duplicate of 29556 ***

Comment 3

[lchiang]

verified duplicate