30638 - Changing same pref multiple times crashes mozilla

Status: VERIFIED WORKSFORME

(SeaMonkey :: Preferences, defect, P1)

Description

[Biswapesh Chatterjee]

System: Nightly of 20000305 on WinNT 4 SP 6 a on PII
Overview: Changing prefs multiple times crashes mozilla with a stack overflow 
in nsTextFormatter::vsprintf_append.
Test Case: Open browser. Go to Edit->Preferences->Debug. Disable memory cache 
and press OK. Repeat to re-enable memory cache and press OK again.
Expected Result: Normal closure of window.
Actual Result: Crash (See attached crash log)
Other info: Works fine in M14 though the browser window gets minimized every 
time after clicking OK.

Comment 1

[Biswapesh Chatterjee]

Attachment: Crash log containing stack trace

Comment 2

[matt]

*** Bug 27824 has been marked as a duplicate of this bug. ***

Comment 3

[matt]

Open prefs
change any pref
hit ok
open prefs
change any pref
hit ok
crash

Mcafee,  Can you debug this?
I can help you.
nsStr::Compare(const nsStr & {...}, const nsStr & {...}, int -1, int 0) line 610 
+ 37 bytes
nsString::Equals(const nsString & {...}, int 0, int -1) line 1888 + 69 bytes
nsString::operator==(const nsString & {...}) line 1831 + 23 bytes
nsStringKey::Equals(const nsHashKey * 0x00c9c4d0) line 278
_hashKeyCompare(const void * 0x0003310c, const void * 0x00c9c4d0) line 38
PL_HashTableRawLookup(PLHashTable * 0x00c844f0, unsigned int 2189529655, const 
void * 0x0003310c) line 181 + 28 bytes
PL_HashTableLookup(PLHashTable * 0x00c844f0, const void * 0x0003310c) line 344 + 
17 bytes
nsHashtable::Get(nsHashKey * 0x0003310c) line 168 + 15 bytes
nsComponentManagerImpl::ProgIDToClassID(nsComponentManagerImpl * const 
0x00c84950, const char * 0x100b3924, nsID * 0x000331d4) line 1149 + 18 bytes
nsComponentManager::ProgIDToClassID(const char * 0x100b3924, nsID * 0x000331d4) 
line 59
nsServiceManagerImpl::GetService(nsServiceManagerImpl * const 0x00c84cc0, const 
char * 0x100b3924, const nsID & {...}, nsISupports * * 0x00033244, 
nsIShutdownListener * 0x00000000) line 429 + 13 bytes
nsServiceManager::GetService(const char * 0x100b3924, const nsID & {...}, 
nsISupports * * 0x00033244, nsIShutdownListener * 0x00000000) line 545
nsGetServiceByProgID::operator()(const nsID & {...}, void * * 0x00033244) line 
63 + 22 bytes
nsCOMPtr<nsIObserverService>::assign_from_helper(const nsCOMPtr_helper & {...}, 
const nsID & {...}) line 795 + 18 bytes
nsCOMPtr<nsIObserverService>::nsCOMPtr<nsIObserverService>(const nsCOMPtr_helper 
& {...}) line 498
nsEventQueueImpl::NotifyObservers(const char * 0x100b3718) line 166 + 33 bytes
nsEventQueueImpl::~nsEventQueueImpl() line 84
nsEventQueueImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsEventQueueImpl::Release(nsEventQueueImpl * const 0x03c24f70) line 139 + 120 
bytes
nsCOMPtr<nsIEventQueue>::~nsCOMPtr<nsIEventQueue>() line 435
nsAppShellService::Observe(nsAppShellService * const 0x01017cf4, nsISupports * 
0x03c24f70, const unsigned short * 0x000334a4, const unsigned short * 
0x00000000) line 759
nsObserverService::Notify(nsObserverService * const 0x01017530, nsISupports * 
0x03c24f70, const unsigned short * 0x000334a4, const unsigned short * 
0x00000000) line 241
nsEventQueueImpl::NotifyObservers(const char * 0x100b3718) line 169
nsEventQueueImpl::~nsEventQueueImpl() line 84
nsEventQueueImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsEventQueueImpl::Release(nsEventQueueImpl * const 0x03c24f70) line 139 + 120 
bytes
nsCOMPtr<nsIEventQueue>::~nsCOMPtr<nsIEventQueue>() line 435
nsAppShellService::Observe(nsAppShellService * const 0x01017cf4, nsISupports * 
0x03c24f70, const unsigned short * 0x000336ac, const unsigned short * 
0x00000000) line 759
nsObserverService::Notify(nsObserverService * const 0x01017530, nsISupports * 
0x03c24f70, const unsigned short * 0x000336ac, const unsigned short * 
0x00000000) line 241

Comment 4

[matt]

*** Bug 30673 has been marked as a duplicate of this bug. ***

Comment 5

[Phil Peterson]

PDT+. Must stop crash.

Comment 6

[don]

Ugh.  This is bad.

Comment 7

[Chris McAfee]

I cannot reproduce with commercial 3/7 bits (NT),
mjudge cannot reproduce with current debug build.
still looking

Comment 8

[sairuh (rarely reading bugmail)]

this is wfm too on mac, linux and winNT [2000.03.08.xx, opt comm bits]. we are
thus marking as wfm.

Comment 9

[sairuh (rarely reading bugmail)]

biswapesh_chatterjee, is this still a problem for you with a recent build? gonna
verify this, but do reopen if you see it again.

Comment 10

[Biswapesh Chatterjee]

Yup, this seems fine now. Thanks, sairuh.