315453 - [FIX]SeaMonkey crash [@ nsCSSFrameConstructor::RestyleEvent::HandleEvent] when closing after using 'Reply' in MailNews

Status: VERIFIED FIXED

(Core :: Layout, defect, P1)

Description

[Ruediger Lahl]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051107 SeaMonkey/1.5a
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051107 SeaMonkey/1.5a

After you open the Composer to answer a posting(its not necessary to send the answer), SeaMonkey crash when you close SeaMonkey after that.

Reproducible: Always

Steps to Reproduce:
1.Open MailNews
2.Select a mail/posting
3.Klick on 'Reply'
4.Leave the composer after that(sending an answer is not necessary)
5.Close Seamonkey

Actual Results:  
Crash after the SeaMonkey-Window allready is closed

Expected Results:  
no crash

Linux-builds are allso affected.

Comment 1

[Tobias Fischer]

Hmm. I can confirm this crash using: 

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20051107 SeaMonkey/1.5a Mnenhy/0.7.2.10015 {Build ID: 2005110710}

Got an TB-Incident: TB11568018K but it was not processed at moment, so I cant add the Stack.

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

Confirming with build 2005-11-07-10 of SeaMonkey trunk on Windows XP.

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

Likely is the fix in bug 314776:

nsCSSFrameConstructor::RestyleEvent::HandleEvent  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13302]
0x778b0c24
nsBidi::doWriteReverse  [e:/builds/tinderbox/thunderbird-trunk/WINNT_5.0_Depend/mozilla/layout/base/nsBidi.cpp, line 2211]
0xe9c03330

Comment 4

[Boris Zbarsky [:bzbarsky]]

Yeah, this is a regression from bug 314776

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed patch

Composer is torn down after the frame tree in this case and tries to reconstruct style after messing with override sheets...  We want to just ignore that on a destroyed presshell.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 202194 [details] [diff] [review]
Proposed patch

Didn't I review moving mIsDestroying as part of another patch?  Anyway, r+sr=dbaron.

Comment 7

[Boris Zbarsky [:bzbarsky]]

I moved mDidInitialReflow in bug 314776...

Comment 8

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 9

[Boris Zbarsky [:bzbarsky]]

*** Bug 315560 has been marked as a duplicate of this bug. ***

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using SeaMonkey 1.5a

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051108 Mozilla/1.0