349576 - Crash on editing filters [@ nsMsgSearchBoolExpression::~nsMsgSearchBoolExpression]

Status: RESOLVED FIXED

(MailNews Core :: Filters, defect)

Description

[Mike Cowperthwaite]

TB 2a1-0821, Win2K.
Talkback ID: TB22347898K

This has happened several times in varying circumstances.  Each time, I've been editing an existing RSS filter.  I'd thought, in earlier instances, that a key part of this might have been shifting focus to a different window and then back to the Filter Rules dialog; I'm not sure if that was the case in this particular instance.

Good thing drafts are autosaved!  I was in the middle of composing mail to my mom!  :)

Comment 1

[Frank Wein [:mcsmurf]]

That stacktrace is useless, try to get another Talkback ID for that crash?

Comment 2

[Mike Cowperthwaite]

I have sent in at least three Talkbacks for similar crashes in the past week or two, but it appears that if you switch back and forth between build versions, you end up losing old talkback data.  I'll keep an eye out for this.

Comment 3

[timeless]

please review the following incidents:
Incident ID:	22347898
Incident ID: 	22230872
Incident ID: 	22209458
Incident ID: 	22198908
Incident ID: 	22086421
Incident ID: 	21999747
Incident ID: 	20338356
Incident ID: 	19458390
Incident ID: 	18711777
Incident ID: 	18680920

Comment 4

[Mike Cowperthwaite]

(In reply to comment #3)
> please review the following incidents:

I opened this bug with this one:
> Incident ID:    22347898

These two could be related:
> Incident ID:    22209458
> Incident ID:    21999747

The others are probably unrelated or I didn't add a comment (assuming all of those were reported by me).

Comment 5

[timeless]

Well, this one has the right number of stack frames from js.
But note that the trigger reason is stack overflow!

Incident ID: 21999747
Stack Signature	nsMsgSearchBoolExpression::~nsMsgSearchBoolExpression 272a2c06
Product ID	ThunderbirdTrunk
Build ID	2006080806
Trigger Time	2006-08-11 18:19:52.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	thunderbird.exe + (00597876)
URL visited	
User Comments	Editing message filter with multiple criteria. Added a criterion; left rules dialog open without saving, continued reading messages. Returned to rules dialog, clicked OK to Save: crash.
Since Last Crash	143769 sec
Total Uptime	143769 sec
Trigger Reason	Stack overflow
Source File, Line No.	e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 127
Stack Trace 	
nsMsgSearchBoolExpression::~nsMsgSearchBoolExpression  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 127]
XPCWrappedNative::CallMethod  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2162]
XPC_WN_CallMethod  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1449]
js_Invoke  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1350]
js_Interpret  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 4061]
js_Invoke  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1369]
nsXPCWrappedJSClass::CallMethod  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1418]
nsXPCWrappedJS::CallMethod  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 478]
SharedStub  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsEventListenerManager::HandleEventSubType  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1648]
nsEventListenerManager::HandleEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1752]
nsEventTargetChainItem::HandleEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventDispatcher.cpp, line 356]
nsEventTargetChainItem::HandleEventTargetChain  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventDispatcher.cpp, line 433]
nsEventDispatcher::Dispatch  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventDispatcher.cpp, line 643]
PresShell::HandleDOMEventWithTarget  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6272]
nsButtonBoxFrame::DoMouseClick  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp, line 169]
nsButtonBoxFrame::MouseClicked  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsButtonBoxFrame.h, line 62]
nsPresShellEventCB::HandleEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 1484]
nsEventDispatcher::Dispatch  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventDispatcher.cpp, line 643]
PresShell::HandleEventInternal  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6229]
PresShell::HandleEventWithTarget  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6122]
nsEventStateManager::CheckForAndDispatchClick  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 3248]
nsEventStateManager::PostHandleEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 2197]
PresShell::HandleEventInternal  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6247]
PresShell::HandlePositionedEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6104]
PresShell::HandleEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 5932]
nsViewManager::HandleEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 1665]
nsViewManager::DispatchEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp, line 1618]
HandleEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1102]
nsWindow::DispatchMouseEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6037]
ChildWindow::DispatchMouseEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6219]
nsWindow::WindowProc  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1291]
USER32.DLL + 0x3158f (0x77e4158f)
USER32.DLL + 0x31dc9 (0x77e41dc9)
USER32.DLL + 0x31e7e (0x77e41e7e)
nsBaseAppShell::DoProcessNextNativeEvent  [e:/builds/tinderbox/Tb-Trunk/WINNT_5.0_Depend/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp, line 137]
0xc0850845

Comment 6

[Mike Cowperthwaite]

I had a similar crash to this with 2a1-0901 this morning.  Unfortunately, I forgot I was running 2a1 until after I'd dismissed the Talkback, so I can't say for sure it was the same problem.  Still, I think it bears further investigation before 2.0 goes out.

I once again edited an RSS filter (to add a match criterion), which I was able to save.  Then I minimized the window and was working in another program, when suddenly a box popped up showing a TB crash.  This might have been as long as five minutes between minimizing and the crash; the crash might have occurred as a side-effect of a scheduled check-for-new (either POP or RSS).

Comment 7

[JConley]

Same issue: TB23398766Y

Access Violation this time, not Stack Overflow

Stack Signature	 nsMsgSearchBoolExpression::~nsMsgSearchBoolExpression 5a1f011c
Build ID	2006091606
Operating System	Windows NT 5.1 build 2600
Module	thunderbird.exe + (00528cdd)
Trigger Reason	Access violation
Source File, Line No.	e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 129
Stack Trace 	
nsMsgSearchBoolExpression::~nsMsgSearchBoolExpression  [mozilla/mailnews/base/search/src/nsMsgLocalSearch.cpp, line 129]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1449]

Comment 8

[Mike Cowperthwaite]

Got this again with TB 2b1-1004:  Talkback TB24173970Q

Comment 9

[David :Bienvenu]

could the fix for bug 336097 have fixed this? That fix went in on 10/13

Comment 10

[Mike Cowperthwaite]

(In reply to comment #9)
> could the fix for bug 336097 have fixed this? That fix went in on 10/13

I think this is likely.  I've been testing with 2b1 builds (1014 and 1018) but I haven't enountered the crash, altho I've only made a few changes to edited filters.  I'm not sure what's going on that all the stack traces seem to be in different places...

I'll mark this Fixed assuming that patch did the trick; I'll reopen if I encounter the problem again.

Comment 11

[Mike Cowperthwaite]

*** Bug 349171 has been marked as a duplicate of this bug. ***

Comment 12

[David :Bienvenu]

keyword fu to get this off the 2.0 queries - if you re-open this, please remove the fixed1.8.1 keyword - thx!

Comment 13

[Marcia Knous [:marcia]]

verified on the 1.8 branch using WinXP and the Tbird candidate build, version 2.0.0.0 (20070326). Edited several filters and experienced no crashes. Adding branch verified keyword, i will check this on Win 2K as well.