37597 - Mail, Proxies: crash clicking textfield associate w/selected radio button (in nsXULRadioGroupElement::SetSelectedItem)

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[R.K.Aa.]

Build ID 2000-042809 M16 Linux

Mozilla crash when i select the diskspace box in prefs/mail and newsgroups
Happens each time.
Don't know which module this is - "preferences backend" looked nice :)

-start moz
-open edit/prefs
-double-click "mail and newsgroups"
-select "Disk Space"
-click once in box outside "Keep messages which have arrived within the past"
-crash

from bt without debugging symbols:

Program received signal SIGSEGV, Segmentation fault.
0x40812ffe in NSGetModule ()
(gdb) bt
#0  0x40812ffe in NSGetModule ()
#1  0x407cba46 in NSGetModule ()
#2  0x4006b805 in js_Interpret ()
#3  0x400656da in js_Invoke ()
#4  0x400658bc in js_InternalInvoke ()
#5  0x4004d6df in JS_CallFunctionValue ()
#6  0x401ed99e in nsJSContext::CallEventHandler ()
#7  0x40219d3c in nsJSEventListener::HandleEvent ()

Comment 1

[R.K.Aa.]

adding crash keyword.

Comment 2

[Andreas Franke (gone)]

Actually, the crash is in nsXULRadioGroupElement::SetSelectedItem :)
It seems to be one of the things that regressed between 2000042416 and
2000042512. Adding regression keyword, extending summary.

#0  0x40f03ede in nsXULRadioGroupElement::SetSelectedItem ()
   from /build/dist/bin/components/librdf.so
#1  0x40ebca36 in SetXULRadioGroupElementProperty ()
   from /build/dist/bin/components/librdf.so
#2  0x4006b845 in js_Interpret ()
   from /build/dist/bin/libmozjs.so
#3  0x4006571a in js_Invoke ()
   from /build/dist/bin/libmozjs.so
#4  0x400658fc in js_InternalInvoke ()
   from /build/dist/bin/libmozjs.so
#5  0x4004d71f in JS_CallFunctionValue ()
   from /build/dist/bin/libmozjs.so
#6  0x40d8c99e in nsJSContext::CallEventHandler ()
   from /build/dist/bin/libjsdom.so
#7  0x40db8c3c in nsJSEventListener::HandleEvent ()
   from /build/dist/bin/libjsdom.so
#8  0x40c8a4e2 in nsXBLEventHandler::ExecuteHandler ()
   from /build/dist/bin/components/libraptorhtml.so
#9  0x40c89b4f in nsXBLEventHandler::MouseUp ()
   from /build/dist/bin/components/libraptorhtml.so

Comment 3

[R.K.Aa.]

hmmph. Should i upgrade gdb here or is this due to lack of debugging symbols in
nightlies? I got the same backtrace all the time.

Comment 4

[neeti]

Changing component to preferences

Comment 5

[Chris Siebenmann]

 This also happens if you click in a text field in Preferences | Advanced |
Proxies. Just before the crash Mozilla reports
	JavaScript error: 
	 line 0: 
(and a blank line or two)

 [e-mail]: nightlies are (mostly) stripped, so you get very few symbols.
You need to build from CVS (even an optimized/no-debug build) in order to get
function names in gdb backtraces. (This change saves over a megabyte in the
download size, and something like eight megabytes in the unpacked version.)

Comment 6

[sairuh (rarely reading bugmail)]

yep, i can repro this using 2000.05.02.xx comm bits on linux, mac and winNT,
with slight modification to the steps:

after clicking just outside of the "Keep messages which have arrived within the
past" textfield, i then clicked *inside* that textfield -> crash.

jrgm, does this ring any toolkit bells for you? i wonder if this happens
elsewhere in the app.

talkback incident #9774153 for winNT:



0x00000000 
nsXULRadioGroupElement::SetSelectedItem
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULRadioGroupElement.cpp, line
91] 
SetXULRadioGroupElementProperty
[d:\builds\seamonkey\mozilla\rdf\content\src\nsJSXULRadioGroupElement.cpp, line
132] 
js_SetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2161] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2365] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 703] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 776] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2796] 
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 791] 
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsXBLEventHandler::ExecuteHandler
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLEventHandler.cpp, line 452] 
nsXBLEventHandler::MouseUp
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLEventHandler.cpp, line 154] 
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line
769] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3294] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3319] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3319] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3319] 
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\layout\base\src\nsGenericElement.cpp, line 1043] 
nsHTMLInputElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp,
line 733] 
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3410] 
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3340] 
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 774] 
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 747] 
nsViewManager2::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1372] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 69] 
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 531] 
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 548] 
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3359] 
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3564] 
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2477] 
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 781] 
USER32.dll + 0x1820 (0x77e71820) 


talkback incident #9774170 for MacOS:

0x93e1fffc 
SetXULRadioGroupElementProperty() [nsJSXULRadioGroupElement.cpp, line 131] 
js_Interpret() [jsinterp.c, line 2352] 
js_Invoke() [jsinterp.c, line 702] 
js_InternalInvoke() [jsinterp.c, line 774] 
JS_CallFunctionValue() [jsapi.c, line 2792] 
DOM_DLL + 0x80c4 (0x05c64554) 
DOM_DLL + 0x6260c (0x05cbea9c) 
nsXBLEventHandler::ExecuteHandler() [nsXBLEventHandler.cpp, line 449] 
nsXBLEventHandler::MouseUp() [nsXBLEventHandler.cpp, line 153] 
nsEventListenerManager::HandleEvent() [nsEventListenerManager.cpp, line 768] 
nsXULElement::HandleDOMEvent() [nsXULElement.cpp, line 3292] 
nsXULElement::HandleDOMEvent() [nsXULElement.cpp, line 3316]


still waiting on cyclone to show me the linux talkback report info, argh.

Comment 7

[(not reading, please use [e-mail] instead)]

ben thinks this bug is a sympton of 36655

Comment 8

[sairuh (rarely reading bugmail)]

*** Bug 38183 has been marked as a duplicate of this bug. ***

Comment 9

[sairuh (rarely reading bugmail)]

joseph found another instance of this:

1. go to Advanced > Proxies
2. select the radio button "Manual proxy configuration"
3. Click into the text field for "Http proxy"

same trace'n'all. updated summary to reflect a more general case.

Comment 10

[Asa Dotzler [:asa]]

*** Bug 38127 has been marked as a duplicate of this bug. ***

Comment 11

[John Morrison]

*** Bug 38254 has been marked as a duplicate of this bug. ***

Comment 12

[John Morrison]

*** Bug 38224 has been marked as a duplicate of this bug. ***

Comment 13

[John Morrison]

re-assigning to hyatt (hey, he once "marked the territory", after all).

This crashes with a freshly pulled tree on linux: 

1) Edit->Preferences
2) Advanced -> Proxies
3) click the radio button for "Manual Proxy Configuration"
4) set focus in the textfield
5) crashes

Comment 14

[John Morrison]

re-assigning to hyatt (hey, he once "marked the territory", after all).

This crashes with a freshly pulled tree on linux: 

1) Edit->Preferences
2) Advanced -> Proxies
3) click the radio button for "Manual Proxy Configuration"
4) set focus in the textfield
5) crashes

Comment 15

[David Hyatt]

radiogroup...

Comment 16

[R.K.Aa.]

*** Bug 38267 has been marked as a duplicate of this bug. ***

Comment 17

[R.K.Aa.]

*** Bug 38478 has been marked as a duplicate of this bug. ***

Comment 18

[R.K.Aa.]

*** Bug 38458 has been marked as a duplicate of this bug. ***

Comment 19

[R.K.Aa.]

*** Bug 38514 has been marked as a duplicate of this bug. ***

Comment 20

[lchiang]

I'm concerned about the M17 milestone.  This bug needs to be fixed for beta2 (I 
don't know if M17 is post-beta2 or not).  This bug causes a crash and is common 
(as factored by the many dup reports).

Comment 21

[Andreas Franke (gone)]

*** Bug 38683 has been marked as a duplicate of this bug. ***

Comment 22

[Shiva Thirumazhusai]

Updating with topcrash keyword

Comment 23

[leger]

Putting on [nsbeta2+] radar for beta2 fix.

Comment 24

[sairuh (rarely reading bugmail)]

*** Bug 39001 has been marked as a duplicate of this bug. ***

Comment 25

[sairuh (rarely reading bugmail)]

*** Bug 39088 has been marked as a duplicate of this bug. ***

Comment 26

[sairuh (rarely reading bugmail)]

*** Bug 39131 has been marked as a duplicate of this bug. ***

Comment 27

[sairuh (rarely reading bugmail)]

adding mail and proxies to summary, as this is a very popular bug. hopefully
users will be able to find this more easily...

Comment 28

[R.K.Aa.]

*** Bug 39145 has been marked as a duplicate of this bug. ***

Comment 29

[R.K.Aa.]

*** Bug 39177 has been marked as a duplicate of this bug. ***

Comment 30

[Blake Ross]

*** Bug 39190 has been marked as a duplicate of this bug. ***

Comment 31

[Chris McAfee]

*** Bug 26794 has been marked as a duplicate of this bug. ***

Comment 32

[(not reading, please use [e-mail] instead)]

adding dogfood.  this is killing me.

hyatt / waterson, is this really ben's bug?

Comment 33

[(not reading, please use [e-mail] instead)]

*** Bug 38010 has been marked as a duplicate of this bug. ***

Comment 34

[Chris Waterson]

No, it isn't ben's bug.

Comment 35

[sairuh (rarely reading bugmail)]

*** Bug 39279 has been marked as a duplicate of this bug. ***

Comment 36

[Paul Newman]

I get this too on win32.

Using nightly build from 05/15 on Win32.
Noticed this on other nightly builds after M15

Problem is crash when inputting IP address of HTTP proxy server when user 
chooses to manually input the http proxy server settings

Here's a core dump:
MOZILLA caused an invalid page fault in
module <unknown> at 0000:00000013.
Registers:
EAX=035fff18 CS=014f EIP=00000013 EFLGS=00010207
EBX=00000000 SS=0157 ESP=0068d924 EBP=0068d9d8
ECX=0068d930 DS=0157 ESI=80000000 FS=0fd7
EDX=00000004 ES=0157 EDI=0068db40 GS=0000
Bytes at CS:EIP:
00 54 ff 00 f0 40 e1 00 f0 6f ef 00 f0 00 00 00 
Stack dump:
00680157 606fa214 020f83f8 0068db40 0217f28c 01571438 0214a250 60ce1ee0 
0000000f 0000003f 00000001 00000000 00000000 00550058 0052004c 00640061 

Comment 37

[John Morrison]

<radio> and <radiogroup> were re-implemented by ben in XBL. With the new 
code, for mac/win32/linux 20000517 builds, I do not get this crash (which
was impossible to miss previously). Marking FIXED.

Comment 38

[(not reading, please use [e-mail] instead)]

the crasher in the download headers dialog is fixed.

thanks!

Comment 39

[Paul Newman]

On Win32, 05/17 nightly latest build
I can now enter the proxy settings but these are not remembered after I press 
the okay button. Re-opening preferences or closing and re-starting Mozilla 
yeilds the same result.
If I do go back into preferences and click in the textfield to re-input the 
proxy server address, the previously-input data re-appears in the textfield the 
moment that the textfield is clicked (note: this does not happen in the case of 
the textfield for the port of the proxy server, only for the textfield for the 
IP address of the proxy server.
Is this a new bug or does this leave this bug partly resolved? Should I report 
a new bug?

Comment 40

[Peter Trudelle]

Yes, please don't reopen this one unless the original problem recurs, we don't
want to morph bugs. thanks.

Comment 41

[Joseph Elwell]

marking verified. tested http proxy field in prefs on winNT build 2000051808.

Comment 42

[Blake Ross]

*** Bug 37606 has been marked as a duplicate of this bug. ***