Closed Bug 42109 Opened 24 years ago Closed 24 years ago

crash at shift-clicking a title in the messages list

Categories

(Core :: XUL, defect, P1)

Product:
Core
Component:
XUL
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: tarahim, Assigned: bryner)

References

Details

(Keywords: crash, Whiteboard: [nsbeta3+][PDTP1])

Attachments

(1 file)

talkback report
5.00 KB, text/plain
Details
Currently, there are 7 messages in the trash folder of an mail account. When I select Trash, and the list of messages title are displayed but none of them are selected for displaying the message body. Then, at the instant I shift-click a title in the message list, Mozilla crashes with type 11 error.
Severity: blocker → critical
Is this for any message you have? Is this particular to just those messages?
Status: UNCONFIRMED → NEW
Ever confirmed: true
OK, I nailed it down. The crash occurs only when the last in the list is shift- clicked. It does not crash when there is only one message in the list. May be related to the shift-click bug No.30377. Shift-clicking others in the list before any selection shows some weird behavior, too.
similar type 11 crash after shift-click occured in Manage Bookmark window, too(2000060908-M17). Even more likely a duplicate of No.30377 with worse outcome in MacOS? If this is 30377, the priority for fix is disppointingly low for Mac version.
I'm not clear on what the steps to reproduce this crash are. Can you try to explain this again? I cannot get a crash for Mac with the build you mentioned, by shift-clicking on the last message in the mail thread pane, or in the bookmarks window. I doubt this is causally related to bug 30377. That's just some selection logic that is wrong in the UI sense, but not likely to cause a crash.
1)Start Mozilla (with Browser window in my case, I doubt it matters). 2)Open Mail window (at this point, Mozilla Mail Start message is displayed), select whatever box you have a message in, and display a message content by clicking one of the title. 3)Change the box to another where there are more than two messages by cliking in Mail Folders pane. 4)At this point no message content is displayed. This is the requirement for the crash to occur. 5)Shift-click the last title in the message list and you get a crash. Now I am getting type 2 crash instead of type 11 in build 2000060908M17. This is still very reproducible. I am not sure about the exact conditon for Bookmarks, yet. But the mechanism seems similar.
I believe this is related to selection logic. For Bookmarks, you select one and delete it. Then, you shift click the one at the bottom of the list, and you get type 11. The crash with Mail seems that since you have selected one message before moving to another box, the effect is like deleting the previously selected message in Bookmarks. No wonder they behave similarly.
FYI I remeber a similar "shift-clicking selection of deleted bookmark" crash bug was present in NScommunicator PRs.
Thank you. Most excellent descriptions. Certainly a selection bug in tree code. This code is all going under the knife as we 'speak', but I'll move this over to hyatt and I'll see if this is still a problem with the tree-is-a-grid-not-an-HTMLTable code. Thanks again. cc: claudius for the bookmark's test.
Assignee: putterman → hyatt
Component: Mail Window Front End → XP Toolkit/Widgets: Trees
Keywords: crash
OS: Mac System 8.6 → All
Product: MailNews → Browser
QA Contact: lchiang → jrgm
Hardware: Macintosh → All
This is the stack from the mail thread crash: Calling chain using A6/R1 links Back chain ISA Caller 00000000 PPC 1F504B04 0E710AC0 PPC 1F4EF718 main+00130 0E710A60 PPC 1F4EEC14 main1(int, char**, nsISupports*)+00944 0E7107A0 PPC 1F0EED34 nsAppShellService::Run()+00018 0E710760 PPC 1EC39D44 nsAppShell::Run()+00038 0E710710 PPC 1EC3A440 nsMacMessagePump::DoMessagePump()+0003C 0E7106C0 PPC 1EC3A944 nsMacMessagePump::DispatchEvent(int, EventRecord*)+00070 0E710670 PPC 1EC3B2AC nsMacMessagePump::DoMouseUp(EventRecord&)+0004C 0E710620 PPC 1EC3B840 nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort*)+00044 0E7105D0 PPC 1EC371E4 nsMacMessageSink::DispatchOSEvent(EventRecord&, GrafPort*)+00038 0E710590 PPC 1EC32488 nsMacWindow::HandleOSEvent(EventRecord&)+00020 0E710550 PPC 1EC331D4 nsMacEventHandler::HandleOSEvent(EventRecord&)+000D0 0E710500 PPC 1EC34990 nsMacEventHandler::HandleMouseUpEvent(EventRecord&)+00048 0E710470 PPC 1EC18368 nsWindow::DispatchMouseEvent(nsMouseEvent&)+00054 0E710410 PPC 1EC18224 nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018 0E7103D0 PPC 1EC18150 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&)+00094 0E710380 PPC 1CD2A4DC HandleEvent(nsGUIEvent*)+00058 0E710330 PPC 1CD33834 nsViewManager2::DispatchEvent(nsGUIEvent*, nsEventStatus*)+005EC 0E710200 PPC 1CD2BE8C nsView::HandleEvent(nsGUIEvent*, unsigned int, nsEventStatus*, int&)+0015C 0E710180 PPC 1CD2BF18 nsView::HandleEvent(nsGUIEvent*, unsigned int, nsEventStatus*, int&)+001E8 0E710100 PPC 1DFF52B8 PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*, int&)+002E4 0E710090 PPC 1DFF55F4 PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*)+001C8 0E710030 PPC 1E0AD294 nsEventStateManager::PostHandleEvent(nsIPresContext*, nsEvent*, nsIFrame*, nsEventStatus*, nsIView*)+00398 0E70FEC0 PPC 1E0AF18C nsEventStateManager::CheckForAndDispatchClick(nsIPresContext*, nsMouseEvent*, nsEventStatus*)+00158 0E70FDE0 PPC 1DFF539C PresShell::HandleEventWithTarget(nsEvent*, nsIFrame*, nsIContent*, nsEventStatus*)+00038 0E70FD90 PPC 1DFF54E8 PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*)+000BC 0E70FD30 PPC 1F054E50 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4 0E70FAE0 PPC 1F054E50 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4 0E70F890 PPC 1F054E50 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4 0E70F640 PPC 1F054D74 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+004C8 0E70F3F0 PPC 1E0A7968 nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*)+002C8 0E70F210 PPC 1E35BA04 nsXBLEventHandler::MouseClick(nsIDOMEvent*)+000BC 0E70F110 PPC 1E35D944 nsXBLEventHandler::ExecuteHandler(const nsString&, nsIDOMEvent*)+003C8 0E70EDD0 PPC 1F1BC9A0 nsJSEventListener::HandleEvent(nsIDOMEvent*)+00268 0E70ECB0 PPC 1F15FB9C nsJSContext::CallEventHandler(void*, void*, unsigned int, void*, int*, int)+001E0 0E70EBF0 PPC 1EE2C520 JS_CallFunctionValue+00028 0E70EBB0 PPC 1EE4578C js_InternalInvoke+000C0 0E70EAF0 PPC 1EE45558 js_Invoke+004C4 0E70EA10 PPC 1EE4C58C js_Interpret+06528 0E70E7D0 PPC 1EE45500 js_Invoke+0046C 0E70E6F0 PPC 1F039AE8 XULTreeElementSelectItemRange(JSContext*, JSObject*, unsigned int, long*, long*)+002D8 0E70E510 PPC 1F03B92C nsXULTreeElement::SelectItemRange(nsIDOMXULElement*, nsIDOMXULElement*)+00228 0E70E170 PPC 1EC7CE24 nsCOMPtr_base::assign_from_helper(const nsCOMPtr_helper&, const nsID&)+00028 0E70E120 PPC 1EC7CC50 nsQueryInterface::operator()(const nsID&, void**) const+00028 This is the code from the bookmark crash: Calling chain using A6/R1 links Back chain ISA Caller 00000000 PPC 1F504B04 0E710AC0 PPC 1F4EF718 main+00130 0E710A60 PPC 1F4EEC14 main1(int, char**, nsISupports*)+00944 0E7107A0 PPC 1F0AED34 nsAppShellService::Run()+00018 0E710760 PPC 1ED8BD44 nsAppShell::Run()+00038 0E710710 PPC 1ED8C440 nsMacMessagePump::DoMessagePump()+0003C 0E7106C0 PPC 1ED8C944 nsMacMessagePump::DispatchEvent(int, EventRecord*)+00070 0E710670 PPC 1ED8D2AC nsMacMessagePump::DoMouseUp(EventRecord&)+0004C 0E710620 PPC 1ED8D840 nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort*)+00044 0E7105D0 PPC 1ED891E4 nsMacMessageSink::DispatchOSEvent(EventRecord&, GrafPort*)+00038 0E710590 PPC 1ED84488 nsMacWindow::HandleOSEvent(EventRecord&)+00020 0E710550 PPC 1ED851D4 nsMacEventHandler::HandleOSEvent(EventRecord&)+000D0 0E710500 PPC 1ED86990 nsMacEventHandler::HandleMouseUpEvent(EventRecord&)+00048 0E710470 PPC 1ED6A368 nsWindow::DispatchMouseEvent(nsMouseEvent&)+00054 0E710410 PPC 1ED6A224 nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018 0E7103D0 PPC 1ED6A150 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&)+00094 0E710380 PPC 1CD2A4DC HandleEvent(nsGUIEvent*)+00058 0E710330 PPC 1CD33834 nsViewManager2::DispatchEvent(nsGUIEvent*, nsEventStatus*)+005EC 0E710200 PPC 1CD2BE8C nsView::HandleEvent(nsGUIEvent*, unsigned int, nsEventStatus*, int&)+0015C 0E710180 PPC 1CD2BF18 nsView::HandleEvent(nsGUIEvent*, unsigned int, nsEventStatus*, int&)+001E8 0E710100 PPC 1DFF52B8 PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*, int&)+002E4 0E710090 PPC 1DFF55F4 PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*)+001C8 0E710030 PPC 1E0AD294 nsEventStateManager::PostHandleEvent(nsIPresContext*, nsEvent*, nsIFrame*, nsEventStatus*, nsIView*)+00398 0E70FEC0 PPC 1E0AF18C nsEventStateManager::CheckForAndDispatchClick(nsIPresContext*, nsMouseEvent*, nsEventStatus*)+00158 0E70FDE0 PPC 1DFF539C PresShell::HandleEventWithTarget(nsEvent*, nsIFrame*, nsIContent*, nsEventStatus*)+00038 0E70FD90 PPC 1DFF54E8 PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*)+000BC 0E70FD30 PPC 1F014E50 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4 0E70FAE0 PPC 1F014E50 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4 0E70F890 PPC 1F014E50 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4 0E70F640 PPC 1F014E50 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4 0E70F3F0 PPC 1F014E50 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+005A4 0E70F1A0 PPC 1F014D74 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned int, nsEventStatus*)+004C8 0E70EF50 PPC 1E0A7968 nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*)+002C8 0E70ED70 PPC 1E35BA04 nsXBLEventHandler::MouseClick(nsIDOMEvent*)+000BC 0E70EC70 PPC 1E35D944 nsXBLEventHandler::ExecuteHandler(const nsString&, nsIDOMEvent*)+003C8 0E70E930 PPC 1F17C9A0 nsJSEventListener::HandleEvent(nsIDOMEvent*)+00268 0E70E810 PPC 1F11FB9C nsJSContext::CallEventHandler(void*, void*, unsigned int, void*, int*, int)+001E0 0E70E750 PPC 1EE2C520 JS_CallFunctionValue+00028 0E70E710 PPC 1EE4578C js_InternalInvoke+000C0 0E70E650 PPC 1EE45558 js_Invoke+004C4 0E70E570 PPC 1EE4C58C js_Interpret+06528 0E70E330 PPC 1EE45500 js_Invoke+0046C 0E70E250 PPC 1EFF9AE8 XULTreeElementSelectItemRange(JSContext*, JSObject*, unsigned int, long*, long*)+002D8
nominate nsbeta3.
Keywords: nsbeta3
Oh yes. Very reproducible in the bookmarks context. Simply delete bookmark and shift+click on the last bookmark and you crash immediately. Reproduced with the 2000061109 Rh 6.1 Linux build
I wonder if I should nominate for nsbeta2 instead. Will your new tree rewrite address this, hyatt?
Summary: type 11 crash at shift-clicking a title in the messages list → crash at shift-clicking a title in the messages list
*** Bug 42807 has been marked as a duplicate of this bug. ***
fixed.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
(grumble, I suck, reopening ...) I can reproduce this crash in 3pane mail, using the steps provided by hirata masakazu on 06/10. (reproduced on mac/linux/win32 20000719nn builds). (Note: I cannot reproduce this using the steps in the dup of this bug (Bug 42807), and bug 42013, which could generate the same stack trace is also no longer crashable. However, this bug can still trigger the required code path).
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
This is a result of not updating the current item when a tree item is deleted. I've been working on this.
Assignee: hyatt → bryner
Status: REOPENED → NEW
Status: NEW → ASSIGNED
Whiteboard: nsbeta3+
Whiteboard: nsbeta3+ → [nsbeta3+]
*** Bug 46426 has been marked as a duplicate of this bug. ***
Target Milestone: --- → M18
Keywords: mailtrack
P1
Priority: P3 → P1
*** Bug 49685 has been marked as a duplicate of this bug. ***
Checked in a fix.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago → 24 years ago
Resolution: --- → FIXED
Reopening. I can crash in mailnews using the steps provided by hirata masakazu 2000-06-10 20:02 -- note: this does not involve deleting any items, just doing a selection. It appears that currentItem is null prior to doing the shift-click (hence deref's a null pointer). Crash on mac/linux/win32 2000090508 builds.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Note: this _is_ fixed for the bookmark case (deleting, then doing shift-click).
I see this all the time. I think I'm doing the steps here. I'll attach the talkback report I have.
Attached file talkback report —
Ok, I must have missed something...
Status: REOPENED → ASSIGNED
PDT agrees P1
Whiteboard: [nsbeta3+] → [nsbeta3+][PDTP1]
Fixed for good, I hope.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago → 24 years ago
Resolution: --- → FIXED
Verified fixed 2000080708 win32/mac/linux builds -- no mo crash on the shift click. bryner is the man ...
Status: RESOLVED → VERIFIED
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: jrgmorrison → xptoolkit.widgets
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: