447630 - crash deleting attachment [@ nsAccessible::GetPreviousSibling]

Status: RESOLVED WORKSFORME

(Thunderbird :: Mail Window Front End, defect)

Description

[Wayne Mery (:wsmwk)]

crash deleting attachment [@ nsAccessible::GetPreviousSibling].
nsAccessible::GetPreviousSibling is not a top crash, <1 per day

from litmus testresult 145159 https://litmus.mozilla.org/single_result.cgi?id=145159

"On Delete, TB crash pop - Talk Back id TB47923128M imap - Talk Back id TB47933624E On restart, - pop, TB immediately crash on selecting respective msg (eventually had to del msg with msg pane collapsed/not accessing msg) Talk Back id TB47923560Y -On gmail imap the msg seamed fine first, but then is there twice and crash (twice cause gmail wants to keep one original..). Detach work as expected, save file and link to it, file ok (tested with jpg att). But it fails to "save all" attach stopping at the detached one and saving a corrupted version. If for single "save as", it works. Tested repeatedly with html/ plain, pop and imap gmails."

all ovidiu's crashes are same stack. 

nsAccessible::GetPreviousSibling  [mozilla/accessible/src/base/nsAccessible.cpp, line 552]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_GetterSetter  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1487]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1384]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1478]
js_InternalGetOrSet  [mozilla/js/src/jsinterp.c, line 1549]
js_NativeGet  [mozilla/js/src/jsobj.c, line 3472]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3722]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1403]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1478]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4363]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]
nsJSEventListener::HandleEvent  [mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsGlobalWindow::HandleDOMEvent  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 1733]
nsXULDocument::HandleDOMEvent  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 1252]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2261]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2257]
HandleImagePLEvent  [mozilla/layout/xul/base/src/nsImageBoxFrame.cpp, line 128]
HandleImageOnerrorPLEvent  [mozilla/layout/xul/base/src/nsImageBoxFrame.cpp, line 148]

Comment 1

[ovidiu]

as much is it is possibly related, it may be solved in trunk 3 on bug 390071. Anyway, tested a bit in 3 and seams to work for now version 3.0a2 (2008072418)

Comment 2

[Wayne Mery (:wsmwk)]

WFM on v3 per reporter