Crash [@ objc_msgSend] removing Junk button from toolbar

VERIFIED FIXED in Thunderbird 3.0b3

Status

P2
critical
VERIFIED FIXED
10 years ago
7 years ago

People

(Reporter: philor, Unassigned)

Tracking

({crash, regression})

Trunk
Thunderbird 3.0b3
x86
Mac OS X
crash, regression
Bug Flags:
blocking-thunderbird3 +
in-testsuite ?
in-litmus +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: will be fixed by unforking in bug 363981, crash signature)

(Reporter)

Description

10 years ago
STR:

1. In a nice fresh disposable Thunderbird profile (this will trash things), right click the main window toolbar, select Customize
2. Drag the Junk button off the toolbar, drop it in the palette.
3. Wait a few seconds, Crash Bang Boom.

Extremely rough regression window is in the neighborhood of 2008-05-14 to 2008-05-22 (in the random assortment of my own builds that I keep around), a rather unlikely time since that's right around Fx3.0rc1, so nothing Core was landing, making it hard to blame Widget:Cocoa the way I want to, and nothing we did seem likely.

I do crash in official builds, but even if we've got symbols now, it times out trying to upload. In a debug build from today, I get

#0	0x96ce36e8 in objc_msgSend
#1	0x90509e75 in -[NSCoreDragManager _dragUntilMouseUp:accepted:]
#2	0x90508c1e in -[NSCoreDragManager dragImage:fromWindow:at:offset:event:pasteboard:source:slideBack:]
#3	0x90508668 in -[NSWindow(NSDrag) dragImage:at:offset:event:pasteboard:source:slideBack:]
#4	0x11fd4be1 in nsDragService::InvokeDragSession at nsDragService.mm:313
#5	0x12029cca in nsBaseDragService::InvokeDragSessionWithImage at nsBaseDragService.cpp:275
#6	0x136291b3 in nsEventStateManager::DoDefaultDragStart at nsEventStateManager.cpp:2284
#7	0x13629943 in nsEventStateManager::GenerateDragGesture at nsEventStateManager.cpp:2052
#8	0x13631183 in nsEventStateManager::PreHandleEvent at nsEventStateManager.cpp:855
#9	0x1330c51f in PresShell::HandleEventInternal at nsPresShell.cpp:5911
#10	0x1330c9e9 in PresShell::HandlePositionedEvent at nsPresShell.cpp:5809
#11	0x1330e9cd in PresShell::HandleEvent at nsPresShell.cpp:5669
#12	0x137e7cf8 in nsViewManager::HandleEvent at nsViewManager.cpp:1387
#13	0x137e8c21 in nsViewManager::DispatchEvent at nsViewManager.cpp:1346
#14	0x137def5d in HandleEvent at nsView.cpp:168
#15	0x11ff58cb in nsChildView::DispatchEvent at nsChildView.mm:1810
#16	0x11fec3be in nsChildView::DispatchWindowEvent at nsChildView.mm:1823
#17	0x11ff6fab in -[ChildView mouseDragged:] at nsChildView.mm:3326
#18	0x903074c5 in -[NSWindow sendEvent:]
#19	0x11fe66e2 in -[NSWindow(MethodSwizzling) nsCocoaWindow_NSWindow_sendEvent:] at nsCocoaWindow.mm:2198
#20	0x11fe169b in -[ToolbarWindow sendEvent:] at nsCocoaWindow.mm:1857
#21	0x902d3431 in -[NSApplication sendEvent:]
#22	0x90230e27 in -[NSApplication run]
#23	0x11fd8490 in nsAppShell::Run at nsAppShell.mm:591
#24	0x12ccd14a in nsAppStartup::Run at nsAppStartup.cpp:182
#25	0x000c2481 in XRE_main at nsAppRunner.cpp:3220
#26	0x00002777 in main at nsMailApp.cpp:103
Flags: blocking-thunderbird3?
need regression date  wonder if anything similar happens in FF?

need better TB litmus tests for customize toolbar - all we've got is 
https://litmus.mozilla.org/show_test.cgi?id=5454  ... might copy FF's which looks pretty good. 

(no crash on XP for 05-13 15, 16, 21)
Flags: in-testsuite?
Flags: in-litmus?
Keywords: regressionwindow-wanted
I don't have a debug build by hand but what I can see in comparing the d&d for the Junk icon to all the other ones are two things:

* The Junk icon is grayed out while all the others aren't
* The d&d hand cursor isn't shown when hovering over or d&d the icon

I cannot reproduce it with all the icon Minefield uses so it's probably Thunderbird only.
The correct regression range for this bug's crash is as follows:

The 2008-04-05-03-trunk Thunderbird nightly doesn't have the problem.

The 2008-04-06-03-trunk Thunderbird nightly does have it.

From the dates, I assume one should look (by date) in Bonsai for
relevant changes.  I did, but can't find any.  (Note that there are no
Cocoa widgets changes in that range.)

As best I can tell, it's not possible to search by date at
hg.mozilla.org.
You can search by date but sadly nothing is shown within this timespan (or I made a mistake):

http://hg.mozilla.org/comm-central/pushloghtml?startdate=2008-04-05+00%3A00%3A00&enddate=2008-04-06+05%3A00%3A00

Checkins (Bonsai):
http://tinyurl.com/6sac6j
Keywords: regressionwindow-wanted
(In reply to comment #4)
> You can search by date but sadly nothing is shown within this timespan (or I
> made a mistake):
> 
> http://hg.mozilla.org/comm-central/pushloghtml?startdate=2008-04-05+00%3A00%3A00&enddate=2008-04-06+05%3A00%3A00
> 

There wouldn't be anything in comm-central for that range because we didn't have comm-central then.

> Checkins (Bonsai):
> http://tinyurl.com/6sac6j

Your link seemed broken, so I did one: http://tinyurl.com/5hmrkm but I also extended the date range so that it started from 2008-04-04. One of the bugs on there is bug 408268 which touches toolkit's customiseToolbar.js. Interestingly there was at least one crash fix in for that bug (and I verified it did get checked in).
(In reply to comment #4)

Thanks, Henrik for your information about
http://hg.mozilla.org/comm-central/pushloghtml and
http://hg.mozilla.org/mozilla-central/pushloghtml!

Are you aware of any other undocumented hg.mozilla.org functionality?
:-)
Sorry, I don't have yet. But testing your given regression range showed me that its wrong. Even version 3.0a1pre (2008040503) crashes for me. I'll try to get the correct one.
> But testing your given regression range showed me that its
> wrong. Even version 3.0a1pre (2008040503) crashes for me.

I just tried that one again ... and this time I crashed.  I swear this
didn't happen yesterday :-(

> I'll try to get the correct one.

Please do.
Regression window is between the following builds: 

version 3.0a1pre (2008031905)
version 3.0a1pre (2008032003)

Checkins: http://tinyurl.com/4x7e4k

There are too much check-ins in this time frame. No idea which one is responsible for this crash.
If I had to bet, I'd bet on the "additional patch" for bug 329385.

Someone else will need to test, though (I don't have time).
(In reply to comment #10)
> If I had to bet, I'd bet on the "additional patch" for bug 329385.

Steven, I don't have access to this bug. Could you attach the assignee to this bug please?
Actually you don't need access to that bug.  You can see the contents of its
patch (in separate pieces) in your list of commits.

I'd try commenting out the following line, added by the patch to
nsDragService::InvokeDragSession() in nsDragService.mm:

  NS_ENSURE_SUCCESS(rv, rv);

No, that isn't a fix :-)  But if it "works" (stops the crash), you'll have
gone a long way toward figuring out this bug.
I should add that I don't have access to bug 329385, either.
Johnny, could this be a regression from the additional patch on bug 329385?
Flags: blocking-thunderbird3? → blocking-thunderbird3+
Priority: -- → P2
Target Milestone: --- → Thunderbird 3.0b1

Updated

10 years ago
Keywords: relnote
Target Milestone: Thunderbird 3.0b1 → Thunderbird 3.0b2

Updated

10 years ago
Duplicate of this bug: 472349
(Reporter)

Comment 16

10 years ago
Taking temporarily to remind me to investigate, though the odds of me actually fixing it are microscopic.
Assignee: nobody → philringnalda
Target Milestone: Thunderbird 3.0b2 → Thunderbird 3.0b3
(Reporter)

Comment 17

10 years ago
Actually, it's (exposed by) something in our fork of customizeToolbar.js, and I don't think it's sufficiently interesting to find out what. Will be fixed by bug 363981.
Assignee: philringnalda → nobody
Depends on: 363981
Whiteboard: will be fixed by unforking in bug 363981
(Reporter)

Comment 18

10 years ago
"Fixed" by bug 363981 (if I had to bet, I'd bet on the way our wrapping was trying to remove and store and restore observes attributes, of which the Junk and Delete decks have more than their share).
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Looks good. No crash anymore with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090127 Shredder/3.0b2pre ID:20090127025553
Status: RESOLVED → VERIFIED
Added https://litmus.mozilla.org/show_test.cgi?id=9512 to BFT, FFT, Smoketests
Flags: in-litmus? → in-litmus+
Crash Signature: [@ objc_msgSend]
Keywords: relnote
You need to log in before you can comment on or make changes to this bug.