56952 - crash after sending a mail [@js_AllocGCThing]

Status: VERIFIED DUPLICATE of bug 54792

(SeaMonkey :: MailNews: Message Display, defect, P3)

Description

[Bernd Mielke]

I just crashed after sending a mail via smtp. 

CVS 2000-10-16 Win98
stack trace:

KERNEL32! bff768a0()
js_AllocGCThing(JSContext * 0x03be4ba0, unsigned int 0) line 420 + 41 bytes
js_NewObject(JSContext * 0x03be4ba0, JSClass * 0x01c497f8 struct JSClass  
KeyEventClass, JSObject * 0x031c0e50, JSObject * 0x00000000) line 1439 + 11 
bytes
JS_NewObject(JSContext * 0x03be4ba0, JSClass * 0x01c497f8 struct JSClass  
KeyEventClass, JSObject * 0x031c0e50, JSObject * 0x00000000) line 1892 + 21 
bytes
NS_NewScriptKeyEvent(nsIScriptContext * 0x03be4d50, nsISupports * 0x04b210c4, 
nsISupports * 0x00000000, void * * 0x007aca5c) line 1014 + 23 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x04b210c4) line 141 + 25 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0409eb20, 
nsIDOMEvent * 0x04b210c4, nsIDOMEventTarget * 0x03d53e08, unsigned int 2, 
unsigned int 7) line 788 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x03c0eef0, nsEvent * 
0x007ad46c, nsIDOMEvent * * 0x007ad1bc, nsIDOMEventTarget * 0x03d53e08, unsigned 
int 7, nsEventStatus * 0x007ad490) line 1207 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x03d53e00, nsIPresContext * 
0x03c0eef0, nsEvent * 0x007ad46c, nsIDOMEvent * * 0x007ad1bc, unsigned int 1, 
nsEventStatus * 0x007ad490) line 3301
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x03fbc6a8, 
nsIPresContext * 0x03c0eef0, nsEvent * 0x007ad7b4, nsIFrame * 0x031c3048, 
nsEventStatus * 0x007ad71c, nsIView * 0x03c0e800) line 561
PresShell::HandleEventInternal(nsEvent * 0x007ad7b4, nsIView * 0x03c0e800, 
unsigned int 1, nsEventStatus * 0x007ad71c) line 4882 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x03c0e174, nsIView * 0x03c0e800, 
nsGUIEvent * 0x007ad7b4, nsEventStatus * 0x007ad71c, int 1, int & 1) line 4823 + 
25 bytes
nsView::HandleEvent(nsView * const 0x03c0e800, nsGUIEvent * 0x007ad7b4, unsigned 
int 28, nsEventStatus * 0x007ad71c, int 1, int & 1) line 379
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x03c0ea40, nsGUIEvent * 
0x007ad7b4, nsEventStatus * 0x007ad71c) line 1439
HandleEvent(nsGUIEvent * 0x007ad7b4) line 68
nsWindow::DispatchEvent(nsWindow * const 0x03c0e6c4, nsGUIEvent * 0x007ad7b4, 
nsEventStatus & nsEventStatus_eIgnore) line 682 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x007ad7b4) line 703
nsWindow::DispatchFocus(unsigned int 108) line 4044 + 15 bytes
nsWindow::ProcessMessage(unsigned int 8, unsigned int 2244, long 0, long * 
0x007adaf8) line 3104 + 19 bytes
nsWindow::WindowProc(HWND__ * 0x000007a8, unsigned int 8, unsigned int 2244, 
long 0) line 951 + 27 bytes
KERNEL32! bff7363b()
KERNEL32! bff94407()

Comment 1

[Bernd Mielke]

while it was difficult to reproduce, I have now a method to do this:
1. Go to n.p.m.seamonkey
2. find phils posting from 20.10.
3. Reply all
4. Save as draft
5. Click the x to close the composing window.

this from the debug log before mozilla dies:

ComposeLoad from XUL
Compose: ComposeStartup
[originalMsg=news_message://[e-mail]/netscape.public.mozilla.seamonkey#4274]
[preselectid=id2]
[format=0]
[type=2]
[nsIMsgIdentity: id1],[nsIMsgIdentity: id2],[nsIMsgIdentity: id4]
Created editorShell
editor initialized in PLAIN TEXT mode
WARNING: Replacing existing command -- cmd_printSetup, file
C:\MOZ_SOUR\MOZILLA\mozilla\rdf\content\src\nsControllerCommandManager.cpp, line 60
failed to get command manager number 3
failed to get command manager number 2
Registering commands
Have Find = true
Have SpellChecker = false
args newshost = undefined
PrefStyleSheet removed
Setting Preference Style Rules:
CreatePrefStyleSheet completed: error=0
 - Creating rules for link and visited colors
 - Creating rules for enabling link underlines
Preference Style Rules set: error=0
Enabling Quirk StyleSheet
PrefStyleSheet DISABLED (state toggled)
PrefStyleSheet removed
PrepareDocumentForEditing: Editor is editing about:blank
WARNING: not calling OnDataAvailable, file
C:\MOZ_SOUR\MOZILLA\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 403
WARNING: not calling OnDataAvailable, file
C:\MOZ_SOUR\MOZILLA\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 403
WARNING: not calling OnDataAvailable, file
C:\MOZ_SOUR\MOZILLA\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 403
WARNING: not calling OnDataAvailable, file
C:\MOZ_SOUR\MOZILLA\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 403
RECEIVE CALLBACK: OnHeadersReady
replacing child in comp fields 2 recips
Warning prev sibling is not in our list!!!set focus on the body
************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "Component returned failure code: 0x80004001
(NS_ERROR_NOT_IMPLEMENTED) [nsIEditorShell.GetSelectedElement]"  nsresult:
"0x80004001 (NS_ERROR_NOT_IMPLEMENTED)"  location: "JS frame ::
chrome://editor/content/editor.js :: GetObjectForProperties :: line 945"  data: no]
************************************************************
An error occurred updating the cmd_objectProperties command
SaveAsDraft from XUL
GenericSendMessage from XUL
Identity = [nsIMsgIdentity: id2]
attachments =
SUCCESS:  netscape.public.mozilla.seamonkey -> netscape.public.mozilla.seamonkey
CopyListener::OnStartCopy()
nsMsgComposeSendListener::OnStartCopy()
CopyListener: SUCCESSFUL ON THE COPY OPERATION!
nsMsgComposeSendListener: Success on the message copy operation!

 RECEIVE SaveAndSendProcessDone

WARNING: not calling OnDataAvailable, file
C:\MOZ_SOUR\MOZILLA\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 403
WARNING: not calling OnDataAvailable, file
C:\MOZ_SOUR\MOZILLA\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 403
WARNING: not calling OnDataAvailable, file
C:\MOZ_SOUR\MOZILLA\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 403

ComposeUnload from XUL
###!!! ASSERTION: ~nsTextEditor: 'Not Reached', file
C:\MOZ_SOUR\MOZILLA\mozilla\editor\base\nsHTMLEditor.cpp, line 349

Comment 2

[Phil Peterson]

cc brendan since he was looking at some of these JS GC bugs.

Comment 3

[Daniel Bratell]

Is this a Javascript-bug? Can something else than Javascript cause a crash in 
js_AllocGCThing?

Comment 4

[Brendan Eich [:brendan]]

Daniel: there is at least one way to make a DEBUG build "crash" in the JS GC 
without there being a bug in the JS GC.  Possibly this is a dup of bug 54792, I 
can't tell from the stack (which does not appear to be a complete backtrace; 
cc'ing jband for help analyzing that).

Phil: all the known-and-fixed-"JS GC bugs" involved crashes in gc_find_flags, 
js_MarkGCThing, or js_GC itself, either due to two small-scale bugs in the big 
fix landed for bug 49816, or due to API abusage in code that calls OpenDialog 
(53123-reopen and dups).

If anyone can reproduce under a debugger, please show the line in 
js_AllocGCThing and any relevant variables (rt, *rt, a, *a, cx, *cx, etc.).  
Thanks,

/be

Comment 5

[Brendan Eich [:brendan]]

Forgot to cc: jband.

Obviously, there are other ways to crash the GC (dangling roots being the most 
common, see bug 54121 and other bugs that crash with gc_root_marker near the top 
of stack).  I should have written 'there is at least one way to make a DEBUG 
build "crash" in js_AllocGCThing' [not "in the JS GC"].  And we've had bad JS 
context management bugs and other outright impurities that crash the GC in many 
of its functions.

If anyone reproduces this, a full stack or convincing data that the debugger is 
giving a full stack would be welcome too.

/be

Comment 6

[Bernd Mielke]

Attachment: all the crash information I have

Comment 7

[John Bandhauer]

This is a dup of bug 54792. This happens on Win32 debug builds only (when not 
running under the debugger) and is caused by the debug dialog leaking windows 
messages - even before it is visible.

The notreached assert is bug 51825.

*** This bug has been marked as a duplicate of 54792 ***

Comment 8

[Azrael AOD]

verifying as a duplicate of bug 54792 
'nsDebug::Assertion does not prevent re-entry into the main window'