5844 - Crash when closing preferences window

Status: VERIFIED FIXED

(SeaMonkey :: Preferences, defect, P2)

Description

[Stephen P. Morse]

Go to edit/preferences, then press OK.  Get the following crash.  It sounds
like an M5 showstopper to me.

nsFrame::DeleteFrame(nsFrame * const 0x02733ee0, nsIPresContext & {...}) line
364 + 33 bytes
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x02733ee0,
nsIPresContext & {...}) line 83
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x0272b390) line
158
nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x0271e920, nsIPresContext &
{...}) line 803 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x02722af0) line
158
nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x0271abf0, nsIPresContext &
{...}) line 803 + 16 bytes
nsAreaFrame::DeleteFrame(nsAreaFrame * const 0x0271abf0, nsIPresContext & {...})
line 102
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 29
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x02721be0,
nsIPresContext & {...}) line 82
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 29
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x027211a0,
nsIPresContext & {...}) line 82
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 29
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x02720260,
nsIPresContext & {...}) line 82
ViewportFrame::DeleteFrame(ViewportFrame * const 0x02720260, nsIPresContext &
{...}) line 112
PresShell::~PresShell() line 552
PresShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes
PresShell::Release(PresShell * const 0x0271f3f0) line 488 + 34 bytes
nsView::HandleEvent(nsView * const 0x02722f00, nsGUIEvent * 0x0012e67c, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore) line 827 + 12 bytes
nsView::HandleEvent(nsView * const 0x02721c90, nsGUIEvent * 0x0012e67c, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore) line 810
nsView::HandleEvent(nsView * const 0x02721320, nsGUIEvent * 0x0012e67c, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore) line 810
nsView::HandleEvent(nsView * const 0x02721250, nsGUIEvent * 0x0012e67c, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore) line 810
nsView::HandleEvent(nsView * const 0x0271ece0, nsGUIEvent * 0x0012e67c, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore) line 810
nsViewManager::DispatchEvent(nsViewManager * const 0x0271e9b0, nsGUIEvent *
0x0012e67c, nsEventStatus & nsEventStatus_eIgnore) line 1726
HandleEvent(nsGUIEvent * 0x0012e67c) line 67
nsWindow::DispatchEvent(nsWindow * const 0x0272bcf4, nsGUIEvent * 0x0012e67c,
nsEventStatus & nsEventStatus_eIgnore) line 414 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012e67c) line 435
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 2892 +
15 bytes
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 589830, long *
0x0012e7f8) line 2258 + 24 bytes
nsWindow::WindowProc(void * 0x00040750, unsigned int 514, unsigned int 0, long
589830) line 478 + 27 bytes
US

Comment 1

[chris hofmann]

anyone have any ideas on this one?  putting on the M5 list until we understand
it better.

Comment 2

[chris hofmann]

didn't happen every time for me. I did see one crash when I tried to add
set my mail server and then save.

Comment 3

[chris hofmann]

didn't happen every time for me. I did see one crash when I tried to add
set my mail server and then save.

Comment 4

[Stephen P. Morse]

Happens every time for me.  Simply opening the preference panel and then
pressing OK without even making any changes causes the crash.

Comment 5

[chris hofmann]

The talkback stack might be easier to read.

Troy,kipp, and michealp are last to touch nsView.cpp but it does
appear their changes are related to this crash at first glance.
Do we know when this might have first appeared to be broken?

 Call Stack:    (Signature = nsView::HandleEvent 87c1c40d)
  nsView::HandleEvent
                [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 798]
  nsView::HandleEvent
                [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 810]
  nsView::HandleEvent
                [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 810]
       nsView::HandleEvent
                [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 810]
       nsViewManager::DispatchEvent
             [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1726]
     HandleEvent
             [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 67]
     nsWindow::DispatchEvent
        [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 418]
     nsWindow::DispatchWindowEvent
        [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 435]
     nsWindow::DispatchMouseEvent
        [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2894]
     nsWindow::ProcessMessage
       [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2291]
     nsWindow::WindowProc
       [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 479]
     KERNEL32.DLL + 0x3663(0xbff73663)
     KERNEL32.DLL + 0x22894(0xbff92894)
     0x0077838c

Comment 6

[mcmullen]

cc-ing danm - this appears to be a bug calling window.close(), rather than a bug
that has to do with preferences per se.

Comment 7

[mcmullen]

Changed summary to refer to the closing of the window, rather than the changing
of preferences.

Should be reassigned.

Comment 8

[Dan M]

It's an ownership problem made visible by the recent ownership model spring cleaning.  Joy.

Comment 9

[mcmullen]

BTW, it also crashes if you hit "cancel" without changing any of the controls.

Furthermore, the profile wizard window is crashing in the same way.

Comment 10

[Dan M]

Toyed with owning pointers and refcounts in layout, to delay things' deletion as the window is closed.
Seems all better now.  Note I haven't had a chance to test it with the profile wizard; that comes after
the tree goes green for ten minutes straight and I sneak in a source pull.

Comment 11

[racham]

Will there be updates on the toolkitCore.CloseWindow() crash we are
experiencing with createprofile wizard in this bug's comments ? OR
Do I need to open a new bug to track it until we see a fix for it ?

Comment 12

[Dan M]

(responding to racham's comment above): no, oddly, the crash I fixed is actually fixed and remains fixed.
Now it's crashing for a different reason; someone introduced a new way.  There is already at least one
bug filed for that problem, though they're all very limited in scope.  I'll file yet another one once I get
an idea who to blame, and cc racham.

Comment 13

[leger]

Updating QA Contact from paulmac to cpratt

Comment 14

[leger]

Bulk move of all Pref UI component bugs to new Preferences component.  Pref UI 
component will be deleted.