62272 - Crash if I change two "Appearance" properties in prefs

Status: VERIFIED WORKSFORME

(SeaMonkey :: Preferences, defect, P3)

Description

[Michael Mahan]

From Bugzilla Helper:
User-Agent: Mozilla/4.75 [en] (X11; U; SunOS 5.7 sun4u)
BuildID:    

Every time I change two properties in the Appearance category, mozilla crashes
with a Segmentation Fault,Bus Error or a Bad Instruction.  

For example these steps will crash

start mozilla
open preferences
change Default Type from Sans Serif to Serif
unselect Underline links
press "OK"
result: Bus Error - core dumped

or this:
start mozilla
open preferences
deselect Always use my font settings, ...
change Fixed-width font size from 14 to 12
press "OK"
result: Illegal Instruction - core dumped

The preference changes are commited, and are there when I restart mozilla.

Reproducible: Always
Steps to Reproduce:
1. Start Mozilla
2. Open preferences dialog
3. change two preferences in the Appearence catagory
4. press OK.

Actual Results:  preferences are changed;mozilla crashes

Expected Results:  mozilla shouldn't have crashed.

stack trace looks like this:
#0  0xbb0524 in ?? ()
#1  0xff21ef28 in nsCOMPtr_base::assign_from_helper ()
#2  0xfcc981a8 in nsXBLBinding::ExecuteAttachedHandler ()
#3  0xfccaf894 in nsBindingManager::ProcessAttachedQueue ()
#4  0xfcbe46d8 in nsCSSFrameConstructor::CreateTreeWidgetContent ()
#5  0xfcc5e084 in nsXULTreeGroupFrame::GetFirstTreeBox ()
#6  0xfcc5bcd4 in nsTreeLayout::LazyRowCreator ()
#7  0xfcc63418 in nsXULTreeOuterGroupFrame::ReflowFinished ()
#8  0xfcacf484 in PresShell::HandlePostedReflowCallbacks ()
#9  0xfcad0d68 in PresShell::ProcessReflowCommands ()
#10 0xfcad0904 in PresShell::ResizeReflow ()
#11 0xff215d28 in PL_HandleEvent ()
#12 0xff215c5c in PL_ProcessPendingEvents ()
#13 0xff216a94 in nsEventQueueImpl::ProcessPendingEvents ()
#14 0xfdfa6484 in nsAppShell::SetDispatchListener ()
#15 0xfdfa6194 in keysym2ucs ()
#16 0xfdce5ea0 in g_io_unix_dispatch (source_data=0x19c578,
current_time=0xffbee3a0, user_data=0x12fa90) at giounix.c:135
#17 0xfdce7ca0 in g_main_dispatch (dispatch_time=0xffbee3a0) at gmain.c:656
#18 0xfdce853c in g_main_iterate (block=0, dispatch=1) at gmain.c:877
#19 0xfdce8770 in g_main_run (loop=0x12fab0) at gmain.c:935
#20 0xfde4da08 in gtk_main () at gtkmain.c:476
#21 0xfdfa6a6c in nsAppShell::Run ()
#22 0xfec3e120 in nsAppShellService::Run ()
#23 0x16f50 in NS_CreateNativeAppSupport ()
#24 0x17670 in main ()

Comment 1

[sairuh (rarely reading bugmail)]

what version of the browser are you using? communicator/4.x or mozilla/netscape
6.0? unless the user-agent is incorrect, bugzilla is for reporting mozilla
issues. you should go to http://help.netscape.com or
http://developer.netscape.com for any communicator/4.x issues. thx!

fwiw, i cannot repro using 2000.12.08.08 comm bits on linux.

Comment 2

[Michael Mahan]

I filed the bug from 4.75 so I could crash the mozilla build while I was filing
the bug.  It wouldn't do to crash the browser I was filling the bug with. 
Anyway here is the version I was using based  based on help->about mozilla:
Mozilla/5.0 (X11; U; SunOS 5.7 sun4u; en-US; m18) Gecko/20001206

I will try using 2000.12.08.08 on sun and see if I can still reproduce the
problem.

Comment 3

[Michael Mahan]

So the latest build I could find was Mozilla/5.0 (X11; U; SunOS 5.7 sun4u;
en-US; m18) Gecko/2000120721

I started it up tried to reproduce the problem and it crashed on my first try. 
So this isn't limited to just the 12/6 build.

Comment 4

[sairuh (rarely reading bugmail)]

thx for the info michael --yeah, what you did for filing this makes sense
[doh!].

Comment 5

[Keyser Sose]

Marking NEW as per reporters comments.

Comment 6

[Chris McAfee]

stealing from matt.
This works for me, on a build from 1/5/01.  Where are you getting
the Solaris build from?  There's a lot of different ways to build
on Solaris, maybe the build you have is not being built right.
Try again?  Sorry I can't be more help.

Comment 7

[Blake Ross]

*** Bug 65376 has been marked as a duplicate of this bug. ***

Comment 8

[Blake Ross]

See steps in 65376 also.  Isn't this hyatt's?

Comment 9

[Michael Mahan]

This bug went away for me.  Even if I went back to the old 2000.12.08.08 build. 
I could not reproduce the bug.  

Then today when I wiped away my ~/.mozilla directory and started from scratch
with the 0.7 build (Mozilla/5.0 (X11; U; SunOS 5.7 sun4u; en-US; 0.7)
Gecko/20010110) and the problem reappeared.

Comment 10

[sairuh (rarely reading bugmail)]

[still] cannot repro this [2001.01.16.08 linux, winnt, mac]. dan tilkin [or
anyone else], is this still a problem for you using the latest build? if not, we
should prolly mark this wfm...

Comment 11

[Michael Mahan]

I am able to narrow this down a little more.  First I remove the .mozilla and
.netscape directories in my home directory.  Next I start mozilla most current
build 2001011609. If I try to change two properties like 'san sarif' and 'always
use my font...' It doesn't crash.  However if mozilla's theme is modern it will
crash.  I'm not sure what I did in december to get it to work in the modern
theme, but this bug reappears with a fresh .mozilla user directory.  I hope this
helps.  Oh, I also noticed the stack trace is alittle different this time, so
I'll include it:

#0  0xfda66120 in nsXULElement::nsIDOMXULElement virtual table ()
#1  0xff222634 in nsQueryInterface::operator() ()
#2  0xff222710 in nsCOMPtr_base::assign_from_helper ()
#3  0xfd00d078 in nsXBLBinding::ExecuteAttachedHandler ()
#4  0xfd02530c in nsBindingManager::ProcessAttachedQueue ()
#5  0xfcf590f8 in nsCSSFrameConstructor::CreateTreeWidgetContent ()
#6  0xfcfd183c in nsXULTreeGroupFrame::GetFirstTreeBox ()
#7  0xfcfcf338 in nsTreeLayout::LazyRowCreator ()
#8  0xfcfd7018 in nsXULTreeOuterGroupFrame::ReflowFinished ()
#9  0xfce76e24 in PresShell::HandlePostedReflowCallbacks ()
#10 0xfce78708 in PresShell::ProcessReflowCommands ()
#11 0xfce782a4 in PresShell::ResizeReflow ()
#12 0xff219470 in PL_HandleEvent ()
#13 0xff2193a4 in PL_ProcessPendingEvents ()
#14 0xff21a1dc in nsEventQueueImpl::ProcessPendingEvents ()
#15 0xfdca62e4 in nsAppShell::SetDispatchListener ()
#16 0xfdca5ff4 in keysym2ucs ()
#17 0xfe0c5ea0 in g_io_unix_dispatch (source_data=0x195828,
current_time=0xffbee018, user_data=0x191358) at giounix.c:135
#18 0xfe0c7ca0 in g_main_dispatch (dispatch_time=0xffbee018) at gmain.c:656
#19 0xfe0c853c in g_main_iterate (block=0, dispatch=1) at gmain.c:877
#20 0xfe0c8770 in g_main_run (loop=0x191328) at gmain.c:935
#21 0xfdfcda08 in gtk_main () at gtkmain.c:476
#22 0xfdca68cc in nsAppShell::Run ()
#23 0xfe11e150 in nsAppShellService::Run ()
#24 0x17120 in NS_CreateNativeAppSupport ()
#25 0x179c8 in main ()

Comment 12

[Daniel Tilkin]

This comes and goes for me.  When it's happening, it will crash every few times
I do this.  (It happens for any two preferences, not just the two I mentioned in
 Bug 65376).  I'll try the next day, and it doesn't happen at all.  Deleting the
folder for my profile in Mozilla/Users50 doesn't seem to do it.  (That is the
windows equivalent of .mozilla, right?)  I sent a couple of more talkbacks in,
but I forgot to get the ID before I deleted them.  I'll try to narrow this down
some more.

Comment 13

[Paul Chen]

nav triage team:

marking nsbeta1+ for now, though I'm having a hard reproducing this bug

Comment 14

[Paul Chen]

nav triage team:

no, really, marking nsbeta1+

Comment 15

[Paul Chen]

nav triage team:

If we can get a reproducible case, we'll look into it. For now marking W4M,
which might be a little premature. ;-)

Comment 16

[sairuh (rarely reading bugmail)]

mass verification of WorksForMe bugs: to find all bugspam pertaining to this,
set your search string to "IfItWorksForSlappyTheSquirrelThenItWFM".

if you think this particular bug is *still* an open issue, please make sure of
the following before reopening:

a. that it's still a problem with ***recent trunk builds*** on the all
appropriate platform[s]

b. provide clear steps to reproduce (unless a good test case is already in the
bug report), making sure it pertains to the original problem (avoid morphing as
much as possible :)