64124 - Crash when cancelling New Account Wizard after a news://foo/bar URL

Status: VERIFIED WORKSFORME

(MailNews Core :: Networking: NNTP, defect, P1)

Description

[[e-mail] (gone - use [e-mail] instead)]

Windows 2000 2001010204 and Mac 2001010209.

Summary:

We crash when cancelling out of the Account Wizard after hitting a
news://foo/bar URL (following a link or entering into the URL bar).

Steps to Reproduce:

1.  Type news://foo/bar into the URL bar or click on a news:// link on any
page/message.
2.  Click Cancel on the Account Wizard that comes up

Desired Results:

Wizard should cancel, no crash

Actual Results:

We crash.

I'll attach a track and CVS blame and CC: who over touched the code.

Comment 1

[[e-mail] (gone - use [e-mail] instead)]

Call Stack:    (Signature = nsXPCWrappedNative::~nsXPCWrappedNative 5fce96f2)  
     nsXPCWrappedNative::~nsXPCWrappedNative  
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
399] 
     nsXPCWrappedNative::`scalar deleting destructor'    
     nsXPCWrappedNative::Release  
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
72] 
     nsXPCWrappedNative::JSObjectFinalized  
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
96] 
     WrappedNative_Finalize  
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 783] 
     js_FinalizeObject  [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 1630] 
     js_GC  [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 1200] 
     js_ForceGC  [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 932] 
     js_DestroyContext  [d:\builds\seamonkey\mozilla\js\src\jscntxt.c, line 
225] 
     JS_DestroyContext  [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 886] 
     nsJSContext::~nsJSContext  
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 389] 
     nsJSContext::`scalar deleting destructor'    
     nsJSContext::Release  
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 394] 
     nsCOMPtr_base::assign_with_AddRef  
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 59] 
     nsWebShell::Destroy  
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 1446] 
     nsDocShell::DestroyChildren  
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 156] 
     nsWebShell::Destroy  
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 1446] 
     nsDocShell::DestroyChildren  
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 156] 
     nsDocShell::Destroy  
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 1698] 
     nsWebShell::Destroy  
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 1446] 
     nsXULWindow::Destroy  
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 330] 
     nsWebShellWindow::Destroy  
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp, line 1783] 
     nsChromeTreeOwner::Destroy  
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsChromeTreeOwner.cpp, line 223] 
     GlobalWindowImpl::Close  
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 2090] 
     GlobalWindowImpl::CloseWindow  
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3582] 
     nsJSContext::ScriptEvaluated  
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1317] 
     nsJSContext::CallEventHandler  
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 936] 
     nsJSEventListener::HandleEvent  
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
     nsEventListenerManager::HandleEventSubType  
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
844] 
     nsEventListenerManager::HandleEvent  
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
1732] 
     nsXULElement::HandleDOMEvent  
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3455] 
     PresShell::HandleDOMEventWithTarget  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4926] 
     nsButtonBoxFrame::MouseClicked  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 
138] 
     nsButtonBoxFrame::HandleEvent  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 99] 
     PresShell::HandleEventInternal  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4895] 
     PresShell::HandleEventWithTarget  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4858] 
     nsEventStateManager::CheckForAndDispatchClick  
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
1942] 
     nsEventStateManager::PostHandleEvent  
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
1077] 
     PresShell::HandleEventInternal  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4899] 
     PresShell::HandleEvent  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4813] 
     nsView::HandleEvent  [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, 
line 379] 
     nsViewManager2::DispatchEvent  
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1439] 
     HandleEvent  [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68] 
     nsWindow::DispatchEvent  
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 691] 
     nsWindow::DispatchWindowEvent  
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 708] 
     nsWindow::DispatchMouseEvent  
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4008] 
     ChildWindow::DispatchMouseEvent  
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4216] 
     nsWindow::ProcessMessage  
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3048] 
     nsWindow::WindowProc  
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 944] 
     USER32.DLL + 0x48dc (0x77e148dc)    
     USER32.DLL + 0x4aa7 (0x77e14aa7)    
     USER32.DLL + 0x4bf7 (0x77e14bf7)    
     nsWebShellWindow::ShowModal  
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp, line 1118] 
     nsChromeTreeOwner::ShowModal  
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsChromeTreeOwner.cpp, line 182] 
     GlobalWindowImpl::OpenInternal  
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3143] 
     GlobalWindowImpl::OpenDialog  
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 2076] 
     WindowInternalOpenDialog  
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSWindow.cpp, line 4425] 
     js_Invoke  [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 786] 
     js_Interpret  [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2608] 
     js_Execute  [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 958] 
     JS_EvaluateUCScriptForPrincipals  
[d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3219] 
     nsJSContext::EvaluateString  
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 604] 
     GlobalWindowImpl::RunTimeout  
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3827] 
     nsGlobalWindow_RunTimeout  
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 4107] 
 
 

Comment 2

[John Bandhauer]

Looks to me like a refcount error elsewhere. (If I'm reight) someone else
already released the reference to the native object that is really owned by
xpconnect. Releasing someone else's reference is a no-no. If this can be
reproduced in a debugger then you can stop at the crash point and inspect
nsXPCWrappedNative::mClass. Digging into it will tell you the name of the
interface being wrapped and may help establish what sort of object has been
mis-refcounted.

Comment 3

[scottputterman]

moving to mozilla0.8 and marking nsbeta1+

Comment 4

[scottputterman]

reassigning to naving

Comment 5

[Navin Gupta]

I don't see any crash on Win NT. This is mozilla debug build.

Comment 6

[[e-mail] (gone - use [e-mail] instead)]

I tried to reproduce this, and couldn't (it used to crash 100%).  Builds
2001012708 (windows 2000) and builds 2001012608 Mac.  Resolving as WFM.

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

VERIFIED>