68031 - Mozilla crashes when selecting all messages in a mailbox with no messages.

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Jonathon M. Merz]

The Mozilla MailNews reader can be caused to crash by using the select all
function (either CTRL-A or Edit->Select All) in the news reader if you have
selected a window with now messages.

How to Reproduce:

1.  Start the Mozilla Mail reader
2.  In the left frame, select a mailbox or folder that does not contain any
messages.
3.  Put the focus on the message window.  (Either click on the window where the
messages would appear, or keep the folder name highlighted in the left-hand
frame and hit TAB)
4.  Select all the messages (Either hit CTRL-A or choose Edit->Select All from
the Edit menu)
5.  Mozilla crashes.

Comment 1

[(not reading, please use [e-mail] instead)]

accepting, I am able to reproduce this.  working on getting a stack trace...

Comment 2

[(not reading, please use [e-mail] instead)]

it is going to end up being a bug for hyatt, the crash is in
nsXULTreeElement::SelectItemRange(), due to a null nsCOMPtr.

I'll see if I can code up a fix for hyatt to review.

I'll attach a stack trace.

Comment 3

[(not reading, please use [e-mail] instead)]

here's the stack trace



  10955840    PPC  0F5100EC  main+001AC

  109557E0    PPC  0F50D454  main1(int, char**, nsISupports*)+00830

  10955580    PPC  0F0B3604  nsAppShellService::Run()+00054

  10955530    PPC  0F029288  nsAppShell::Run()+0004C

  109554F0    PPC  0F029B7C  nsMacMessagePump::DoMessagePump()+00044

  109554A0    PPC  0F02A298  nsMacMessagePump::DispatchEvent(int, EventRecord*)+

00090

  10955450    PPC  0F02A62C  nsMacMessagePump::DoMouseDown(EventRecord&)+00124

  109552E0    PPC  0F02B25C  nsMacMessagePump::DoMenu(EventRecord&, long)+000D0

  10955190    PPC  0F02B588  

nsMacMessagePump::DispatchMenuCommandToRaptor(EventRecord&, long

)+00050

  10955150    PPC  0F025C70  nsMacMessageSink::DispatchMenuCommand(EventRecord&, 

long)+00050

  10955110    PPC  0F01EF70  nsMacWindow::HandleMenuCommand(EventRecord&, long)+

00040

  109550D0    PPC  0F020748  nsMacEventHandler::HandleMenuCommand(EventRecord&, 

long)+0018C

  10954FF0    PPC  0EFF2984  nsWindow::DispatchWindowEvent(nsGUIEvent&)+00028

  10954FB0    PPC  0EFF286C  nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&

)+00098

  10954F60    PPC  0F00C9AC  nsMenuBar::MenuSelected(const nsMenuEvent&)+00190

  10954E90    PPC  0F0029FC  nsMenu::MenuItemSelected(const nsMenuEvent&)+01034

  109549B0    PPC  0F013BF8  nsMenuItem::MenuItemSelected(const nsMenuEvent&)+

00090

  10954970    PPC  0F014178  nsMenuItem::DoCommand()+00344

  10954860    PPC  0EF0AA08  nsXULElement::HandleDOMEvent(nsIPresContext*, 

nsEvent*, nsIDOMEv

ent**, unsigned int, nsEventStatus*)+0116C

  10954420    PPC  0E5ABB28  nsEventListenerManager::HandleEvent(nsIPresContext*, 

nsEvent*, n

sIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*)+02208

  10954190    PPC  0E5A94CC  

nsEventListenerManager::HandleEventSubType(nsListenerStruct*, ns

IDOMEvent*, nsIDOMEventTarget*, unsigned int, unsigned int)+00878

  10953F20    PPC  0F1BBDA0  nsJSEventListener::HandleEvent(nsIDOMEvent*)+002B0

  10953DF0    PPC  0F12593C  nsJSContext::CallEventHandler(void*, void*, unsigned 

int, void*,

 int*, int)+0041C

  10953D10    PPC  0F3E90E4  JS_CallFunctionValue+00044

  10953CD0    PPC  0F40C7E0  js_InternalInvoke+000D0

  10953C10    PPC  0F40C528  js_Invoke+00A94

  10953B10    PPC  0F419974  js_Interpret+0C268

  10953710    PPC  0F40C4B4  js_Invoke+00A20

  10953610    PPC  0EDFC9A4  WrappedNative_CallMethod(JSContext*, JSObject*, 

unsigned int, lo

ng*, long*)+001B8

  10953590    PPC  0EDFA13C  

nsXPCWrappedNativeClass::CallWrappedMethod(JSContext*, nsXPCWrap

pedNative*, const XPCNativeMemberDescriptor*, nsXPCWrappedNativeClass::CallMode, 

unsigned int

, long*, long*)+01178

  109532C0    PPC  0F33E0BC  XPTC_InvokeByIndex+0002C

  10953280    PPC  0F33E1C4  _XPTC_InvokeByIndex+000C8

  109531D8    PPC  0F340D40  nsXPTCStubBase::Sentinel9()+000E4

  10953128    PPC  0F33E7C0  PrepareAndDispatch+005B4

  10953018    PPC  0EDEF6AC  nsXPCWrappedJS::CallMethod(unsigned short, const 

nsXPTMethodInfo

*, nsXPTCMiniVariant*)+00054

  10952FD8    PPC  0EDF232C  nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, 

unsigned short,

 const nsXPTMethodInfo*, nsXPTCMiniVariant*)+00A8C

  10952B28    PPC  0F40C528  js_Invoke+00A94

  10952A28    PPC  0F419974  js_Interpret+0C268

  10952628    PPC  0F40C4B4  js_Invoke+00A20

  10952528    PPC  0EEDDC0C  XULTreeElementSelectAll(JSContext*, JSObject*, 

unsigned int, lon

g*, long*)+000CC

  109524D8    PPC  0EEE0A74  nsXULTreeElement::SelectAll()+00514

  109523B8    PPC  0EEDFFD0  nsXULTreeElement::SelectItemRange(nsIDOMXULElement*, 

nsIDOMXULEl

ement*)+006B0

Comment 4

[(not reading, please use [e-mail] instead)]

I've got the fix.  I'll attach it for hyatt to review.

Comment 5

[(not reading, please use [e-mail] instead)]

Attachment: fix

Comment 6

[(not reading, please use [e-mail] instead)]

there is a null check in nsXULTreeFrame(), that return NS_OK if the
XULTreeOuterGroup is null.  we could also set *aResult to 0 there.

Comment 7

[(not reading, please use [e-mail] instead)]

Attachment: an alternate fix

Comment 8

[(not reading, please use [e-mail] instead)]

adding status whiteboard comment.  time to get a review from hyatt...

Comment 9

[Brendan Eich [:brendan]]

r/sr=[e-mail] on "an alternate fix" -- successful XPCOM result code
means out and inout params must be valid!

/be

Comment 10

[(not reading, please use [e-mail] instead)]

waiting for review from hyatt, before I check the "alternative fix" in.

Comment 11

[David Hyatt]

sr=hyatt

Comment 12

[Asa Dotzler [:asa]]

great! approval to check in 
a=asa and stuff.

Comment 13

[(not reading, please use [e-mail] instead)]

fixed.

Comment 14

[laurel]

OK using 2001-02-09-04 commercial trunk build, win98.