Closed Bug 74997 Opened 23 years ago Closed 23 years ago

Outliner causes crash when loading inbox

Categories

(SeaMonkey :: MailNews: Message Display, defect)

Product:
SeaMonkey
Component:
MailNews: Message Display
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: kinmoz, Assigned: hyatt)

References

Details

(Keywords: crash, smoketest)

Attachments

(1 file)

Patch to work around the view manager's problems
1.07 KB, patch
Details | Diff | Splinter Review 
With my 04/05/01 11:30pm Mozilla Win32 debug build, I'm seeing a crash when I 
start mail. It seems to be happening while it's loading my inbox. I've been 
seeing this for a couple of days now, but thought it might be due to some 
changes in my local tree, but apparently it's not.

It's crashing in nsViewManager::RenderViews(), and seems to be caused by the 
fact that the outliner is causing the ViewManager to be re-entered while trying 
to scroll.

I see 2 assertions thrown by the ViewManager saying that recursive painting is 
not allowed, and then I eventually crash in nsViewManager::RenderViews.

If I skip over the mOutlinerWidget->Scroll() call in the debugger, in 
nsOutlinerBodyFrame::ScrollInternal(), while my INBOX is loading, I don't crash 
and mail comes up fine.

This is really hindering me from using my debug build as dogfood. Some others on 
IRC have mentioned that this is happening to them too.

Here are the stack traces for the 2 assertions before the crash ...

Assertion #1:


NTDLL! 77f762e8()
nsDebug::Assertion(const char * 0x029d4988, const char * 0x029d4970, const char 
* 0x029d4948, int 819) line 286 + 13 bytes
nsViewManager::Refresh(nsIView * 0x07216d80, nsIRenderingContext * 0x06db9930, 
const nsRect * 0x0012dd14, unsigned int 1) line 819 + 35 bytes
nsViewManager::DispatchEvent(nsViewManager * const 0x063e7870, nsGUIEvent * 
0x0012de54, nsEventStatus * 0x0012dd58) line 1909
HandleEvent(nsGUIEvent * 0x0012de54) line 68
nsWindow::DispatchEvent(nsWindow * const 0x07216c44, nsGUIEvent * 0x0012de54, 
nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012de54, nsEventStatus & 
nsEventStatus_eIgnore) line 721
nsWindow::OnPaint() line 3825 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long * 
0x0012e234) line 2832 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x002605ea, unsigned int 15, unsigned int 0, long 
0) line 950 + 27 bytes
USER32! 77e71303()
USER32! 77e71dfa()
NTDLL! 77f763ef()
nsOutlinerBodyFrame::ScrollInternal(int 4803) line 1867
nsOutlinerBodyFrame::PositionChanged(nsOutlinerBodyFrame * const 0x0146fac4, int 
81804, int & 81651) line 1896
nsSliderFrame::AttributeChanged(nsSliderFrame * const 0x0146fda8, nsIPresContext 
* 0x063e7ee0, nsIContent * 0x07216180, int 0, nsIAtom * 0x019d2970, int 4) line 
249
nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const 
0x063e89b0, nsIPresContext * 0x063e7ee0, nsIContent * 0x07216180, int 0, nsIAtom 
* 0x019d2970, int 3) line 9851 + 35 bytes
StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x063e8ae0, nsIPresContext * 
0x063e7ee0, nsIContent * 0x07216180, int 0, nsIAtom * 0x019d2970, int -1) line 
1272
PresShell::AttributeChanged(PresShell * const 0x063e8628, nsIDocument * 
0x063e5bc0, nsIContent * 0x07216180, int 0, nsIAtom * 0x019d2970, int -1) line 
4429 + 57 bytes
nsXULDocument::AttributeChanged(nsXULDocument * const 0x063e5bc0, nsIContent * 
0x07216180, int 0, nsIAtom * 0x019d2970, int -1) line 1554
nsXULElement::SetAttribute(nsXULElement * const 0x07216180, nsINodeInfo * 
0x06385d80, const nsAString & {...}, int 1) line 3096
nsXULElement::SetAttribute(nsXULElement * const 0x07216180, int 0, nsIAtom * 
0x019d2970, const nsAString & {...}, int 1) line 3116 + 29 bytes
nsXBLPrototypeBinding::AttributeChanged(nsXBLPrototypeBinding * const 
0x0306a350, nsIAtom * 0x019d2970, int 0, int 0, nsIContent * 0x072147f0, 
nsIContent * 0x07216350) line 662
nsXBLBinding::AttributeChanged(nsXBLBinding * const 0x072164f0, nsIAtom * 
0x019d2970, int 0, int 0) line 1348
nsXULElement::SetAttribute(nsXULElement * const 0x072147f0, nsINodeInfo * 
0x08221620, const nsAString & {...}, int 1) line 3063
nsXULElement::SetAttribute(nsXULElement * const 0x072147f0, int 0, nsIAtom * 
0x019d2970, const nsAString & {...}, int 1) line 3116 + 29 bytes
nsOutlinerBodyFrame::InvalidateScrollbar(nsOutlinerBodyFrame * const 0x0146fabc) 
line 612
nsOutlinerBodyFrame::Paint(nsOutlinerBodyFrame * const 0x0146fa80, 
nsIPresContext * 0x063e7ee0, nsIRenderingContext & {...}, const nsRect & {...}, 
nsFramePaintLayer eFramePaintLayer_Underlay) line 1160
PresShell::Paint(PresShell * const 0x063e8624, nsIView * 0x07216d80, 
nsIRenderingContext & {...}, const nsRect & {...}) line 4855 + 34 bytes
nsView::Paint(nsView * const 0x07216d80, nsIRenderingContext & {...}, const 
nsRect & {...}, unsigned int 128, int & 268598533) line 277
nsViewManager::RenderDisplayListElement(DisplayListElement2 * 0x06db9800, 
nsIRenderingContext & {...}) line 1394
nsViewManager::RenderViews(nsIView * 0x07216d80, nsIRenderingContext & {...}, 
const nsRect & {...}, int & 0) line 1319
nsViewManager::Refresh(nsIView * 0x07216d80, nsIRenderingContext * 0x06dbaf10, 
const nsRect * 0x0012f694, unsigned int 1) line 885
nsViewManager::DispatchEvent(nsViewManager * const 0x063e7870, nsGUIEvent * 
0x0012f7d4, nsEventStatus * 0x0012f6d8) line 1909
HandleEvent(nsGUIEvent * 0x0012f7d4) line 68
nsWindow::DispatchEvent(nsWindow * const 0x07216c44, nsGUIEvent * 0x0012f7d4, 
nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7d4, nsEventStatus & 
nsEventStatus_eIgnore) line 721
nsWindow::OnPaint() line 3825 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long * 
0x0012fbb4) line 2832 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x002605ea, unsigned int 15, unsigned int 0, long 
0) line 950 + 27 bytes
USER32! 77e71303()
USER32! 77e71962()
NTDLL! 77f763ef


Assertion #2:


NTDLL! 77f762e8()
nsDebug::Assertion(const char * 0x029d4988, const char * 0x029d4970, const char 
* 0x029d4948, int 819) line 286 + 13 bytes
nsViewManager::Refresh(nsIView * 0x063e7670, nsIRenderingContext * 0x06dc00c0, 
const nsRect * 0x00128998, unsigned int 1) line 819 + 35 bytes
nsViewManager::DispatchEvent(nsViewManager * const 0x063e7870, nsGUIEvent * 
0x00128ad8, nsEventStatus * 0x001289dc) line 1909
HandleEvent(nsGUIEvent * 0x00128ad8) line 68
nsWindow::DispatchEvent(nsWindow * const 0x063e7534, nsGUIEvent * 0x00128ad8, 
nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x00128ad8, nsEventStatus & 
nsEventStatus_eIgnore) line 721
nsWindow::OnPaint() line 3825 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long * 
0x00128eb8) line 2832 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x00030566, unsigned int 15, unsigned int 0, long 
0) line 950 + 27 bytes
USER32! 77e71303()
USER32! 77e71962()
NTDLL! 77f763ef()



And finally the stack trace for the crash:



NTDLL! 77f762e8()
_CrtDbgReport(int 2, const char * 0x102500d8 ??_C@_0L@OFGA@dbgdel?4cpp?$AA@, int 
47, const char * 0x00000000, const char * 0x102500e4 
??_C@_0CH@PHOC@_BLOCK_TYPE_IS_VALID?$CIpHead?9?$DOnBlo@) line 353
operator delete(void * 0x06db96f0) line 47 + 73 bytes
nsViewManager::RenderViews(nsIView * 0x063e7670, nsIRenderingContext & {...}, 
const nsRect & {...}, int & 0) line 1330 + 24 bytes
nsViewManager::Refresh(nsIView * 0x063e7670, nsIRenderingContext * 0x06dc00c0, 
const nsRect * 0x00128998, unsigned int 1) line 885
nsViewManager::DispatchEvent(nsViewManager * const 0x063e7870, nsGUIEvent * 
0x00128ad8, nsEventStatus * 0x001289dc) line 1909
HandleEvent(nsGUIEvent * 0x00128ad8) line 68
nsWindow::DispatchEvent(nsWindow * const 0x063e7534, nsGUIEvent * 0x00128ad8, 
nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x00128ad8, nsEventStatus & 
nsEventStatus_eIgnore) line 721
nsWindow::OnPaint() line 3825 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long * 
0x00128eb8) line 2832 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x00030566, unsigned int 15, unsigned int 0, long 
0) line 950 + 27 bytes
USER32! 77e71303()
USER32! 77e71962()
NT
dup'ing.

*** This bug has been marked as a duplicate of 74770 ***
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → DUPLICATE
So I just tried a patch from sspitzer that disables the mail code that scrolls 
to the new message. That doesn't stop the crash.

I think the problem here is that during a paint, the outliner invalidates it's 
scrollbar which causes the maxpos attribute to be set, triggering a scroll that 
does a synchronous paint. If we have to adjust the maxpos during the 
invalidation, we should probably tell ViewManager that we want an asynchronous 
paint during the scroll so that we don't re-enter the ViewManager.

In any case I think this is a bug hyatt should look into.
reopening
Status: RESOLVED → REOPENED
Resolution: DUPLICATE → ---
*** Bug 74770 has been marked as a duplicate of this bug. ***
marking as smoketest blocker
Severity: normal → blocker
Keywords: smoketest
over to hyatt.
Assignee: mscott → hyatt
Status: REOPENED → NEW
*** Bug 73913 has been marked as a duplicate of this bug. ***
I can't reproduce this crash on my machine.
Status: NEW → ASSIGNED
according to others:

use imap, make it is it is your default server and sure you have "login at
startup" set in the server settings.

exit, send yourself mail from 4.x that won't get filtered away, so you know you
have new messages in your inbox.

start back up.
*** Bug 74992 has been marked as a duplicate of this bug. ***
It's crashing in nsViewManager for me too even w/o IMAP.  Changing summary to
reflect this...
Keywords: crash
OS: Windows NT → All
Summary: Outliner causes crash when loading IMAP INBOX → Outliner causes crash when loading inbox
I don't see this on my 04-06 linux and mac builds, hwaara, why did you change 
the OS to all?
sr=sspitzer

thanks hyatt.
Ok, fixed.
Status: ASSIGNED → RESOLVED
Closed: 23 years ago → 23 years ago
Resolution: --- → FIXED
i still crash after applying this patch.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
my crash seems to be happening at

status = mRawPtr->QueryInterface(aIID, answer);

in nsCOMPtr.cpp  if that helps.
Yeah, but what's above that on the stack?
I no longer crash, and removing my patch and reverting back causes me to crash
again.  I have certainly eliminated any re-entrant painting with this patch...

sorry, here it is:

nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012d90c) line 32 + 
23 bytes
nsCOMPtr<nsIContent>::assign_from_helper(const nsCOMPtr_helper & {...}, const 
nsID & {...}) line 970 + 18 bytes
nsCOMPtr<nsIContent>::nsCOMPtr<nsIContent>(const nsQueryInterface & {...}) line 
564
nsXBLWindowKeyHandler::EnsureHandlers() line 89
nsXBLWindowKeyHandler::WalkHandlers(nsXBLWindowKeyHandler * const 0x04b2d9d0, 
nsIDOMEvent * 0x0502b124, nsIAtom * 0x02b7d5b0) line 114
nsXBLWindowKeyHandler::KeyDown(nsIDOMEvent * 0x0502b124) line 143
nsEventListenerManager::HandleEvent(nsIPresContext * 0x042212f0, nsEvent * 
0x0012f7d4, nsIDOMEvent * * 0x0012f598, nsIDOMEventTarget * 0x041f9cfc, unsigned 
int 2, nsEventStatus * 0x0012f740) line 1293 + 23 bytes
nsXULDocument::HandleDOMEvent(nsXULDocument * const 0x041f9ce0, nsIPresContext * 
0x042212f0, nsEvent * 0x0012f7d4, nsIDOMEvent * * 0x0012f598, unsigned int 2, 
nsEventStatus * 0x0012f740) line 1908
nsXULElement::HandleDOMEvent(nsXULElement * const 0x04234640, nsIPresContext * 
0x042212f0, nsEvent * 0x0012f7d4, nsIDOMEvent * * 0x0012f598, unsigned int 2, 
nsEventStatus * 0x0012f740) line 3694 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0491fe20, nsIPresContext * 
0x042212f0, nsEvent * 0x0012f7d4, nsIDOMEvent * * 0x0012f598, unsigned int 2, 
nsEventStatus * 0x0012f740) line 3688 + 53 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0491fbb0, nsIPresContext * 
0x042212f0, nsEvent * 0x0012f7d4, nsIDOMEvent * * 0x0012f598, unsigned int 2, 
nsEventStatus * 0x0012f740) line 3688 + 53 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0491fb30, nsIPresContext * 
0x042212f0, nsEvent * 0x0012f7d4, nsIDOMEvent * * 0x0012f598, unsigned int 2, 
nsEventStatus * 0x0012f740) line 3688 + 53 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0491fa60, nsIPresContext * 
0x042212f0, nsEvent * 0x0012f7d4, nsIDOMEvent * * 0x0012f598, unsigned int 2, 
nsEventStatus * 0x0012f740) line 3688 + 53 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0491f4b0, nsIPresContext * 
0x042212f0, nsEvent * 0x0012f7d4, nsIDOMEvent * * 0x0012f598, unsigned int 2, 
nsEventStatus * 0x0012f740) line 3688 + 53 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0491f3a0, nsIPresContext * 
0x042212f0, nsEvent * 0x0012f7d4, nsIDOMEvent * * 0x0012f598, unsigned int 1, 
nsEventStatus * 0x0012f740) line 3688 + 53 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f7d4, nsIView * 0x04222aa0, 
unsigned int 1, nsEventStatus * 0x0012f740) line 5125 + 47 bytes
PresShell::HandleEvent(PresShell * const 0x04222364, nsIView * 0x04222aa0, 
nsGUIEvent * 0x0012f7d4, nsEventStatus * 0x0012f740, int 1, int & 1) line 5052 + 
25 bytes
nsView::HandleEvent(nsView * const 0x04222aa0, nsGUIEvent * 0x0012f7d4, unsigned 
int 28, nsEventStatus * 0x0012f740, int 1, int & 1) line 379
nsViewManager::DispatchEvent(nsViewManager * const 0x04222c40, nsGUIEvent * 
0x0012f7d4, nsEventStatus * 0x0012f740) line 1996
HandleEvent(nsGUIEvent * 0x0012f7d4) line 68
nsWindow::DispatchEvent(nsWindow * const 0x04222964, nsGUIEvent * 0x0012f7d4, 
nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7d4) line 716
nsWindow::DispatchKeyEvent(unsigned int 133, unsigned short 0, unsigned int 16) 
line 2330 + 15 bytes
nsWindow::OnKeyDown(unsigned int 16, unsigned int 42) line 2361 + 25 bytes
nsWindow::ProcessMessage(unsigned int 256, unsigned int 16, long 2752513, long * 
0x0012fb88) line 2948 + 32 bytes
nsWindow::WindowProc(HWND__ * 0x002004be, unsigned int 256, unsigned int 16, 
long 2752513) line 950 + 27 bytes
USER32! 77e148dc()
USER32! 77e14aa7()
USER32! 77e266fd()
nsAppShellService::Run(nsAppShellService * const 0x0058a360) line 408
main1(int 1, char * * 0x004b4180, nsISupports * 0x00000000) line 1021 + 32 bytes
main(int 1, char * * 0x004b4180) line 1316 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e992a6()

Am I seeing something different here then?  I crash right after hitting enter on 
login.
That's the same stack as in bug 75039...
That is a totally different bug.  Closing this one back out.
Status: REOPENED → RESOLVED
Closed: 23 years ago → 23 years ago
Resolution: --- → FIXED
From a CVS pull at 4:45 with nmake /f client.mak pull_all depend build_all I see
no crash when logging in as startup to my IMAP inbox on Windows 2000.
Status: RESOLVED → VERIFIED
on 2001-04-05 moz loads to the profile selection and after hitting return: no
load. If i double-click the desktop icon a second time, moz loads - related?
(using imap.cs.com, win98)
*** Bug 75089 has been marked as a duplicate of this bug. ***
Product: Browser → Seamonkey
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: