78574 - Mail crashes Trunk when entering a second email address to send to [@ 0x00000000 - nsEventStateManager::GetEventTargetContent]

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect, P1)

Description

[Kevin McCluskey (gone)]

1) Open mail
2) Click on New Message
3) Enter an email address into the to: field
4) Click on the line below to enter another email address
5) Crash


I was using a debug build from this morning on WINNT. It also crashes using a
release build from 5/1/2001 and this morning 5/2/2001

This is the stack trace for the crash on WINNT:


00000000()
nsEventStateManager::GetEventTargetContent(nsEventStateManager * const 
0x07a474c8, nsEvent * 0x0810cca0, nsIContent * * 0x0012c114) line 2867
nsDOMEvent::GetTarget(nsDOMEvent * const 0x0810c3f0, nsIDOMEventTarget * * 
0x0012c4a0) line 277 + 54 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x07a2d720, nsIPresContext * 
0x0539a080, nsEvent * 0x0810cca0, nsIDOMEvent * * 0x0012cf64, unsigned int 4, 
nsEventStatus * 0x0012cfa0) line 3636 + 43 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x07a2d5f0, nsIPresContext * 
0x0539a080, nsEvent * 0x0810cca0, nsIDOMEvent * * 0x0012cf64, unsigned int 4, 
nsEventStatus * 0x0012cfa0) line 3656
nsXULElement::HandleDOMEvent(nsXULElement * const 0x07a2efa0, nsIPresContext * 
0x0539a080, nsEvent * 0x0810cca0, nsIDOMEvent * * 0x0012cf64, unsigned int 4, 
nsEventStatus * 0x0012cfa0) line 3656
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0689af60, nsIPresContext * 
0x0539a080, nsEvent * 0x0810cca0, nsIDOMEvent * * 0x0012cf64, unsigned int 1, 
nsEventStatus * 0x0012cfa0) line 3656
PresShell::HandlePostedDOMEvents() line 4717
PresShell::ProcessReflowCommands(int 0) line 5877
PresShell::FlushPendingNotifications(PresShell * const 0x053a1510) line 4783
nsXULTreeGroupFrame::OnContentRemoved(nsIPresContext * 0x0539a080, nsIFrame * 
0x06aa0bc8, int 2, int & 1) line 503
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x053a0df0, 
nsIPresContext * 0x0539a080, nsIContent * 0x0689af60, nsIContent * 0x07df6160, 
int 2) line 9062
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x053a1250, nsIPresContext * 
0x0539a080, nsIContent * 0x0689af60, nsIContent * 0x07df6160, int 2) line 1269
PresShell::ContentRemoved(PresShell * const 0x053a1518, nsIDocument * 
0x053998f0, nsIContent * 0x0689af60, nsIContent * 0x07df6160, int 2) line 4940 + 
53 bytes
nsXULDocument::ContentRemoved(nsXULDocument * const 0x053998f0, nsIContent * 
0x0689af60, nsIContent * 0x07df6160, int 2) line 1739
nsXULElement::RemoveChildAt(nsXULElement * const 0x0689af60, int 2, int 1) line 
2812
nsXULElement::RemoveChild(nsXULElement * const 0x0689af64, nsIDOMNode * 
0x07df6164, nsIDOMNode * * 0x0012d6cc) line 1185 + 22 bytes
NodeRemoveChild(JSContext * 0x07390810, JSObject * 0x02772c08, unsigned int 1, 
long * 0x06acf1c4, long * 0x0012d7b0) line 545 + 25 bytes
js_Invoke(JSContext * 0x07390810, unsigned int 1, unsigned int 0) line 813 + 23 
bytes
js_Interpret(JSContext * 0x07390810, long * 0x0012e530) line 2706 + 15 bytes
js_Invoke(JSContext * 0x07390810, unsigned int 1, unsigned int 2) line 830 + 13 
bytes
js_InternalInvoke(JSContext * 0x07390810, JSObject * 0x02773b50, long 111967336, 
unsigned int 0, unsigned int 1, long * 0x0012e6c8, long * 0x0012e658) line 902 + 
20 bytes
JS_CallFunctionValue(JSContext * 0x07390810, JSObject * 0x02773b50, long 
111967336, unsigned int 1, long * 0x0012e6c8, long * 0x0012e658) line 3334 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x07396b90, void * 0x02773b50, 
void * 0x06ac7c68, unsigned int 1, void * 0x0012e6c8, int * 0x0012e6c4, int 0) 
line 940 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x080e2384) line 154 + 64 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x07df0b20, 
nsIDOMEvent * 0x080e2384, nsIDOMEventTarget * 0x07df4d98, unsigned int 4, 
unsigned int 2) line 1035 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x0539a080, nsEvent * 
0x0012f440, nsIDOMEvent * * 0x0012f34c, nsIDOMEventTarget * 0x07df4d98, unsigned 
int 2, nsEventStatus * 0x0012f734) line 1201 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x07df4d90, nsIPresContext * 
0x0539a080, nsEvent * 0x0012f440, nsIDOMEvent * * 0x0012f34c, unsigned int 2, 
nsEventStatus * 0x0012f734) line 3675
nsXULElement::HandleDOMEvent(nsXULElement * const 0x07df0e70, nsIPresContext * 
0x0539a080, nsEvent * 0x0012f440, nsIDOMEvent * * 0x0012f34c, unsigned int 1, 
nsEventStatus * 0x0012f734) line 3692 + 53 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f440, nsIView * 0x00000000, 
unsigned int 1, nsEventStatus * 0x0012f734) line 5551 + 47 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x053a1510, nsEvent * 
0x0012f440, nsIFrame * 0x05cedbe8, nsIContent * 0x07df0e70, unsigned int 1, 
nsEventStatus * 0x0012f734) line 5524 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 
0x07a474c0, nsIPresContext * 0x0539a080, nsMouseEvent * 0x0012f840, 
nsEventStatus * 0x0012f734) line 2349 + 61 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x07a474c8, 
nsIPresContext * 0x0539a080, nsEvent * 0x0012f840, nsIFrame * 0x05cedbe8, 
nsEventStatus * 0x0012f734, nsIView * 0x07d894b0) line 1448 + 28 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f840, nsIView * 0x07d894b0, 
unsigned int 1, nsEventStatus * 0x0012f734) line 5571 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x053a1514, nsIView * 0x07d894b0, 
nsGUIEvent * 0x0012f840, nsEventStatus * 0x0012f734, int 1, int & 1) line 5478 + 
25 bytes
nsView::HandleEvent(nsView * const 0x07d894b0, nsGUIEvent * 0x0012f840, unsigned 
int 28, nsEventStatus * 0x0012f734, int 1, int & 1) line 377
nsViewManager::DispatchEvent(nsViewManager * const 0x053a05f0, nsGUIEvent * 
0x0012f840, nsEventStatus * 0x0012f734) line 2055
HandleEvent(nsGUIEvent * 0x0012f840) line 68
nsWindow::DispatchEvent(nsWindow * const 0x07d5ee34, nsGUIEvent * 0x0012f840, 
nsEventStatus & nsEventStatus_eIgnore) line 704 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f840) line 725
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 4041 + 
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 
4286
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 1900664, long * 
0x0012fc10) line 3022 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x017504b6, unsigned int 514, unsigned int 0, long 
1900664) line 959 + 27 bytes
USER32! 77e7124c()

Comment 1

[esther]

Using builds 2001-05-02 on Win and Linux NOT Mac.  The key is to type in the 
full name in the 1st addressing field and don't press <Enter>.  Just click in 
the 2nd addressing field.  

Comment 2

[scottputterman]

marking nsbeta1+.  This is pretty bad.

Comment 3

[Jay Patel [:jay]]

Adding topcrash keyword and [@ 0x00000000 - 
nsEventStateManager::GetEventTargetContent] to summary.  This is a topcrasher 
according to Talkback data.  Here's one of many similar entries and a stack 
trace:

0x00000000 8c306449
         line 
        Build: 2001050106 CrashDate: 2001-05-02 UptimeMinutes: 102  Total: 164 
        OS: Windows NT  5.0 build 2195
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=29920831
         StackTrace: 
http://climate/reports/stackcommentemail.cfm?dynamicBBID=29920831

Incident ID 29920831 
0x00000000 
nsEventStateManager::GetEventTargetContent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 
2867] 
nsDOMEvent::GetTarget 
[d:\builds\seamonkey\mozilla\content\events\src\nsDOMEvent.cpp, line 280] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3639] 
PresShell::HandlePostedDOMEvents 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4665] 
PresShell::ProcessReflowCommands 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5824] 
PresShell::FlushPendingNotifications 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4731] 
PresShell::HandlePostedReflowCallbacks 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4647] 
PresShell::ProcessReflowCommands 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5827] 
PresShell::FlushPendingNotifications 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4731] 
PresShell::HandlePostedReflowCallbacks 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4647] 
PresShell::ProcessReflowCommands 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5827] 
PresShell::FlushPendingNotifications 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4731] 
nsXULDocument::FlushPendingNotifications 
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 
1902] 
nsXBLStreamListener::Load 
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp, line 418] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1619] 
nsDocument::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 2851] 
nsXMLDocument::EndLoad 
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLDocument.cpp, line 
710] 
nsXMLContentSink::DidBuildModel 
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLContentSink.cpp, line 
292] 
CWellFormedDTD::DidBuildModel 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 318] 
nsParser::DidBuildModel 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1432] 
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 1912] 
nsParser::OnStopRequest 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2361] 
nsXBLStreamListener::OnStopRequest 
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp, line 293] 
nsJARChannel::OnStopRequest 
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 
587] 
nsOnStopRequestEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 
159] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 589] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 522] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 
1070] 

Comment 4

[scottputterman]

*** Bug 78788 has been marked as a duplicate of this bug. ***

Comment 5

[Jean-Francois Ducarroz]

*** Bug 78448 has been marked as a duplicate of this bug. ***

Comment 6

[Jean-Francois Ducarroz]

This is a regression due to the new mordern skin landing. Reassign to hewitt,
cc'ing hyatt

Comment 7

[Oliver Klee]

*** Bug 79024 has been marked as a duplicate of this bug. ***

Comment 8

[Håkan Waara]

*** Bug 79043 has been marked as a duplicate of this bug. ***

Comment 9

[Håkan Waara]

Topcrash and 4 dups in 3 days - this is one really bad and visible crash.
Hewitt, is this your bug? We need someone to get started on this immediately.

Comment 10

[gstovall]

This is also happening on Linux, in 2001050315 build.  

Comment 11

[Stef van der Made]

In build 20010413 this bug did not appear. I've never had this bug pop up so it
must have slipped in just a few builds ago

Comment 12

[Oliver Klee]

*** Bug 79144 has been marked as a duplicate of this bug. ***

Comment 13

[Håkan Waara]

*** Bug 79207 has been marked as a duplicate of this bug. ***

Comment 14

[Christopher Blizzard (:blizzard)]

Adding pierre since I see some style set changes there.

Comment 15

[Christopher Blizzard (:blizzard)]

Adding jst since there are lots of DOM changes in there and danm since it's
triggered from the event processor.

Comment 16

[Joe Hewitt (gone)]

Attachment: patch to fix

Comment 17

[hangas]

Themes Triage Team marking nsbeta1+

Comment 18

[Jean-Francois Ducarroz]

R=ducarroz. Thanks for fixing this bug...

Comment 19

[Scott MacGregor]

sr=mscott

Comment 20

[Joe Hewitt (gone)]

fixed

Comment 21

[esther]

using build 2001-05-08-15 on windows and 2001-05-08-08 on linux this is fixed. I 
also verified this works on Mac even though it wasn't reported on Mac.  
Verified.

Comment 22

[Håkan Waara]

*** Bug 79190 has been marked as a duplicate of this bug. ***