79207 - crash when trying to add an address to a reply to message

Status: RESOLVED DUPLICATE of bug 78574

(Core :: Layout, defect)

Description

[Christopher Blizzard (:blizzard)]

When I reply to a message and I click on a blank address line to add another
recipient I get a crash every time.  Here is the stack trace:

#6  0x4137f870 in nsDOMEvent::GetTarget (this=0xad40a98, aTarget=0xbfffcb10)
    at ../../../dist/include/nsCOMPtr.h:649
#7  0x414c88a0 in nsGenericElement::HandleDOMEvent (this=0xac8a0a8, 
    aPresContext=0xad1d808, aEvent=0xaea2330, aDOMEvent=0xbfffca3c, aFlags=1, 
    aEventStatus=0xbfffcb68) at ../../../dist/include/nsCOMPtr.h:1131
#8  0x418519c1 in PresShell::HandlePostedDOMEvents (this=0xa9d0ee8)
    at ../../../../dist/include/nsCOMPtr.h:642
#9  0x41853257 in PresShell::ProcessReflowCommands (this=0xa9d0ee8, 
    aInterruptible=0) at nsPresShell.cpp:5883
#10 0x41851bb7 in PresShell::FlushPendingNotifications (this=0xa9d0ee8)
    at nsPresShell.cpp:4787
#11 0x41851c1c in PresShell::EndReflowBatching (this=0xa9d0ee8, 
    aFlushPendingReflows=1) at nsPresShell.cpp:4813
#12 0x42235b82 in nsEditor::EndUpdateViewBatch (this=0xac88f00)
    at ../../dist/include/nsCOMPtr.h:648
#13 0x4222badb in nsEditor::EndPlaceHolderTransaction (this=0xac88f00)
    at nsEditor.cpp:710
#14 0x42242d9b in nsPlaintextEditor::DeleteSelection (this=0xac88f00, 
    aAction=0) at ../../dist/include/nsCOMPtr.h:648
#15 0x4189b4a9 in nsGfxTextControlFrame2::SetTextControlFrameState (
    this=0xa9dac10, aValue=@0xbfffcfa0)
    at ../../../../dist/include/nsCOMPtr.h:649
#16 0x4189a455 in nsGfxTextControlFrame2::AttributeChanged (this=0xa9dac10, 
    aPresContext=0xad1d808, aChild=0xae5f9b8, aNameSpaceID=0, 
    aAttribute=0x822bec8, aHint=5) at nsGfxTextControlFrame2.cpp:2793
#17 0x418ae1ec in nsCSSFrameConstructor::AttributeChanged (this=0xaba5e30, 
    aPresContext=0xad1d808, aContent=0xae5f9b8, aNameSpaceID=0, 
    aAttribute=0x822bec8, aHint=5) at nsCSSFrameConstructor.cpp:9936
#18 0x414ec743 in StyleSetImpl::AttributeChanged (this=0xae8f8a0, 
    aPresContext=0xad1d808, aContent=0xae5f9b8, aNameSpaceID=0, 
    aAttribute=0x822bec8, aHint=5) at nsStyleSet.cpp:1289
#19 0x41851d24 in PresShell::AttributeChanged (this=0xa9d0ee8, 
    aDocument=0xa991ea8, aContent=0xae5f9b8, aNameSpaceID=0, 
    aAttribute=0x822bec8, aHint=5) at ../../../../dist/include/nsCOMPtr.h:649
#20 0x4144f5b2 in nsXULDocument::AttributeChanged (this=0xa991ea8, 
    aElement=0xae5f9b8, aNameSpaceID=0, aAttribute=0x822bec8, aHint=5)
    at nsXULDocument.cpp:1613
#21 0x41386b95 in nsGenericHTMLElement::SetHTMLAttribute (this=0xae5f9b8, 
    aAttribute=0x822bec8, aValue=@0xbfffd760, aNotify=1)
    at nsGenericHTMLElement.cpp:1565
#22 0x41385e6a in nsGenericHTMLElement::SetAttribute (this=0xae5f9b8, 
    aNameSpaceID=0, aAttribute=0x822bec8, aValue=@0xbfffd9b0, aNotify=1)
    at nsGenericHTMLElement.cpp:1332
#23 0x4138c918 in nsGenericHTMLElement::SetFormControlAttribute (
    this=0xae5f9b8, aForm=0x0, aNameSpaceID=0, aName=0x822bec8, 
    aValue=@0xbfffd9b0, aNotify=1) at nsGenericHTMLElement.cpp:3855
#24 0x4138d06a in nsGenericHTMLLeafFormElement::SetAttribute (this=0xae5f9b8, 
    aNameSpaceID=0, aName=0x822bec8, aValue=@0xbfffd9b0, aNotify=1)
    at nsGenericHTMLElement.cpp:4074
#25 0x4148a588 in nsXBLPrototypeBinding::AttributeChanged (this=0xa2e4e18, 
    aAttribute=0x822bec8, aNameSpaceID=0, aRemoveFlag=0, 
    aChangedElement=0xae815c8, aAnonymousContent=0xae5f630)
    at ../../../dist/include/nsCOMPtr.h:649
#26 0x41486a9f in nsXBLBinding::AttributeChanged (this=0xae5f598, 
    aAttribute=0x822bec8, aNameSpaceID=0, aRemoveFlag=0)
    at ../../../dist/include/nsCOMPtr.h:649
#27 0x4143b0a0 in nsXULElement::SetAttribute (this=0xae815c8, 
    aNodeInfo=0x9217688, aValue=@0xbfffde30, aNotify=1)
    at ../../../../dist/include/nsCOMPtr.h:648
#28 0x41436a5e in nsXULElement::SetAttribute (this=0xae815c8, 
    aName=@0xbfffded0, aValue=@0xbfffde30)
    at ../../../../dist/include/nsCOMPtr.h:642
#29 0x404d1b92 in ElementSetAttribute (cx=0xabdb460, obj=0xadd9910, argc=2, 
    argv=0xad7bad4, rval=0xbfffe020) at nsJSElement.cpp:249
#30 0x40138fa7 in js_Invoke (cx=0xabdb460, argc=2, flags=0) at jsinterp.c:813
#31 0x4014066b in js_Interpret (cx=0xabdb460, result=0xbfffe25c)
    at jsinterp.c:2708
#32 0x40138fff in js_Invoke (cx=0xabdb460, argc=1, flags=2) at jsinterp.c:830
#33 0x401391f9 in js_InternalInvoke (cx=0xabdb460, obj=0xa43ad58, 
    fval=182294672, flags=0, argc=1, argv=0xbfffe47c, rval=0xbfffe3e8)
    at jsinterp.c:902
#34 0x4011d25e in JS_CallFunctionValue (cx=0xabdb460, obj=0xa43ad58, 
    fval=182294672, argc=1, argv=0xbfffe47c, rval=0xbfffe3e8) at jsapi.c:3337
#35 0x4049db70 in nsJSContext::CallEventHandler (this=0xafb2df8, 
    aTarget=0xa43ad58, aHandler=0xadd9890, argc=1, argv=0xbfffe47c, 
    aBoolResult=0xbfffe480, aReverseReturnResult=0) at nsJSEnvironment.cpp:941
#36 0x404da73d in nsJSEventListener::HandleEvent (this=0xaed2a10, 
    aEvent=0xae80ba4) at nsJSEventListener.cpp:154
#37 0x4137246e in nsEventListenerManager::HandleEventSubType (this=0xaed29e0, 
    aListenerStruct=0xaed2a40, aDOMEvent=0xae80ba4, aCurrentTarget=0xb043468, 
    aSubType=4, aPhaseFlags=2) at nsEventListenerManager.cpp:1063
#38 0x41372baf in nsEventListenerManager::HandleEvent (this=0xaed29e0, 
    aPresContext=0xad1d808, aEvent=0xbfffee80, aDOMEvent=0xbfffeb4c, 
    aCurrentTarget=0xb043468, aFlags=2, aEventStatus=0xbffff168)
    at nsEventListenerManager.cpp:1229
#39 0x4143da30 in nsXULElement::HandleDOMEvent (this=0xb043460, 
    aPresContext=0xad1d808, aEvent=0xbfffee80, aDOMEvent=0xbfffeb4c, aFlags=2, 
    aEventStatus=0xbffff168) at ../../../../dist/include/nsCOMPtr.h:649
#40 0x4143db47 in nsXULElement::HandleDOMEvent (this=0xaed2880, 
    aPresContext=0xad1d808, aEvent=0xbfffee80, aDOMEvent=0xbfffeb4c, aFlags=1, 
    aEventStatus=0xbffff168) at ../../../../dist/include/nsCOMPtr.h:648
#41 0x41852ae7 in PresShell::HandleEventInternal (this=0xa9d0ee8, 
    aEvent=0xbfffee80, aView=0x0, aFlags=1, aStatus=0xbffff168)
    at ../../../../dist/include/nsCOMPtr.h:642
#42 0x418529e3 in PresShell::HandleEventWithTarget (this=0xa9d0ee8, 
    aEvent=0xbfffee80, aFrame=0xac57128, aContent=0xaed2880, aFlags=1, 
    aStatus=0xbffff168) at nsPresShell.cpp:5531
#43 0x4137a709 in nsEventStateManager::CheckForAndDispatchClick (
    this=0xa8d04b0, aPresContext=0xad1d808, aEvent=0xbffff220, 
    aStatus=0xbffff168) at ../../../dist/include/nsCOMPtr.h:648
#44 0x41378eea in nsEventStateManager::PostHandleEvent (this=0xa8d04b0, 
    aPresContext=0xad1d808, aEvent=0xbffff220, aTargetFrame=0xac57128, 
    aStatus=0xbffff168, aView=0xa5ce240) at nsEventStateManager.cpp:1448
#45 0x41852bb5 in PresShell::HandleEventInternal (this=0xa9d0ee8, 
    aEvent=0xbffff220, aView=0xa5ce240, aFlags=1, aStatus=0xbffff168)
    at ../../../../dist/include/nsCOMPtr.h:642
#46 0x4185295f in PresShell::HandleEvent (this=0xa9d0ee8, aView=0xa5ce240, 
    aEvent=0xbffff220, aEventStatus=0xbffff168, aForceHandle=1, 
    aHandled=@0xbffff0e4) at nsPresShell.cpp:5485
#47 0x4197c846 in nsView::HandleEvent (this=0xa5ce240, event=0xbffff220, 
    aEventFlags=28, aStatus=0xbffff168, aForceHandle=1, aHandled=@0xbffff0e4)
    at nsView.cpp:364
#48 0x419866f1 in nsViewManager::DispatchEvent (this=0xa30e880, 
    aEvent=0xbffff220, aStatus=0xbffff168) at nsViewManager.cpp:2053
#49 0x4197c1a2 in HandleEvent (aEvent=0xbffff220) at nsView.cpp:67
#50 0x40609b1e in nsWidget::DispatchEvent (this=0x8b46040, aEvent=0xbffff220, 
    aStatus=@0xbffff1bc) at nsWidget.cpp:1488
#51 0x40609a3e in nsWidget::DispatchWindowEvent (this=0x8b46040, 
    event=0xbffff220) at nsWidget.cpp:1379
#52 0x40609bb4 in nsWidget::DispatchMouseEvent (this=0x8b46040, 
    aEvent=@0xbffff220) at nsWidget.cpp:1515
#53 0x4060a93d in nsWidget::OnButtonReleaseSignal (this=0x8b46040, 
    aGdkButtonEvent=0xa9219ac) at nsWidget.cpp:2064
#54 0x4060e9d1 in nsWindow::HandleGDKEvent (this=0x8b46040, event=0xa9219ac)
    at nsWindow.cpp:1474
#55 0x4060433a in dispatch_superwin_event (event=0xa9219ac, window=0x8b46040)
    at nsGtkEventHandler.cpp:1022
#56 0x40603ff2 in handle_gdk_event (event=0xa9219ac, data=0x0)
    at nsGtkEventHandler.cpp:843
#57 0x40774e4f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#58 0x407a47f3 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#59 0x407a4dd9 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#60 0x407a4f8c in g_main_run () from /usr/lib/libglib-1.2.so.0
#61 0x406bc803 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#62 0x405fbbb6 in nsAppShell::Run (this=0x80eee00) at nsAppShell.cpp:360
#63 0x405d0dfa in nsAppShellService::Run (this=0x80eb448)
    at ../../../dist/include/nsCOMPtr.h:649
#64 0x0804e5b7 in main1 (argc=2, argv=0xbffff7fc, nativeApp=0x0)
    at ../../dist/include/nsCOMPtr.h:649
#65 0x0804eeaf in main (argc=2, argv=0xbffff7fc) at nsAppRunner.cpp:1311
#66 0x40200177 in __libc_start_main (main=0x804ed64 <main>, argc=2, 
    ubp_av=0xbffff7fc, init=0x804af9c <_init>, fini=0x805099c <_fini>, 
    rtld_fini=0x4000e184 <_dl_fini>, stack_end=0xbffff7ec)
    at ../sysdeps/generic/libc-start.c:129

Comment 1

[Håkan Waara]

*** This bug has been marked as a duplicate of 78891 ***

Comment 2

[Christopher Blizzard (:blizzard)]

I think you marked this a dup of the wrong bug.

Comment 3

[Håkan Waara]

Oops. Sorry about that! Duping against the right bug

*** This bug has been marked as a duplicate of 78574 ***