Closed Bug 8755 Opened 26 years ago Closed 26 years ago

[BLOCKER] Clicking on a Messenger folder causes a crash

Categories

(MailNews Core :: Backend, defect, P1)

Product:
MailNews Core
Component:
Backend
Type:
defect

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: scottputterman, Assigned: scottputterman)

References

Details

With this morning's build, I'm crashing when I click on a Messenger folder in the folder pane. This is the call stack: js_SkipWhiteSpace(const unsigned short * 0x0358001c) line 2270 + 5 bytes js_strtod(JSContext * 0x041c47b0, const unsigned short * 0x0358001c, const unsigned short * * 0x0012dbd4, double * 0x0012dbd8) line 637 + 9 bytes js_ValueToNumber(JSContext * 0x041c47b0, long 66074212, double * 0x0012e284) line 477 + 24 bytes js_Interpret(JSContext * 0x041c47b0, long * 0x0012e3b4) line 1851 + 318 bytes js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes js_Interpret(JSContext * 0x041c47b0, long * 0x0012eba0) line 2215 + 15 bytes js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes js_Interpret(JSContext * 0x041c47b0, long * 0x0012f38c) line 2215 + 15 bytes js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes js_CallFunctionValue(JSContext * 0x041c47b0, JSObject * 0x01273f48, long 19349328, unsigned int 1, long * 0x0012f4d0, long * 0x0012f4d8) line 749 + 15 bytes JS_CallFunctionValue(JSContext * 0x041c47b0, JSObject * 0x01273f48, long 19349328, unsigned int 1, long * 0x0012f4d0, long * 0x0012f4d8) line 2568 + 29 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x04caf4c0) line 97 + 34 bytes nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 569 + 21 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042d8700, nsIPresContext & {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2348 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042e3c40, nsIPresContext & {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042eae80, nsIPresContext & {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042ec110, nsIPresContext & {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042f7c50, nsIPresContext & {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042e7640, nsIPresContext & {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042d74b0, nsIPresContext & {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 1, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x04303920, nsIPresContext & {...}, nsMouseEvent * 0x0012fbd4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 632 + 31 bytes nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x04303920, nsIPresContext & {...}, nsGUIEvent * 0x0012fbd4, nsIFrame * 0x04306340, nsEventStatus & nsEventStatus_eConsumeDoDefault, nsIView * 0x041ec2a0) line 194 + 24 bytes PresShell::HandleEvent(PresShell * const 0x041edaa4, nsIView * 0x041ec2a0, nsGUIEvent * 0x0012fbd4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2047 + 43 bytes nsView::HandleEvent(nsView * const 0x041ec2a0, nsGUIEvent * 0x0012fbd4, unsigned int 28, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 833 nsViewManager::DispatchEvent(nsViewManager * const 0x041ec4c0, nsGUIEvent * 0x0012fbd4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 1735 HandleEvent(nsGUIEvent * 0x0012fbd4) line 67 nsWindow::DispatchEvent(nsWindow * const 0x041ec184, nsGUIEvent * 0x0012fbd4, nsEventStatus & nsEventStatus_eIgnore) line 419 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbd4) line 440 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? y=???}) line 3018 + 15 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=??? y=???}) line 3167 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 5177426, long * 0x0012fdc0) line 2380 + 24 bytes nsWindow::WindowProc(HWND__ * 0x000305bc, unsigned int 514, unsigned int 0, long 5177426) line 482 + 27 bytes USER32! 77e71250() 004f0052()
Severity: normal → blocker
Priority: P3 → P1
*** Bug 8756 has been marked as a duplicate of this bug. ***
OS: Windows NT → All
Hardware: PC → All
I can bring the browser up and I can also bring up Messenger without any problem. But, clicking on a folder causes this.
Adding myself to the cc list.
There are no obvious changes around the call sites on the stack. There have been no changes in the string-to-number conversion code either. There has, however, been a change to the number-to-string conversion code, a bug fix by Roger Lawrence for bug #7625. Since I can't repro this bug, can someone on the cc list of this bug try backing out just the most recent checkin to jsnum.c in their tree and report whether or not it cures the crash ?
using rev 3.11 of jsnum.c I still get the crash.
I'll need the path to someone's executable to repro the bug. If I can't get a handle on what's causing this before noon, I'll just back out all the JS engine changes.
After reviewing all the JS changes checked in during the period in question, only a few files look like they could possibly be the culprit. We've already eliminated jsnum.c. It's not clear if the JS code in question makes use of regular expressions (there's no regexp code in the call stack), but the bulk of the changes to the JS engine were in jsregexp.c and jsregexp.h. The only other likely cause would be Mike Shaver's change to jsinterp.c to fix bug #8042.
It appears the problem is that I was subtracting Dates to get the current time rather than using the function dateObj.GetTime().
Assignee: fur → putterman
I've been asked to reassign this bug to me so I can mark it fixed for mailnews. If this date crash shouldn't be happening, we should open up another bug on this.
Status: NEW → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Target Milestone: M8
verified this in 6/24 (respun) builds on win32 and mac. Unable to verify for Linux due to bug 8849. Will wait.
Status: RESOLVED → VERIFIED
6/25 Linux builds passed our build smoke test so this bug has been verified.
Product: MailNews → Core
Product: Core → MailNews Core
You need to log in before you can comment on or make changes to this bug.