[BLOCKER] Clicking on a Messenger folder causes a crash

VERIFIED FIXED in M8

Status

P1
blocker
VERIFIED FIXED
20 years ago
10 years ago

People

(Reporter: scottputterman, Assigned: scottputterman)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Assignee)

Description

20 years ago
With this morning's build, I'm crashing when I click on a Messenger folder in
the folder pane.

This is the call stack:

js_SkipWhiteSpace(const unsigned short * 0x0358001c) line 2270 + 5 bytes
js_strtod(JSContext * 0x041c47b0, const unsigned short * 0x0358001c, const
unsigned short * * 0x0012dbd4, double * 0x0012dbd8) line 637 + 9 bytes
js_ValueToNumber(JSContext * 0x041c47b0, long 66074212, double * 0x0012e284)
line 477 + 24 bytes
js_Interpret(JSContext * 0x041c47b0, long * 0x0012e3b4) line 1851 + 318 bytes
js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes
js_Interpret(JSContext * 0x041c47b0, long * 0x0012eba0) line 2215 + 15 bytes
js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes
js_Interpret(JSContext * 0x041c47b0, long * 0x0012f38c) line 2215 + 15 bytes
js_Invoke(JSContext * 0x041c47b0, unsigned int 1, int 0) line 671 + 13 bytes
js_CallFunctionValue(JSContext * 0x041c47b0, JSObject * 0x01273f48, long
19349328, unsigned int 1, long * 0x0012f4d0, long * 0x0012f4d8) line 749 + 15
bytes
JS_CallFunctionValue(JSContext * 0x041c47b0, JSObject * 0x01273f48, long
19349328, unsigned int 1, long * 0x0012f4d0, long * 0x0012f4d8) line 2568 + 29
bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x04caf4c0) line 97 + 34 bytes
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2, nsEventStatus &
nsEventStatus_eConsumeDoDefault) line 569 + 21 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042d8700, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2348
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042e3c40, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042eae80, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042ec110, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042f7c50, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042e7640, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 2,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x042d74b0, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f914, unsigned int 1,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 2351 + 39 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const
0x04303920, nsIPresContext & {...}, nsMouseEvent * 0x0012fbd4, nsEventStatus &
nsEventStatus_eConsumeDoDefault) line 632 + 31 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x04303920,
nsIPresContext & {...}, nsGUIEvent * 0x0012fbd4, nsIFrame * 0x04306340,
nsEventStatus & nsEventStatus_eConsumeDoDefault, nsIView * 0x041ec2a0) line 194
+ 24 bytes
PresShell::HandleEvent(PresShell * const 0x041edaa4, nsIView * 0x041ec2a0,
nsGUIEvent * 0x0012fbd4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line
2047 + 43 bytes
nsView::HandleEvent(nsView * const 0x041ec2a0, nsGUIEvent * 0x0012fbd4, unsigned
int 28, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 833
nsViewManager::DispatchEvent(nsViewManager * const 0x041ec4c0, nsGUIEvent *
0x0012fbd4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 1735
HandleEvent(nsGUIEvent * 0x0012fbd4) line 67
nsWindow::DispatchEvent(nsWindow * const 0x041ec184, nsGUIEvent * 0x0012fbd4,
nsEventStatus & nsEventStatus_eIgnore) line 419 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbd4) line 440
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=???
y=???}) line 3018 + 15 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000 {x=???
y=???}) line 3167
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 5177426, long *
0x0012fdc0) line 2380 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x000305bc, unsigned int 514, unsigned int 0, long
5177426) line 482 + 27 bytes
USER32! 77e71250()
004f0052()
(Assignee)

Updated

20 years ago
Severity: normal → blocker
Priority: P3 → P1
(Assignee)

Comment 1

20 years ago
*** Bug 8756 has been marked as a duplicate of this bug. ***
(Assignee)

Updated

20 years ago
OS: Windows NT → All
Hardware: PC → All
(Assignee)

Comment 2

20 years ago
I can bring the browser up and I can also bring up Messenger without any
problem.  But, clicking on a folder causes this.

Comment 3

20 years ago
Adding myself to the cc list.

Comment 4

20 years ago
There are no obvious changes around the call sites on the stack.  There have
been no changes in the string-to-number conversion code either.

There has, however, been a change to the number-to-string conversion code, a bug
fix by Roger Lawrence for bug #7625.

Since I can't repro this bug, can someone on the cc list of this bug try backing
out just the most recent checkin to jsnum.c in their tree and report whether or
not it cures the crash ?
(Assignee)

Comment 5

20 years ago
using rev 3.11 of jsnum.c I still get the crash.

Comment 6

20 years ago
I'll need the path to someone's executable to repro the bug.  If I can't get a
handle on what's causing this before noon, I'll just back out all the JS engine
changes.

Comment 7

20 years ago
After reviewing all the JS changes checked in during the period in
question, only a few files look like they could possibly be the culprit.
We've already eliminated jsnum.c.

It's not clear if the JS code in question makes use of regular expressions
(there's no regexp code in the call stack), but the bulk of the changes to the
JS engine were in jsregexp.c and jsregexp.h.

The only other likely cause would be Mike Shaver's change to jsinterp.c to fix
bug #8042.
(Assignee)

Comment 8

20 years ago
It appears the problem is that I was subtracting Dates to get the current time
rather than using the function dateObj.GetTime().
(Assignee)

Updated

20 years ago
Assignee: fur → putterman
(Assignee)

Comment 9

20 years ago
I've been asked to reassign this bug to me so I can mark it fixed for mailnews.
If this date crash shouldn't be happening, we should open up another bug on
this.
(Assignee)

Updated

20 years ago
Status: NEW → RESOLVED
Last Resolved: 20 years ago
Resolution: --- → FIXED

Updated

20 years ago
Target Milestone: M8

Comment 10

20 years ago
verified this in 6/24 (respun) builds on win32 and mac.  Unable to verify for
Linux due to bug 8849.  Will wait.

Updated

20 years ago
Status: RESOLVED → VERIFIED

Comment 11

20 years ago
6/25 Linux builds passed our build smoke test so this bug has been verified.
Product: MailNews → Core
Product: Core → MailNews Core
You need to log in before you can comment on or make changes to this bug.