90378 - Address Book, "select all" and "delete" leads to crash - M096 [@ 0x10101010 - js_GetSlotThreadSafe]

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Address Book & Contacts, defect, P1)

Description

[fenella]

Linux (2001-07-11-05-0.9.2)
win32 (2001-07-11-06-0.9.2)
Mac (2001-07-11-08-0.9.2)
steps:
1. From Address Book, select Personal Address Book
2. From the Edit menu, so a Select All to high-light all the cards
3. Click on the Delete button
Actual result: Crash
Expected result: Should delete all the cards.
I can re-produce the bug using 946, 900 700, 400 cards in the Address Book.

Comment 1

[fenella]

Stack trace from Linux. But it crashes on all 3 systems.

Incident ID 32775897 
 Stack Signature 0x72f57808 d963c97d 
 Bug ID
 Trigger Time  2001-07-11 11:40:00 
 User Comments Personal address book 946 cards, select all and delete leads to 
crash 
 Build ID 2001071105 
 Product ID Netscape6.10 
 Platform ID LinuxIntel 
 Stack Trace

0x72f57808 
JS_GetPrivate() 
js_CloneFunctionObject() 
JS_CloneFunctionObject() 
DefinePropertyIfFound() 
XPC_WN_NoHelper_Resolve() 
js_LookupProperty() 
js_GetProperty() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
JS_CallFunctionValue() 
nsJSContext::CallEventHandler() 
nsJSEventListener::HandleEvent() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
nsXULCommandDispatcher::UpdateCommands() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_CallMethod() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
JS_CallFunctionValue() 
nsJSContext::CallEventHandler() 
nsJSEventListener::HandleEvent() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
nsXULTreeElement::FireOnSelectHandler() 
nsXULElement::RemoveChildAt() 
nsXULContentBuilder::RemoveMember() 
nsXULContentBuilder::ReplaceMatch() 
nsXULTemplateBuilder::Retract() 
nsXULTemplateBuilder::OnUnassert() 
CompositeDataSourceImpl::OnUnassert() 
nsAbRDFDataSource::unassertEnumFunc() 
nsSupportsArray::EnumerateForwards() 
nsAbRDFDataSource::NotifyObservers() 
nsAbDirectoryDataSource::OnItemRemoved() 
nsAddrBookSession::NotifyDirectoryItemDeleted() 
nsAbMDBDirectory::NotifyItemDeleted() 
nsAbMDBDirectory::OnCardEntryChange() 
nsAddrDatabase::NotifyCardEntryChange() 
nsAddrDatabase::DeleteCard() 
nsAbMDBDirectory::DeleteCards() 
nsAbDirectoryDataSource::DoDeleteCardsFromDirectory() 
nsAbDirectoryDataSource::DoCommand() 
CompositeDataSourceImpl::DoCommand() 
nsAddressBook::DoCommand() 
nsAddressBook::DeleteCards() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_CallMethod() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
nsXPCWrappedJSClass::CallMethod() 
nsXPCWrappedJS::CallMethod() 
PrepareAndDispatch() 
nsXPTCStubBase::Stub5() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_CallMethod() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
JS_CallFunctionValue() 
nsJSContext::CallEventHandler() 
nsJSEventListener::HandleEvent() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
PresShell::HandleDOMEventWithTarget() 
nsButtonBoxFrame::MouseClicked() 
nsButtonBoxFrame::HandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEventWithTarget() 
nsEventStateManager::CheckForAndDispatchClick() 
nsEventStateManager::PostHandleEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEvent() 
nsView::HandleEvent() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWidget::DispatchMouseEvent() 
nsWidget::OnButtonReleaseSignal() 
nsWindow::HandleGDKEvent() 
dispatch_superwin_event() 
handle_gdk_event() 
libgdk-1.2.so.0 + 0x170fb (0x403100fb) 
libglib-1.2.so.0 + 0xfa86 (0x4033da86) 
libglib-1.2.so.0 + 0x10041 (0x4033e041) 
libglib-1.2.so.0 + 0x101e1 (0x4033e1e1) 
libgtk-1.2.so.0 + 0x8b7a9 (0x402677a9) 

Comment 2

[fenella]

Windows stack trace has more information...

Incident ID 32781252 
 Stack Signature 0x00000100 eaddae63 
 Bug ID
 Trigger Time  2001-07-11 13:48:11 
 User Comments Address Book, select all and delete leads to crashes on windows. 
 Build ID 2001071106 
 Product ID Netscape6.10 
 Platform ID  Win32 
 Stack Trace

0x00000100 
js_GetSlotThreadSafe [d:\builds\seamonkey\mozilla\js\src\jslock.c, line 511] 
JS_GetPrivate [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 1876] 
js_CloneFunctionObject [d:\builds\seamonkey\mozilla\js\src\jsfun.c, line 1929] 
JS_CloneFunctionObject [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2724] 
DefinePropertyIfFound 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 430] 
XPC_WN_NoHelper_Resolve 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 702] 
js_LookupProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2183] 
js_GetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2336] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2541] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3322] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 944] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1162] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
2134] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3635] 
nsXULCommandDispatcher::UpdateCommands 
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULCommandDispatcher.cpp
,
line 370] 
XPTC_InvokeByIndex 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, 
line 139] 
XPCWrappedNative::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
1883] 
XPC_WN_CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 1253] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2703] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3322] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 944] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1162] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1765] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3635] 
nsXULTreeElement::FireOnSelectHandler 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULTreeElement.cpp, line 
459] 
nsXULElement::RemoveChildAt 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
2795] 
nsXULContentBuilder::RemoveMember 
[d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp, 
line 1104] 
nsXULContentBuilder::ReplaceMatch 
[d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp, 
line 1849] 
nsXULTemplateBuilder::Retract 
[d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTemplateBuilder.cpp, 
line 601] 
nsXULTemplateBuilder::OnUnassert 
[d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTemplateBuilder.cpp, 
line 636] 
CompositeDataSourceImpl::OnUnassert 
[d:\builds\seamonkey\mozilla\rdf\base\src\nsCompositeDataSource.cpp, line 1577] 
nsAbRDFDataSource::unassertEnumFunc 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbRDFDataSource.cpp, line 
118] 
nsSupportsArray::EnumerateForwards 
[d:\builds\seamonkey\mozilla\xpcom\ds\nsSupportsArray.cpp, line 360] 
0x80000000 
nsAbDirectoryDataSource::OnItemRemoved 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsDirectoryDataSource.cpp, 
line 478] 
nsAddrBookSession::NotifyDirectoryItemDeleted 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrBookSession.cpp, line 
121] 
nsAbMDBDirectory::NotifyItemDeleted 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbMDBDirectory.cpp, line 
216] 
nsAbMDBDirectory::OnCardEntryChange 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbMDBDirectory.cpp, line 
830] 
nsAddrDatabase::NotifyCardEntryChange 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrDatabase.cpp, line 297] 
nsAddrDatabase::DeleteCard 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddrDatabase.cpp, line 
2271] 
nsAbMDBDirectory::DeleteCards 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAbMDBDirectory.cpp, line 
499] 
nsAbDirectoryDataSource::DoDeleteCardsFromDirectory
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsDirectoryDataSource.cpp, 
line 682] 
nsAbDirectoryDataSource::DoCommand 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsDirectoryDataSource.cpp, 
line 418] 
CompositeDataSourceImpl::DoCommand 
[d:\builds\seamonkey\mozilla\rdf\base\src\nsCompositeDataSource.cpp, line 1422] 
nsAddressBook::DoCommand 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddressBook.cpp, line 219] 
nsAddressBook::DeleteCards 
[d:\builds\seamonkey\mozilla\mailnews\addrbook\src\nsAddressBook.cpp, line 157] 
XPTC_InvokeByIndex 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, 
line 139] 
XPCWrappedNative::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
1883] 
XPC_WN_CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 1253] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2703] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] 
nsXPCWrappedJSClass::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 
1002] 
nsXPCWrappedJS::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 427] 
PrepareAndDispatch 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, 
line 102] 
SharedStub 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, 
line 124] 

Comment 3

[scottputterman]

Fenella, in the future please don't change the milestone (just bring important
bugs to our attention).  The current milestone is 0.9.3.

Candice, can you reproduce this?  If so it would be a good one to try to figure out.

Comment 4

[chuang]

Using win32 build(2001-07-11-06-0.9.2) on Win 2000, I only got it once by using
shift key to select all cards. I didn't get it from the Select All menu. I'll
keep trying.

Comment 5

[fenella]

Scott, thanks for letting me know.

Comment 6

[fenella]

*** Bug 91705 has been marked as a duplicate of this bug. ***

Comment 7

[scottputterman]

moving to 0.9.4

Comment 8

[chuang]

I am not sure if this is related to this bug.  If I use "Ctrl + A" or "Ctrl +
F",  I got crash for an 800+ cards address book.  But it didn't crash if I use
"Select All" menu.  This happened just by doing the selection, not the "delete".

Comment 9

[chuang]

Oop, should be "Shift + mouse click" instead of "Ctrl +F".   It doesn't not
happen every time but in a pretty high percentage.

Comment 10

[Scott MacGregor]

adding nsEnterprise+ keyword per mail triage meeting today.

Comment 11

[chuang]

Move to 0.9.5 since we don't have a fix yet.

Comment 12

[Jaime Rodriguez, Jr.]

Plusing this one, becasue it has a nsenterprise+.

How close are we to a fix, and how risky is it? Will it get done this week? 

Jpatel - What is the frequency of the crash?

Comment 13

[Scott MacGregor]

nsEnterprise+ does not mean nsBranch+ removing the nsBranch+ nomination. We
haven't decided to plus this at this time. 

Comment 14

[Jay Patel [:jay]]

Jaime - This is a crash that will be difficult to dig up in Talkback, since it
appears to be occurring under multiple stack signatures.

chuang - The crashes posted here are from 7/11, and we only keep Talkback data
for 30 days in the database.  If you could try to reproduce this crash with
recent builds and submit Talkback reports that would be great.  

Comment 15

[Jussi-Pekka Mantere]

Triaging nsenterprise-.

Comment 16

[Cindy Roberts]

There aren't any comments on this bug since the 18th of Sept.  Can QA regess
against the Netscape commercial builds and determine if this is still a valid
bug?  Please mark as nsbranch+ which will get this on the PDT radar if you think
this is critical and can give us an ETA for the fix. Else, mark is as nsbranch-.
Also, can someone comment in the bug how serious you think this is?  PDT is only
accepting "stop ship" bugs at this point such as data loss, loss of major
functionality, regressions and bugs to the eMojo "stop ship" features.

Comment 17

[Ninoschka Baca]

Commercial Branch Build 2001-09-26-05: WinMe
Using the menu item Select|All, then Delete button

- 100 cards, deleted cards in a reasonable amount of time.
- 250 cards, it took a little while for the addresses to be deleted but I could
see the scrollbar slowly moving so it gives some feedback that something is
happening.
- 300 cards, it took longer for these addresses to be deleted but it could
appear to be hung since no visual feedback appears. Eventually the addresses are
deleted.

- 400 cards, it appears to hang and definitely crashes. So a number between
300-400 cards displays the crash.

Since it requires a large number of addresses to be selected/deleted to see this
crash, it's probably not a plus.

Comment 18

[Jaime Rodriguez, Jr.]

ETA pls ...

Comment 19

[Scott MacGregor]

I agree with  Ninoschka that this bug isn't a plus due to the requirement that
you need to select 3 or 4 hundred cards.

Comment 20

[scottputterman]

reassigning to cavin

Comment 21

[scottputterman]

moving to 1.0

Comment 22

[scottputterman]

*** Bug 105475 has been marked as a duplicate of this bug. ***

Comment 23

[Matthias Versen [:Matti]]

*** Bug 105332 has been marked as a duplicate of this bug. ***

Comment 24

[Asa Dotzler [:asa]]

Bugs targeted at mozilla1.0 without the mozilla1.0 keyword moved to mozilla1.0.1 
(you can query for this string to delete spam or retrieve the list of bugs I've 
moved)

Comment 25

[Jay Patel [:jay]]

Adding topcrash keyword and M096 [@ 0x10101010 - js_GetSlotThreadSafe] to
summary for tracking.  This was a topcrash with Mozilla 0.9.6.

Comment 26

[(not reading, please use [e-mail] instead)]

taking, I've fixed this.

Comment 27

[(not reading, please use [e-mail] instead)]

fixed.

Comment 28

[Ninoschka Baca]

Trunk build 2002-02-11-03: WinMe
Trunk build 2002-02-11-11: Linux RH 7.1
Trunk build 2002-02-11-08: Mac 10.1
Verified Fixed.