Open Bug 91447 Opened 22 years ago Updated 13 years ago

highlight a specific irc user's text


(Other Applications :: ChatZilla, enhancement)

Not set


(Not tracked)



(Reporter: amla70, Assigned: rginda)



(3 files, 1 obsolete file)

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.2+) Gecko/20010718
BuildID:    2001071803

After installing chatzilla 0.8.4 (with some problems by the way), now whenever I
close mozilla after being using chatzilla a crash appears

Reproducible: Always
Steps to Reproduce:
1. Install chatzilla 0.8.4 (may need to install it twice to get it working)
2. Open chatzilla and then close it
3. Now when mozilla it's closed a crash will happen

Actual Results:  
MOZILLA provocó un error de página no válida en el 
módulo <desconocido> de 0084:01caa982.
EAX=02076af7 CS=015f EIP=01caa982 EFLGS=00010282
EBX=60f60398 SS=0167 ESP=0068fa34 EBP=0068fa78
ECX=01caa980 DS=0167 ESI=020768e0 FS=37ef
EDX=0000003f ES=0167 EDI=00000010 GS=0000
Bytes en CS:EIP:
,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x ,02x 
Volcado de pila:
,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x ,08x 

Expected Results:  No crash

talkback IDs related to this:


not sure if this one is related (didn't close any window, just full system crashed):

and of course, this is s regression, please, don't check in chatzilla 0.8.4 still.
Keywords: crash
It seems to only happen on Win98.  I wonder if it's related to the difficulty
installing chatzilla on Win98.
Ever confirmed: true
I installed mozilla without chatzilla and then installed it from the hacksrus
page.  It installed fine, but still crashed on exit of mozilla.

Very easy to reproduce:
  Start mozilla
  Open chatzilla
  Close chatzilla
  Close mozilla windows

Result: crash dialog (illegal operation)

This happens even when chatzilla is started from the command line.

In about 15 tries, there have been 2 exceptions: once it exited cleanly, and
once there was no crash dialog, but the mozilla process was stuck in the task list.
I see it on Linux as well.
Blocks: 89713
OS: Windows 98 → All
Here's a stack trace on Linux:

Program received signal SIGSEGV, Segmentation fault.
#0  0x0000003b in __strtol_internal (nptr=0x85d7d20 "Ю╒Ш@пи]\b\020",
    endptr=0x3, base=-1073745336, group=1074812806) at eval.c:43
#1  0x401057aa in _hashFreeEntry () at eval.c:41
#2  0x401056b7 in PL_HashTableFinalize () at eval.c:41
#3  0x401058e9 in nsHashtable::~nsHashtable () at eval.c:41
#4  0x40e2eb2d in CSSStyleSheetInner::~CSSStyleSheetInner ()
   from /usr/src/temp/mozilla/dist/bin/components/
#5  0x40e2ebf5 in CSSStyleSheetInner::RemoveSheet ()
   from /usr/src/temp/mozilla/dist/bin/components/
#6  0x40e2f439 in CSSStyleSheetImpl::~CSSStyleSheetImpl ()
   from /usr/src/temp/mozilla/dist/bin/components/
#7  0x40e2f696 in CSSStyleSheetImpl::Release ()
   from /usr/src/temp/mozilla/dist/bin/components/
#8  0x401069ae in nsSupportsHashtable::ReleaseElement () at eval.c:41
#9  0x401057d7 in _hashEnumerate () at eval.c:41
#10 0x401a3523 in PL_HashTableEnumerateEntries () at eval.c:41
#11 0x40105c23 in nsHashtable::Enumerate () at eval.c:41
#12 0x401069eb in nsSupportsHashtable::~nsSupportsHashtable () at eval.c:41
#13 0x40e89efe in nsXULPrototypeCache::~nsXULPrototypeCache ()
   from /usr/src/temp/mozilla/dist/bin/components/
#14 0x40e89f8d in nsXULPrototypeCache::Release ()
   from /usr/src/temp/mozilla/dist/bin/components/
#15 0x401397cc in nsServiceManagerImpl::ReleaseService () at eval.c:41
#16 0x40139adf in nsServiceManagerImpl::ReleaseService () at eval.c:41
#17 0x40139d39 in nsServiceManager::ReleaseService () at eval.c:41
#18 0x40ec6f32 in nsXBLService::~nsXBLService ()
   from /usr/src/temp/mozilla/dist/bin/components/
#19 0x40ec69b2 in nsXBLService::Release ()
   from /usr/src/temp/mozilla/dist/bin/components/
#20 0x4013928c in DeleteEntry () at eval.c:41
#21 0x40105c50 in _hashEnumerateRemove () at eval.c:41
#22 0x401a3523 in PL_HashTableEnumerateEntries () at eval.c:41
#23 0x40105ccd in nsHashtable::Reset () at eval.c:41
#24 0x40106941 in nsObjectHashtable::Reset () at eval.c:41
#25 0x40106849 in nsObjectHashtable::~nsObjectHashtable () at eval.c:41
#26 0x40139371 in nsServiceManagerImpl::~nsServiceManagerImpl () at eval.c:41
#27 0x401393e6 in nsServiceManagerImpl::Release () at eval.c:41
#28 0x40139bae in nsServiceManager::ShutdownGlobalServiceManager ()
    at eval.c:41
#29 0x4010072b in NS_ShutdownXPCOM () at eval.c:41
#30 0x08051c11 in main () at eval.c:41
#31 0x404bbf11 in __libc_start_main (main=0x8051ac0 <main>, argc=2,
    ubp_av=0xbffff8e4, init=0x804b6bc <_init>, fini=0x8053b24 <_fini>,
    rtld_fini=0x4000e214 <_dl_fini>, stack_end=0xbffff8dc)
    at ../sysdeps/generic/libc-start.c:129

cc'ing, because it appears that something is getting
corrupted in the stylesheets at exit or getting corrupted during execution and
shows up at exit.

This may be due to the use of dynamic stylesheet rules (modified at runtime).
The CSSStyleSheetInner object contains a hashtable called mRelevantAttributes. 
Somehow this hashtable is getting corrupted and when the CSSStyleSheetInner
object gets destroyed, the hashtable gets destroyed, but the hashtable
destructor dies when trying to delete one of the keys.
glazou: any comments?
The line that sets up the crash to happen looks something like this:
var rule = frames[0].document.styleSheets[0].cssRules.item(0)

I'm commenting the offending code out of chatzilla 0.8.4 so we can land.
No longer blocks: 89713
styleSheet member of rule is only available if rule.type is a CSSImportRule

this patch puts the highlight menu back in chatzilla.  please apply it an see if
the crash returns.
You should (a) test rules if null or not (b) not rely on selectorText to check
the rule's type. Please
prefer the following piece of code; r=glazman with this change made.

    function processStyleRules(rules)
        if (rules)
          for (var i = 0; i < rules.length; ++i)
            var rule = rules.item(i);
            if (rule.type == 1)
              ary = rule.selectorText.
              if (ary)
                menuitem = document.createElement("menuitem");
                menuitem.setAttribute ("class", "highlight-menu-item");
                menuitem.setAttribute ("label", ary[1]);
                menuitem.setAttribute ("oncommand", "onPopupHighlight('" + 
                               + "');");
                menuitem.setAttribute ("style",;
            else if (rule.type == 3)
Changing the summary since this code didn't actually go into 0.8.4.
Severity: critical → enhancement
Keywords: crash
Summary: Mozilla crashes on close after using chatzilla 0.8.4 → highlight a specific user's text
Summary: highlight a specific user's text → highlight a specific irc user's text
The css code to iterate rules seems to write to memory it doesn't own.  When we
enable the hightlight menu, people start to see strange things.  I promised to
write bz a testcase, but havn't had the chance.  Perhaps someone could try under

The highlight menu can be enabled by pulling the CHATZILLA_0_8_5_BRANCH in
extensions/irc, and uncommenting the <menupopup id="highlightMenu"> in
popups.xul, and the //XXXcreateHighlightMenu(); in static.js.
Attachment #47471 - Attachment is obsolete: true
In bug 127726 Samuel Sieb speculated that this bug may be related to 127726
because of a similar crash stack.  127726 and others went away shortly after a
patch for bug 129620 was checked in.  I guess everybody's busy with 1.0, but if
this was the same crash as 127726, maybe somebody could check the highlight menu
again once things settle down.
I checked out the highlight menu again and no crash on exit.
QA Contact: mozilla → samuel
coooool.  We should spin a 0.8.6-pre xpi for this, to test better for a
potential 1.0 check-in.
I just posted a 0.8.7-pre1 xpi at <>. 
Please test it and give feedback here.
I had to account for the fact that the stylesheet might not be loaded when
setClientOutput() is called.  Also, xul menus don't seem to be styleable
anymore.  Not sure why.  I've commented out the code that attempted to do so,
for now.

output-default.css redefined a few highlights that are already present in
TB4480689G. No go. Crash on exit. Chatzilla 0.8.7-pre1 [Mozilla/5.0 (Macintosh;
U; PPC; en-US; rv:0.9.9+) Gecko/20020325].

Also, as to functionality, clicking on a person's comment nick, rather than
comment text does not seem to work, and I can't highlight my own comments.
Not being able to highlight your own messages is a known limitation, we'll have
to work that out later.
Attached file another talkback
I just crashed closing the chatzilla window.  Here's the talkback.
talkback on Win98 - TB4516008H
ssieb's talkback just says...
Product: Core → Other Applications
QA Contact: samuel → chatzilla
You need to log in before you can comment on or make changes to this bug.