92673 - Crash deleting multiple messages in message window - N610 [@ nsOutlinerRange::Count]

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Message Display, defect)

Description

[yulian chang]

Using 2001072623-0.9.2 Linux build

Deleting multiple messages crashed N6.1 on Linux platform.

60% reproducible:
1. select multiple messages in message window
2. Click Delete toolbar
3. Crash!

Talkback reports were sumitted several times.

Comment 1

[lchiang]

Are you on IMAP or POP?  Is it crashing when you delete or when the next
messages tries to display?

Comment 2

[lchiang]

Yulian - can you look up the Talkback IDs you submitted and paste the stack
trace here?  If you don't know how to look it up, email anyone on the mail team.
 Thanks.

Comment 3

[Karen Huang]

I get the Stack Trace from yulian's Talk Back report:

Incident ID 33432213 
 
Stack Trace

nsOutlinerRange::Count() 
nsOutlinerRange::Count() 
nsOutlinerRange::Count() 
nsOutlinerSelection::GetCount() 
nsMsgDBView::GetNumSelected() 
nsMsgDBView::SelectionChanged() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_CallMethod() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
JS_CallFunctionValue() 
nsJSContext::CallEventHandler() 
nsJSEventListener::HandleEvent() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
nsOutlinerSelection::FireOnSelectHandler() 
nsOutlinerSelection::AdjustSelection() 
nsOutlinerBodyFrame::RowCountChanged() 
nsOutlinerBoxObject::RowCountChanged() 
nsMsgDBView::NoteChange() 
nsMsgDBView::RemoveByIndex() 
nsMsgThreadedDBView::RemoveByIndex() 
nsMsgDBView::OnKeyDeleted() 
nsMsgDatabase::NotifyKeyDeletedAll() 
nsMsgDatabase::DeleteHeader() 
nsMsgDatabase::DeleteMessages() 
nsImapMailDatabase::DeleteMessages() 
nsImapMailFolder::OnStopRunningUrl() 
nsUrlListenerManager::BroadcastChange() 
nsUrlListenerManager::OnStopRunningUrl() 
nsMsgMailNewsUrl::SetUrlState() 
nsImapMailFolder::SetUrlState() 
SetUrlStateProxyEvent::HandleEvent() 
nsImapEvent::imap_event_handler() 
PL_HandleEvent() 
PL_ProcessPendingEvents() 
nsEventQueueImpl::ProcessPendingEvents() 
event_processor_callback() 
our_gdk_io_invoke() 
libglib-1.2.so.0 + 0x101a0 (0x403591a0) 
libglib-1.2.so.0 + 0x11987 (0x4035a987) 
libglib-1.2.so.0 + 0x12001 (0x4035b001) 
libglib-1.2.so.0 + 0x121cc (0x4035b1cc) 
libgtk-1.2.so.0 + 0x93e57 (0x40271e57) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x1bb65 (0x40492b65) 

Comment 4

[Jay Patel [:jay]]

This is showing up in the Talkback reports for the final N610 candidate builds.
 Since there are only 4 crashes reported (probably by the same person), this is
far from being a topcrasher, but I just wanted to add N610 [@
nsOutlinerRange::Count] to the summary in case we start seeing more of these
crashes after the release.

Comment 5

[yulian chang]

2001-08-01-06-trunk wins build.

I was able to reproduce this problem on NT platform.
Stack trace from talk back report as following:

Incident ID 33601592
Stack Signature nsOutlinerRange::Count ada9be61
Bug ID
Trigger Time 2001-08-01 11:35:10
User Comments deleting eight messages all together in msg window on Nt Platform
Build ID 2001080106
Product ID MozillaTrunk
Platform ID Win32
Stack Trace
nsOutlinerRange::Count
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerSelection.cpp,
line 191]
nsOutlinerRange::Count
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerSelection.cpp,
line 193]
nsOutlinerRange::Count
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerSelection.cpp,
line 193]
nsOutlinerRange::Count
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerSelection.cpp,
line 193]
nsOutlinerSelection::GetCount
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerSelection.cpp,
line 521]
nsMsgDBView::GetNumSelected
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgDBView.cpp, line 4230]
nsMsgDBView::SelectionChanged
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgDBView.cpp, line 592]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 139]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1884]
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1253]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2698]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3351]
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 949]
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140]
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1162]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1765]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3645]
nsOutlinerSelection::FireOnSelectHandler
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerSelection.cpp,
line 708]
nsOutlinerSelection::AdjustSelection
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerSelection.cpp,
line 667]
nsOutlinerBodyFrame::RowCountChanged
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerBodyFrame.cpp,
line 1160]
nsOutlinerBoxObject::RowCountChanged
[d:\builds\seamonkey\mozilla\layout\xul\base\src\outliner\src\nsOutlinerBoxObject.cpp,
line 346]
nsMsgDBView::NoteChange
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgDBView.cpp, line 3487]
nsMsgDBView::RemoveByIndex
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgDBView.cpp, line 1546]
nsMsgThreadedDBView::RemoveByIndex
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgThreadedDBView.cpp, line 554]
nsMsgDBView::OnKeyDeleted
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsMsgDBView.cpp, line 3409]
nsMsgDatabase::NotifyKeyDeletedAll
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgDatabase.cpp, line 428]
nsMsgDatabase::DeleteHeader
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgDatabase.cpp, line 1445]
nsMsgDatabase::DeleteMessages
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsMsgDatabase.cpp, line 1387]
nsImapMailDatabase::DeleteMessages
[d:\builds\seamonkey\mozilla\mailnews\db\msgdb\src\nsImapMailDatabase.cpp, line 183]
nsImapMailFolder::OnStopRunningUrl
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 3850]
nsUrlListenerManager::BroadcastChange
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsUrlListenerManager.cpp, line 84]
nsUrlListenerManager::OnStopRunningUrl
[d:\builds\seamonkey\mozilla\mailnews\base\src\nsUrlListenerManager.cpp, line 113]
nsMsgMailNewsUrl::SetUrlState
[d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgMailNewsUrl.cpp, line 114]
nsImapMailFolder::SetUrlState
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapMailFolder.cpp, line 4585]
SetUrlStateProxyEvent::HandleEvent
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapProxyEvent.cpp, line 1314]
nsImapEvent::imap_event_handler
[d:\builds\seamonkey\mozilla\mailnews\imap\src\nsImapProxyEvent.cpp, line 76]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
0x00170003 

Comment 6

[Håkan Waara]

I can't reproduce this, I tried both by hitting the delete toolbar button and
the Delete button on the keyboard.

Yulian, is anyone else besides you able to reproduce it?  Is it possible you can
find out more precise reproducible steps?

Comment 7

[grylchan]

Yulian said to do this:
1.Select a message
2.Hold down both Ctrl and shift key
3.Select another message (so group of messages are selected)
4.Let go of both Ctrl and Shift key
5.Hit delete button.
6.Crash occurs

My talk back url (which is same stack trace as pasted in the bug)
http://climate.mcom.com/reports/incidenttemplate.cfm?bbid=34053288

Comment 8

[yulian chang]

I found the exact way to reproduce this bug.

1. In Msg window, select one msg
2. Press Shift and Ctrl key to choose a couple more Msgs
3. Click Delete button on the toolbar---crash

I've seen this happen on Gary's and Srilatha's Win NT machines.

Comment 9

[(not reading, please use [e-mail] instead)]

I'm able to reproduce this.  accepting.  

Comment 10

[greer]

30 crashes in today's data. Adding topcrash so the reports can track this one.

Comment 11

[(not reading, please use [e-mail] instead)]

still debugging.  

on a related note, when you hold shift and ctrl in 4.x we act like you only are 
pressing shift.  in 6.x, we seems to behave like both are pressed.

we augment the selection in ctrl click and shift click ways.

Comment 12

[lchiang]

this bug only happens when you select using BOTH shift and ctrl keys at the same
time?

Comment 13

[grylchan]

I believe So Lisa. That was the only way I could
reproduce the crash.

Comment 14

[(not reading, please use [e-mail] instead)]

right, only ctrl and shift.

I talk to hyatt, and we're doing the right thing.  (ctrl shift is behaving like 
it is designed to.)

I'll continue to debug...

Comment 15

[(not reading, please use [e-mail] instead)]

ctrl shift is leaving us with bad ranges.

I've a fix, I'll attach it for hyatt to review.

Comment 16

[(not reading, please use [e-mail] instead)]

Attachment: patch

Comment 17

[(not reading, please use [e-mail] instead)]

*** Bug 90671 has been marked as a duplicate of this bug. ***

Comment 18

[Jan Varga [:janv]]

Looks good to me.
r=varga

Comment 19

[David Hyatt]

sr=hyatt, but please test the heck out of selection.

Comment 20

[(not reading, please use [e-mail] instead)]

fixed.   been running with this for a while in my tree, testing thread pane 
selection.

Comment 21

[Sheela Ravindran]

I was able to reproduce the crash on the 2001-08-13-06 build.
Verified on 2001-08-29-06 linux, mac, win98
I ran a few tests moving, deleting, copying  messages by different 
selection(ctrl, shift, select all menu item, ctrl+A).I did not see any other 
crash or any other problem.