96282 - mailNews crashes on startup and via icon - Trunk [@ nsOutlinerRows::Find][@ nsAssignmentSet::GetAssignmentFor]

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect)

Description

[Arthur]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i586; en-US; rv:0.9.3+) Gecko/20010821
BuildID:    2001082108

If I start ./mozilla -news, mozilla crashes after displaying almost the whole
MailNews window. Crashes also when choosing the mail icon next to the statusbar
to start MailNews. Didn't try something else.

Reproducible: Always
Steps to Reproduce:
1. ./mozilla -mail
2. wait
3. watch it crash

Actual Results:  Crash :(

Expected Results:  No Crash :)

Will attach TalkBackID after posting this bug. Ehm, and no.. I didn't try
removing my old profile..

Comment 1

[Arthur]

TalkBack ID TB34331002Q

Offtopic:

Should I let TalkBack send several CrashReports on the same bug (while trying to
reproduce a crash) or is this annoying and doesn't give additional information?

What a fishy nightly, not even backspace and return keys work...
 

Comment 2

[Chase Tingley]

*** Bug 96283 has been marked as a duplicate of this bug. ***

Comment 3

[Chase Tingley]

Confirming based on dup.  Stacktrace from bug 98283:

Build #2001082108Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 7913)]
0x00b97414 in NSGetModule () from /usr/src/mozilla/components/libgkcontent.so

(gdb) 

#0  0x00b97414 in NSGetModule () from /usr/src/mozilla/components/libgkcontent.so
#1  0x00ba52b2 in NSGetModule () from /usr/src/mozilla/components/libgkcontent.so
#2  0x0024a971 in XPTC_InvokeByIndex () at eval.c:41
#3  0x00826869 in NSGetModule () from /usr/src/mozilla/components/libxpconnect.so
#4  0x0082c075 in NSGetModule () from /usr/src/mozilla/components/libxpconnect.so
#5  0x0016f985 in js_Invoke () at eval.c:41   
#6  0x00176e73 in js_Interpret () at eval.c:41
#7  0x0016fdc1 in js_Execute () at eval.c:41
#8  0x00153f65 in JS_EvaluateUCScriptForPrincipals () at eval.c:41
#9  0x00d7f7a3 in NSGetModule () from /usr/src/mozilla/components/libjsdom.so
#10 0x00d8cf8a in NSGetModule () from /usr/src/mozilla/components/libjsdom.so
#11 0x00d8d663 in NSGetModule () from /usr/src/mozilla/components/libjsdom.so
#12 0x00f0a212 in STREAMBUFSIZE () from /usr/src/mozilla/components/libtimer_gtk.so
#13 0x00f0a3dd in STREAMBUFSIZE () from /usr/src/mozilla/components/libtimer_gtk.so
#14 0x00f0a489 in STREAMBUFSIZE () from /usr/src/mozilla/components/libtimer_gtk.so
#15 0x004a1941 in g_timeout_dispatch () from /usr/local/lib/libglib-1.2.so.0
#16 0x004a01ce in g_main_dispatch () from /usr/local/lib/libglib-1.2.so.0
#17 0x004a04f2 in g_main_iterate () from /usr/local/lib/libglib-1.2.so.0
#18 0x004a12e4 in g_main_run () from /usr/local/lib/libglib-1.2.so.0
#19 0x003a0c37 in gtk_main () from /usr/local/lib/libgtk-1.2.so.0
#20 0x009bc120 in NSGetModule () from /usr/src/mozilla/components/libwidget_gtk.so 
#21 0x0084da8a in NSGetModule () from /usr/src/mozilla/components/libnsappshell.so 
#22 0x08050094 in NS_CreateNativeAppSupport ()
#23 0x08050955 in main ()

Comment 4

[sairuh (rarely reading bugmail)]

odd, i cannot repro this, either by using ./netscape -mail, or clicking the mail
icon in the taskbar of a browser window. using 2001.08.21.08-comm on linux
[rh6.2].

then again, i have multiple profiles. and i'm using a commercial build [not
mozilla]. and i used the non-installer tarball [sea]. not sure if any of those
conditions would affect the results...

Comment 5

[Jacek Piskozub]

I reproduced this crash on two computers (both WindowsME) with:
- 20010821 Win32 "nightly" morning build
- 8/21 17:00 PDT CVS build

Using mail is not possible. Talkback does not notice that crash if it happens
when Mozilla starts.

Comment 6

[Jacek Piskozub]

Changing to All/All.

Comment 7

[Jacek Piskozub]

The call stack during a WindowsME crash:

GKCONTENT! 0175f7f0()
GKCONTENT! 01751b52()
XPCOM! 10033201()
XPC3250! 00bc09f1()
XPC3250! 00bc3e85()
JS3250! 00b4835a()
JS3250! 00b4d1c1()
JS3250! 00b487b1()
JS3250! 00b34677()
JSDOM! 019b2ca4()
JSDOM! 019b9e60()
JSDOM! 019ba296()
APPSHELL! 00be6723()
MOZILLA! 0040121a()
MOZILLA! 00403739()
KERNEL32! bff7b9e4()
KERNEL32! bff7b896()

No Talkback report even with a crash while opening MailNews windows after
starting Navigator.

Comment 8

[Scott MacGregor]

Here's the stack trace from the talkback report:

nsOutlinerRows::Find()
nsXULOutlinerBuilder::GetIndexOfResource()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Execute()
JS_EvaluateUCScriptForPrincipals()
nsJSContext::EvaluateString()
GlobalWindowImpl::RunTimeout()
nsGlobalWindow_RunTimeout()
nsTimerGtk::FireTimeout()
process_timers()
TimerCallbackFunc() 

cc'ing hyatt. 

Comment 9

[(not reading, please use [e-mail] instead)]

this might be related to bug #96298, but i'm sure why we crash.

I'll investigate.

reporters:  do you have mail set up to check mail on startup?

Comment 10

[(not reading, please use [e-mail] instead)]

 I believe. esther was seeing this with "get msg", too.

Comment 11

[Jacek Piskozub]

> reporters:  do you have mail set up to check mail on startup?

I crash both ways.

Comment 12

[Jacek Piskozub]

*** Bug 96368 has been marked as a duplicate of this bug. ***

Comment 13

[Chase Tingley]

*** Bug 96329 has been marked as a duplicate of this bug. ***

Comment 14

[Chase Tingley]

*** Bug 96315 has been marked as a duplicate of this bug. ***

Comment 15

[Bernd]

When you create a new account you can enter once mailnews. Even check your new 
created popup account. On the next launch it crashes. 2001-08-22-03 Win98

Comment 16

[esther]

Note, duplicate bug 96315 crash does not happen with 2001-08-22-06 trunk build.

Comment 17

[Bernd]

*** Bug 96430 has been marked as a duplicate of this bug. ***

Comment 18

[WD]

My normal profile crashes when launching MailNews.  (bug 96430 )
When I created a new profile, this profile doesn't crash.   Even after exiting
Mozilla and re-loading MailNews it doesn't crash.    I have one News account set
up only, though.   My normal profile has a mail and several NNTP accounts.

Comment 19

[Jacek Piskozub]

I still crash with 2001082206. I cannot check with CVS build as Win32 does not
build (seen also on the tinderbox).

Yes, I have several news servers configured.

Talkback# TB34375384M

Comment 20

[WD]

Ok, I just did a test with a new profile:

With just one Newsgroup account and nothing else, MailNews can be exited and
loaded all you want and it will not crash.

I added a Mail account, exited, re-loaded, and bam!  Crash! 

Comment 21

[(not reading, please use [e-mail] instead)]

cool, I have an idea what's going on.  very similar to something I fixed last 
night for "next unread".  (see #96298)

details about the crash coming soon, fix on the way.

Comment 22

[(not reading, please use [e-mail] instead)]

here's how I reproduced this:

have a pop account, set it to check new mail on start up.
close the pop server, so the inbox isn't visible.

exit.  restart.

we crash when we try to find and select the inbox.

testing a fix now.

Comment 23

[(not reading, please use [e-mail] instead)]

Attachment: patch

Comment 24

[David :Bienvenu]

via aim, rs=bienvenu, but we should figure out why the old code broke.

Comment 25

[(not reading, please use [e-mail] instead)]

fixed.

but I'll continue to investigate why the old way doesn't work and more 
importantly why the code in content crashes.  (as this might come up again.)

Comment 26

[(not reading, please use [e-mail] instead)]

Attachment: more related clean of the mailnews js

Comment 27

[(not reading, please use [e-mail] instead)]

that last patch will fix another problem, closing the server and then hitting
get msg from account central will not work.

I'll spin up a new bug for that and attach the patch there for review.

Comment 28

[Blu3]

I just built from current branch and the bug has more annoying properties.  If
you have more than one account (I use IMAP) then the INBOX of additional
accounts stall when you open it.  You can open subfolders just fine but the
INBOX of accounts #2+ stall.

In what is probably related, if you have two accounts and you attempt to delete
the #1 account so #2 becomes #1, mozilla instantly crashes.

Somebody accidently mucked up the underlying support code somewhere methinks :)

Should this be re-opened or a new bug created with the current information?

Comment 29

[Jay Patel [:jay]]

Adding topcrash keyword and  Trunk [@ nsOutlinerRows::Find] to summary for
tracking.  This *was* a topcrash.

Comment 30

[Chase Tingley]

*** Bug 96513 has been marked as a duplicate of this bug. ***

Comment 31

[[e-mail]]

Why does attachment 46761 [details] [diff] [review] say

SelectFolder(folderOutliner, folderResource)

but attachment 46758 [details] says

SelectFolder(startFolder.URI)

Comment 32

[Dawn Endico]

i'm still seeing crash on mail startup. asa says my talkback stack is identical
to the one in this
bug. reopening

Comment 33

[Dawn Endico]

its worth noting that things are somewhat better than yesterday. Yesterday mail
crashed instantly.
Today It lets me type in my password and does't crash until it has done a bit of
work (updating
message counts on folders?)

i'm using redhat 6.1

Comment 34

[lohphat]

It's now working for me.  I can open the window and get mail.
win32 2001082303 on win2ksp2

Comment 35

[Dawn Endico]

it crashes when:
 - start with "mozilla -mail"
 - type password in dialog and enter

it does not crash when:
 - start with "mozilla -mail"
 - press 'cancel' on password dialog
 - wait for message counts on news folders to finish updating. (not sure whether
this step is
    necessary)
 - click on inbox
 - type password in to dialog and enter

Comment 36

[Dawn Endico]

oops, right after i submitted that comment about working around the crash, it
crashed again
with the same stack. I guess this is related to checking for new mail.

Comment 37

[(not reading, please use [e-mail] instead)]

esther mentioned that she could get a similar crash on start up if she entered 
her password (to check mail) and then collapsed the server.  

endico, are you doing that?

I haven't fixed the underlying crash nsOutlinerRows::Find() yet.  so far, I've 
been fixing the mailnews js.

Comment 38

[Dawn Endico]

i don't know what you mean by "collapsed the server", but no, i'm not touching
the screen
after i type in my password.

Comment 39

[(not reading, please use [e-mail] instead)]

if I follow what esther told me:

log in, enter password, while loading inbox collapse server, I also crash.

I'll work on that crasher and see if I can fix the root of the crasher in 
content.

Comment 40

[(not reading, please use [e-mail] instead)]

match is 0xfdfdfdfd, so we crash.

nsOutlinerRows::Find(nsConflictSet & {...}, nsIRDFResource * 0x04a704b0) line 
172 + 13 bytes
nsXULOutlinerBuilder::SynchronizeMatch(nsTemplateMatch * 0x04a78848, const 
VariableSet & {...}) line 1094 + 56 bytes
nsXULTemplateBuilder::SynchronizeAll(nsIRDFResource * 0x04a704b0, 
nsIRDFResource * 0x04793260, nsIRDFNode * 0x00000000, nsIRDFNode * 0x04e3a3d0) 
line 1270
nsXULTemplateBuilder::OnChange(nsXULTemplateBuilder * const 0x0409095c, 
nsIRDFDataSource * 0x04793b80, nsIRDFResource * 0x04a704b0, nsIRDFResource * 
0x04793260, nsIRDFNode * 0x00000000, nsIRDFNode * 0x04e3a3d0) line 688 + 27 
bytes
CompositeDataSourceImpl::OnChange(CompositeDataSourceImpl * const 0x04793b84, 
nsIRDFDataSource * 0x04a2bba0, nsIRDFResource * 0x04a704b0, nsIRDFResource * 
0x04793260, nsIRDFNode * 0x00000000, nsIRDFNode * 0x04e3a3d0) line 1598
nsMsgRDFDataSource::changeEnumFunc(nsISupports * 0x04793b84, void * 0x0012defc) 
line 426
nsSupportsArray::EnumerateForwards(nsSupportsArray * const 0x04a2bb30, int 
(nsISupports *, void *)* 0x02f93d00 nsMsgRDFDataSource::changeEnumFunc
(nsISupports *, void *), void * 0x0012defc) line 669 + 20 bytes
nsMsgRDFDataSource::NotifyObservers(nsIRDFResource * 0x04a704b0, nsIRDFResource 
* 0x04793260, nsIRDFNode * 0x04e3a3d0, int 0, int 1) line 382
nsMsgRDFDataSource::NotifyPropertyChanged(nsIRDFResource * 0x04a704b0, 
nsIRDFResource * 0x04793260, nsIRDFNode * 0x04e3a3d0) line 365
nsMsgFolderDataSource::OnTotalMessagePropertyChanged(nsIMsgFolder * 0x04a704cc, 
int 8, int 22) line 1708
nsMsgFolderDataSource::OnItemIntPropertyChanged(nsMsgFolderDataSource * const 
0x04a2bbd0, nsISupports * 0x04a704b0, nsIAtom * 0x04795e90, int 8, int 22) line 
851
nsMsgMailSession::OnItemIntPropertyChanged(nsMsgMailSession * const 0x047959b4, 
nsISupports * 0x04a704b0, nsIAtom * 0x04795e90, int 8, int 22) line 172
nsMsgFolder::NotifyIntPropertyChanged(nsMsgFolder * const 0x04a704cc, nsIAtom * 
0x04795e90, int 8, int 22) line 2317
nsImapMailFolder::UpdateSummaryTotals(nsImapMailFolder * const 0x04a704cc, int 
1) line 1393
nsMsgDBFolder::EndFolderLoading(nsMsgDBFolder * const 0x04a704cc) line 167
XPTC_InvokeByIndex(nsISupports * 0x04a704cc, unsigned int 41, unsigned int 0, 
nsXPTCVariant * 0x0012e1ec) line 139
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
CALL_METHOD) line 1884 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x026fa430, JSObject * 0x03c2bba8, unsigned int 
0, long * 0x03d46f64, long * 0x0012e424) line 1252 + 14 bytes
js_Invoke(JSContext * 0x026fa430, unsigned int 0, unsigned int 0) line 807 + 23 
bytes
js_Interpret(JSContext * 0x026fa430, long * 0x0012f1c4) line 2697 + 15 bytes
js_Invoke(JSContext * 0x026fa430, unsigned int 2, unsigned int 2) line 824 + 13 
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x04a762c0, 
nsXPCWrappedJS * 0x04a76070, unsigned short 10, const nsXPTMethodInfo * 
0x02dfc08c, nsXPTCMiniVariant * 0x0012f70c) line 1023 + 21 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x04a76070, unsigned short 
10, const nsXPTMethodInfo * 0x02dfc08c, nsXPTCMiniVariant * 0x0012f70c) line 427
PrepareAndDispatch(nsXPTCStubBase * 0x04a76070, unsigned int 10, unsigned int * 
0x0012f7bc, unsigned int * 0x0012f7ac) line 100 + 31 bytes
SharedStub() line 124
nsMsgMailSession::OnItemEvent(nsMsgMailSession * const 0x047959b4, nsIFolder * 
0x04a704cc, nsIAtom * 0x04a2e8f0) line 298
nsMsgFolder::NotifyFolderEvent(nsMsgFolder * const 0x04a704cc, nsIAtom * 
0x04a2e8f0) line 2437
nsMsgDBFolder::OnStopRunningUrl(nsMsgDBFolder * const 0x04a70544, nsIURI * 
0x04dcf5e4, unsigned int 0) line 1138
nsImapMailFolder::OnStopRunningUrl(nsImapMailFolder * const 0x04a70544, nsIURI 
* 0x04dcf5e4, unsigned int 0) line 4016 + 18 bytes
nsUrlListenerManager::BroadcastChange(nsIURI * 0x04dcf5e4, nsUrlNotifyType 
nsUrlNotifyStopRunning, unsigned int 0) line 97
nsUrlListenerManager::OnStopRunningUrl(nsUrlListenerManager * const 0x04dcf900, 
nsIMsgMailNewsUrl * 0x04dcf5e4, unsigned int 0) line 110 + 18 bytes
nsMsgMailNewsUrl::SetUrlState(nsMsgMailNewsUrl * const 0x04dcf5e4, int 0, 
unsigned int 0) line 114
nsImapMailFolder::SetUrlState(nsImapMailFolder * const 0x04a7058c, 
nsIImapProtocol * 0x03c60028, nsIMsgMailNewsUrl * 0x04dcf5e4, int 0, unsigned 
int 0) line 4631 + 23 bytes
XPTC_InvokeByIndex(nsISupports * 0x04a7058c, unsigned int 27, unsigned int 4, 
nsXPTCVariant * 0x04e3d8a0) line 139
EventHandler(PLEvent * 0x04e3ec40) line 509 + 41 bytes
PL_HandleEvent(PLEvent * 0x04e3ec40) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x01357900) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x000e023e, unsigned int 49398, unsigned int 0, 
long 20281600) line 1071 + 9 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x013c3950) line 428
main1(int 4, char * * 0x004840d0, nsISupports * 0x00000000) line 1346 + 32 bytes
main(int 4, char * * 0x004840d0) line 1668 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87903()

Comment 41

[(not reading, please use [e-mail] instead)]

I can get a similar crash if I create a new profile, set up my imap account in 
the profile wizard, and collapse the server during folder discovery.

I'll get a stack trace for that.

I think this bug will end up going to waterson.

Comment 42

[(not reading, please use [e-mail] instead)]

doing the imap discovery / server collapse, I first get an assertion:

NTDLL! 77f9f9df()
nsDebug::Assertion(const char * 0x025ce8f0, const char * 0x025ce8d8, const char 
* 0x025ce890, int 1096) line 290 + 13 bytes
nsXULOutlinerBuilder::SynchronizeMatch(nsTemplateMatch * 0x0551d990, const 
VariableSet & {...}) line 1096 + 66 bytes
nsXULTemplateBuilder::SynchronizeAll(nsIRDFResource * 0x054e21e0, 
nsIRDFResource * 0x046ea1f0, nsIRDFNode * 0x00000000, nsIRDFNode * 0x01301a00) 
line 1270
nsXULTemplateBuilder::OnChange(nsXULTemplateBuilder * const 0x03fdd11c, 
nsIRDFDataSource * 0x046eadb0, nsIRDFResource * 0x054e21e0, nsIRDFResource * 
0x046ea1f0, nsIRDFNode * 0x00000000, nsIRDFNode * 0x01301a00) line 688 + 27 
bytes
CompositeDataSourceImpl::OnChange(CompositeDataSourceImpl * const 0x046eadb4, 
nsIRDFDataSource * 0x04a82f10, nsIRDFResource * 0x054e21e0, nsIRDFResource * 
0x046ea1f0, nsIRDFNode * 0x00000000, nsIRDFNode * 0x01301a00) line 1598
nsMsgRDFDataSource::changeEnumFunc(nsISupports * 0x046eadb4, void * 0x0012def4) 
line 426
nsSupportsArray::EnumerateForwards(nsSupportsArray * const 0x04a82ea0, int 
(nsISupports *, void *)* 0x02ee3d00 nsMsgRDFDataSource::changeEnumFunc
(nsISupports *, void *), void * 0x0012def4) line 669 + 20 bytes
nsMsgRDFDataSource::NotifyObservers(nsIRDFResource * 0x054e21e0, nsIRDFResource 
* 0x046ea1f0, nsIRDFNode * 0x01301a00, int 0, int 1) line 382
nsMsgRDFDataSource::NotifyPropertyChanged(nsIRDFResource * 0x054e21e0, 
nsIRDFResource * 0x046ea1f0, nsIRDFNode * 0x01301a00) line 365
nsMsgFolderDataSource::OnUnreadMessagePropertyChanged(nsIMsgFolder * 
0x054e21fc, int 0, int 2) line 1588
nsMsgFolderDataSource::OnItemIntPropertyChanged(nsMsgFolderDataSource * const 
0x04a82f40, nsISupports * 0x054e21e0, nsIAtom * 0x046eb050, int 0, int 2) line 
857
nsMsgMailSession::OnItemIntPropertyChanged(nsMsgMailSession * const 0x046ecbf4, 
nsISupports * 0x054e21e0, nsIAtom * 0x046eb050, int 0, int 2) line 172
nsMsgFolder::NotifyIntPropertyChanged(nsMsgFolder * const 0x054e21fc, nsIAtom * 
0x046eb050, int 0, int 2) line 2317
nsImapMailFolder::UpdateSummaryTotals(nsImapMailFolder * const 0x054e21fc, int 
1) line 1398
nsMsgDBFolder::EndFolderLoading(nsMsgDBFolder * const 0x054e21fc) line 167
XPTC_InvokeByIndex(nsISupports * 0x054e21fc, unsigned int 41, unsigned int 0, 
nsXPTCVariant * 0x0012e1ec) line 139
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
CALL_METHOD) line 1884 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x027a7110, JSObject * 0x0424c028, unsigned int 
0, long * 0x042c8a6c, long * 0x0012e424) line 1252 + 14 bytes
js_Invoke(JSContext * 0x027a7110, unsigned int 0, unsigned int 0) line 807 + 23 
bytes
js_Interpret(JSContext * 0x027a7110, long * 0x0012f1c4) line 2697 + 15 bytes
js_Invoke(JSContext * 0x027a7110, unsigned int 2, unsigned int 2) line 824 + 13 
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x04aa81d0, 
nsXPCWrappedJS * 0x04aa8170, unsigned short 10, const nsXPTMethodInfo * 
0x02cdff34, nsXPTCMiniVariant * 0x0012f70c) line 1023 + 21 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x04aa8170, unsigned short 
10, const nsXPTMethodInfo * 0x02cdff34, nsXPTCMiniVariant * 0x0012f70c) line 427
PrepareAndDispatch(nsXPTCStubBase * 0x04aa8170, unsigned int 10, unsigned int * 
0x0012f7bc, unsigned int * 0x0012f7ac) line 100 + 31 bytes
SharedStub() line 124
nsMsgMailSession::OnItemEvent(nsMsgMailSession * const 0x046ecbf4, nsIFolder * 
0x054e21fc, nsIAtom * 0x054cd870) line 298
nsMsgFolder::NotifyFolderEvent(nsMsgFolder * const 0x054e21fc, nsIAtom * 
0x054cd870) line 2437
nsMsgDBFolder::OnStopRunningUrl(nsMsgDBFolder * const 0x054e2274, nsIURI * 
0x04e37dc4, unsigned int 0) line 1138
nsImapMailFolder::OnStopRunningUrl(nsImapMailFolder * const 0x054e2274, nsIURI 
* 0x04e37dc4, unsigned int 0) line 4016 + 18 bytes
nsUrlListenerManager::BroadcastChange(nsIURI * 0x04e37dc4, nsUrlNotifyType 
nsUrlNotifyStopRunning, unsigned int 0) line 97
nsUrlListenerManager::OnStopRunningUrl(nsUrlListenerManager * const 0x04e37cb0, 
nsIMsgMailNewsUrl * 0x04e37dc4, unsigned int 0) line 110 + 18 bytes
nsMsgMailNewsUrl::SetUrlState(nsMsgMailNewsUrl * const 0x04e37dc4, int 0, 
unsigned int 0) line 114
nsImapMailFolder::SetUrlState(nsImapMailFolder * const 0x054e22bc, 
nsIImapProtocol * 0x02d136f8, nsIMsgMailNewsUrl * 0x04e37dc4, int 0, unsigned 
int 0) line 4631 + 23 bytes
XPTC_InvokeByIndex(nsISupports * 0x054e22bc, unsigned int 27, unsigned int 4, 
nsXPTCVariant * 0x0556c7f0) line 139
EventHandler(PLEvent * 0x0556a330) line 509 + 41 bytes
PL_HandleEvent(PLEvent * 0x0556a330) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x01247900) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0012016c, unsigned int 49398, unsigned int 0, 
long 19167488) line 1071 + 9 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x012b3950) line 428
main1(int 4, char * * 0x004840d0, nsISupports * 0x00000000) line 1346 + 32 bytes
main(int 4, char * * 0x004840d0) line 1668 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87903()

I think I might have something to help, but there is still crashers lurking.

Comment 43

[(not reading, please use [e-mail] instead)]

Attachment: makes the imap discovery crash go away (now it asserts instead), but I'm sure there is more to this.

Comment 44

[(not reading, please use [e-mail] instead)]

here's my lame summary for what I think is going on:

we get assertions (in this case from the folder datasource) but the rows are 
gone (because the server has been collapsed) and we don't handle those 
assertions properly.

Comment 45

[Chris Waterson]

This is almost certainly something wrong with rdfliner. Taking...

Comment 46

[Chris Waterson]

Attachment: fix; be sure to check subtree count when building Last()

Comment 47

[Chris Waterson]

The problem is with nsOutlinerRows::Last(), which constructs an iterator object
that points ``one past'' the last element in the outliner's hierarchy.
Specifically, when building up the termination condition, we need to check that
a subtree is non-empty before pushing it onto the iterator's path.

Comment 48

[Jan Varga [:janv]]

r=varga

Comment 49

[kinmoz]

sr=[e-mail]

Comment 50

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

a=dbaron (on behalf of drivers)

Comment 51

[David Hyatt]

sr=hyatt

Comment 52

[Chris Waterson]

Fix checked in.

Comment 53

[Jay Patel [:jay]]

I'm going to mark bug 96533 a dup of this one, so adding [@
nsAssignmentSet::GetAssignmentFor] to the summary for tracking that topcrash as
well.

Comment 54

[Jay Patel [:jay]]

*** Bug 96533 has been marked as a duplicate of this bug. ***

Comment 55

[Jan Carpenter]

The latest trunk build ID for this stack sig is: 2001082409 (same day the fix 
was checked in.)

Marking verified.

Comment 56

[Keyser Sose]

*** Bug 93225 has been marked as a duplicate of this bug. ***