Reproducible: have not tried yet. I had Mozilla (2002050205 trunk, RHLinux 7.3) crash on me today when I was scrolling in the addressee pane of the message compose window. Not sure if this is related to bug 110165 or not. gdb says: (gdb) bt #0 0x40134866 in nsSupportsHashtable::Get () from /usr/lib/libxpcom.so #1 0x41762c31 in nsPresState::GetStatePropertyAsSupports () from /usr/lib/mozilla/components/libgklayout.so #2 0x41718ffc in nsBoxObject::GetPropertyAsSupports () from /usr/lib/mozilla/components/libgklayout.so #3 0x41788c21 in nsTreeBoxObject::GetTreeBody () from /usr/lib/mozilla/components/libgklayout.so #4 0x4178eb46 in nsTreeColFrame::InvalidateColumnCache () from /usr/lib/mozilla/components/libgklayout.so #5 0x4178e460 in nsTreeColFrame::Init () from /usr/lib/mozilla/components/libgklayout.so #6 0x416cfc1e in nsCSSFrameConstructor::InitAndRestoreFrame () from /usr/lib/mozilla/components/libgklayout.so #7 0x416cdb50 in nsCSSFrameConstructor::ConstructXULFrame () from /usr/lib/mozilla/components/libgklayout.so #8 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #9 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from /usr/lib/mozilla/components/libgklayout.so #10 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from /usr/lib/mozilla/components/libgklayout.so #11 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from /usr/lib/mozilla/components/libgklayout.so #12 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #13 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from /usr/lib/mozilla/components/libgklayout.so #14 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from /usr/lib/mozilla/components/libgklayout.so #15 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from /usr/lib/mozilla/components/libgklayout.so #16 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #17 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from /usr/lib/mozilla/components/libgklayout.so #18 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from /usr/lib/mozilla/components/libgklayout.so #19 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from /usr/lib/mozilla/components/libgklayout.so #20 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #21 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from /usr/lib/mozilla/components/libgklayout.so #22 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from /usr/lib/mozilla/components/libgklayout.so #23 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from /usr/lib/mozilla/components/libgklayout.so #24 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #25 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from /usr/lib/mozilla/components/libgklayout.so #26 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from /usr/lib/mozilla/components/libgklayout.so #27 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from /usr/lib/mozilla/components/libgklayout.so #28 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #29 0x416d0a23 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #30 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from /usr/lib/mozilla/components/libgklayout.so #31 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from /usr/lib/mozilla/components/libgklayout.so #32 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from /usr/lib/mozilla/components/libgklayout.so #33 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #34 0x416d07cf in nsCSSFrameConstructor::ConstructFrame () from /usr/lib/mozilla/components/libgklayout.so #35 0x416db7e6 in nsCSSFrameConstructor::ProcessChildren () from /usr/lib/mozilla/components/libgklayout.so #36 0x416cdc29 in nsCSSFrameConstructor::ConstructXULFrame () from /usr/lib/mozilla/components/libgklayout.so #37 0x416d0bf0 in nsCSSFrameConstructor::ConstructFrameInternal () from /usr/lib/mozilla/components/libgklayout.so #38 0x416dd13c in nsCSSFrameConstructor::CreateListBoxContent () from /usr/lib/mozilla/components/libgklayout.so #39 0x41754958 in nsListBoxBodyFrame::GetNextItemBox () from /usr/lib/mozilla/components/libgklayout.so #40 0x41754210 in nsListBoxBodyFrame::CreateRows () from /usr/lib/mozilla/components/libgklayout.so #41 0x41752980 in nsListBoxBodyFrame::ReflowFinished () from /usr/lib/mozilla/components/libgklayout.so #42 0x41680410 in PresShell::HandlePostedReflowCallbacks () from /usr/lib/mozilla/components/libgklayout.so #43 0x4168255d in PresShell::ProcessReflowCommands () from /usr/lib/mozilla/components/libgklayout.so #44 0x41680706 in PresShell::FlushPendingNotifications () from /usr/lib/mozilla/components/libgklayout.so #45 0x41753f05 in nsListBoxBodyFrame::InternalPositionChanged () from /usr/lib/mozilla/components/libgklayout.so #46 0x417528a8 in nsListBoxBodyFrame::PositionChanged () from /usr/lib/mozilla/components/libgklayout.so #47 0x41736c82 in nsSliderFrame::SetCurrentPosition () from /usr/lib/mozilla/components/libgklayout.so #48 0x41736336 in nsSliderFrame::HandleEvent () from /usr/lib/mozilla/components/libgklayout.so #49 0x41681e21 in PresShell::HandleEventInternal () from /usr/lib/mozilla/components/libgklayout.so #50 0x41681be9 in PresShell::HandleEvent () from /usr/lib/mozilla/components/libgklayout.so #51 0x41815b1c in nsViewManager::HandleEvent () from /usr/lib/mozilla/components/libgkview.so #52 0x4180ae57 in nsView::HandleEvent () from /usr/lib/mozilla/components/libgkview.so #53 0x4181517a in nsViewManager::DispatchEvent () from /usr/lib/mozilla/components/libgkview.so #54 0x4180a942 in HandleEvent () from /usr/lib/mozilla/components/libgkview.so #55 0x4069cb41 in nsWidget::DispatchEvent () from /usr/lib/mozilla/components/libwidget_gtk.so #56 0x4069ca37 in nsWidget::DispatchWindowEvent () from /usr/lib/mozilla/components/libwidget_gtk.so #57 0x4069cbcf in nsWidget::DispatchMouseEvent () from /usr/lib/mozilla/components/libwidget_gtk.so #58 0x4069d040 in nsWidget::OnMotionNotifySignal () from /usr/lib/mozilla/components/libwidget_gtk.so #59 0x406a0b13 in nsWindow::OnMotionNotifySignal () from /usr/lib/mozilla/components/libwidget_gtk.so #60 0x406a0fad in nsWindow::HandleGDKEvent () from /usr/lib/mozilla/components/libwidget_gtk.so #61 0x4069739a in dispatch_superwin_event () from /usr/lib/mozilla/components/libwidget_gtk.so #62 0x4069716f in handle_gdk_event () from /usr/lib/mozilla/components/libwidget_gtk.so #63 0x40378d6f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0 #64 0x403aa773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0 #65 0x403aad39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0 #66 0x403aaeec in g_main_run () from /usr/lib/libglib-1.2.so.0 #67 0x402c72e3 in gtk_main () from /usr/lib/libgtk-1.2.so.0 #68 0x4068fb69 in nsAppShell::Run () from /usr/lib/mozilla/components/libwidget_gtk.so #69 0x4066eba2 in nsAppShellService::Run () from /usr/lib/mozilla/components/libnsappshell.so #70 0x08053475 in getCountry () #71 0x08053dbb in main () #72 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6

i will research it

This crash just ate my mail message! :( Nominating nsbeta1 Here's my talkback: http://climate.mcom.com/reports/SingleIncidentInfo.cfm?dynamicBBID=6077192

i really can not reproduce this bug,my build is 2002/05/08 on windows2000

Reproduced with 2002050806/Win2k. My talkback ID is TB6212471M.

-->varada

Can someone who is able to reproduce this bug please post the steps to do so.

esther, are you able to reproduce this?

This signature is showing up in the topcrash reports for M1RC2. Marking "topcrash".

Attached are comments from users crashing at this signature on the Trunk and M1RC2 to help find a reproducible case. There are a number of comments that point to crashes related to print preview. That would indicate that this is not a Mail/News bug specifically.

I went thru all the talkback reports but unfortunately I am not able to reproduce this problem - neither on the release builds nor on my debug builds. Can anyone reproduce this all the time and if so I would like to see it on their machine.

*** Bug 148215 has been marked as a duplicate of this bug. ***

I have been able to reproduce this crash with builds back to 2002042421, but not 2002042221. steps to reproduce is to simply fill in a bunch of cc fields and scroll -- I can't get it to happen all the time. Also, if it doesn't crash on scrolling, more scrolling probably won't make it crash. Add or change fields and try scrolling again. I tried saving-as-draft something that crashed when I scrolled, but the draft did not crash when I did edit-as-new.

Reassigning to xpapps to assign to appropriate person. (hyatt, hewitt?)

->hewitt. ADT1, since this continues to show up on recent builds. We should at least try to wallpaper/bulletproof this.

I just triggered this on the talkback linux 1.0 final build, and submitted it.. Used a longish list of bcc's and scrolled up real fast, blammo...

hewitt is fairly doomed for machv. I'll take this one.

This stack has line numbers.

The problem is that sometimes when TreeBodyFrames are deleted, they don't get removed from the BoxObject/PresState property hashtable. This can happen if we have never needed to access the BoxObject from the BodyFrame. Then, when the "treebody" property is fetched later, we crash trying to addref the deleted object. Fix is simply to call EnsureBoxObject from nsTreeBodyFrame::Destroy, to make absolutely sure we remove ourself from the property table.

Comment on attachment 86916 [details] [diff] [review] patch sr=jag

Ok, that patch causes a crash closing the mail compose window. I bulletproofed EnsureBoxObject a bit to handle the case where it's called and there's no document around (as will happen during window teardown).

Comment on attachment 86918 [details] [diff] [review] patch #2 carrying over sr=jag (he said it was ok)

Comment on attachment 86918 [details] [diff] [review] patch #2 r=ben@netscape.com

Comment on attachment 86918 [details] [diff] [review] patch #2 a=asa (on behalf of drivers) for checkin to the 1.1 trunk.

Checked into the trunk. I'll let it bake there a couple of days before requesting 1.0 branch approval.

Actually, this should be pretty safe. Nominating for branch approval.

esther - can you pls verify this on the trunk as fixed? thanks!

adding adt1.0.1+. Please get drivers approval for the branch before checking in.

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+" keyword and add the "fixed1.0.1" keyword.

Checked into the 1.0.1 branch.

Sorry, I can't verify what I can reproduce. Hopefully the reporter and others who experienced this can verify they don't see it with a build that has the fix. Also, if the talkback reports stop with build that include the fix then we can use that info to to verify this. Need time for this feedback to determine if it's fixed.

When trying to reproduce this, it's important to drag slow enough so that the scroll smoother doesn't kick in. (When the scroll smoother kicks in, it will stop updating the display until you let go of the scrollbar thumb). This worked reliably for me to reproduce it: - Enter several recipients (say, 7 or so). I made the first one a To recipient and the rest Cc:, but I'm not convinced that it matters. - You should now be at the bottom of the list. Drag the scrollbar slowly up to the top. - Now start dragging the scrollbar down again, slowly. This reproduced the crash for me quite nicely.

thanks for the additional info Brian, I was able to crash with a 6-10 build before the fix, but I could only crash once. I will try to crash again, but after trying again I can't. I will test this on a fixed build as soon as I can get better at crashing this (hopefully within the hour).

I found a Mail 100% reproducible case confirming the bug on linux, mac and win and can now verify the fix. Reproducible case. 1. Launch mail 2. Open a Compose window 3. For ease of testing I will use "one" through "ten" in addressing field): Address the 1st recipient "one" (let it autocomplete with domain or finish the address). Address 2nd address changing the field to CC, type in "two" let it autocomplete. Continue with cc's using "three" through "ten". You will have 10 addresses now. 3. Using the scroll grabber, scroll to the top of the addressing list. 4. Click and drag over the 4th address and hit backspace, Click and hold over the third address and hit backspace. You should have 2 blank lines where these 2 addresses were. 5. Using the scroll grabber, scroll down to the bottom and then back up to the top again. This is where I crash with the same talkback info on all 4 platforms. Now-Using branch build 20020614 on winxp, linux and mac 9.1 and os10.1 this doesn't crash anymore. Verified

Note, this was also verified fixed on trunk builds 20020613 on winxp, mac 9.1 mac os10.1 and linux.

Just for the records. Adding marking topcrash+ and adding testcase keyword.