Using a debug build from September 30 on Windows NT 4.0 1) Open apprunner 2) Open messenger 3) Click on IMAP account 4) As folders start appearing, scroll to get to the bottom then the top 5) Crash: Unhandled exception in apprunner.exe (RDF.DLL) 0xC0000005 Access Violation This bug could be related to 14337 but the trace is different so I closed it and have open this as a new bug XULDocumentImpl::AttributeChanged(XULDocumentImpl * const 0x0309f750, nsIContent * 0x03cce7b0, nsIAtom * 0x00d83970, int -1) line 2219 + 24 bytes RDFElementImpl::SetAttribute(RDFElementImpl * const 0x03cce7b0, int 0, nsIAtom * 0x00d83970, const nsString & {...}, int 1) line 2443 nsSliderFrame::SetCurrentPosition(nsIContent * 0x03cce7b0, nsIFrame * 0x03cb4600, int 0) line 628 + 42 bytes nsSliderFrame::HandleEvent(nsSliderFrame * const 0x03cb15e0, nsIPresContext & {...}, nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eIgnore) line 490 PresShell::HandleEvent(PresShell * const 0x03070f14, nsIView * 0x03cb1070, nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eIgnore) line 2086 + 38 bytes nsView::HandleEvent(nsView * const 0x03cb1070, nsGUIEvent * 0x0012fbc8, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 828 nsViewManager::DispatchEvent(nsViewManager * const 0x030707b0, nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eIgnore) line 1664 HandleEvent(nsGUIEvent * 0x0012fbc8) line 63 nsWindow::DispatchEvent(nsWindow * const 0x03074d74, nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eIgnore) line 341 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbc8) line 362 nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3239 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3457 nsWindow::ProcessMessage(unsigned int 512, unsigned int 1, long 5374147, long * 0x0012fde8) line 2455 + 24 bytes nsWindow::WindowProc(HWND__ * 0x00020758, unsigned int 512, unsigned int 1, long 5374147) line 462 + 27 bytes USER32! DispatchMessageWorker@8 + 135 bytes USER32! DispatchMessageA@4 + 11 bytes nsAppShell::Run() line 74 nsAppShellService::Run(nsAppShellService * const 0x00d0ef40) line 462 main1(int 1, char * * 0x00ca4c70) line 591 + 12 bytes main(int 1, char * * 0x00ca4c70) line 702 + 13 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! BaseProcessStart@4 + 64 bytes

Made ppandit QA contact Made putterman Assigned developer

I used today's commercial 10-04-10-M11 build on Win98 & WinNT platforms and got the same problems.

Par, I checked in a fix for 15479 which had a similar problem but a different stack trace. When you pull again, can you see if this still happens. Maybe they were the same bug.

Failed by retesting on 10-07-09-M11 build/Win98 platform. Please see the similar bug#15479 for more information. So, I will leave this bug same status until developer decide duplicate bug or not.

I get a similar stack trace in a bookmark crash today (Build from CVS 1999-10-08)

The bookmark crash is bug http://bugzilla.mozilla.org/show_bug.cgi?id=15790, I think. May be all related.

15790 and this bug are not related. The stack traces are pretty different. However, fixing my crash had to do with making sure the tree was constrained within a div. I only did this for the 3pane and Paul did this for the address book. Perhaps this needs to be done for bookmarks?

No, bug 15790 is not what I got. I reproduced this by opening and closing some bookmark folders over and over again. The stack trace was: XULDocumentImpl::AttributeChanged(XULDocumentImpl * const 0x026967b0, nsIContent * 0x027f5070, nsIAtom * 0x01071ab0, int -1) line 1766 + 24 bytes RDFElementImpl::SetAttribute(RDFElementImpl * const 0x027f5070, int 0, nsIAtom * 0x01071ab0, const nsString & {...}, int 1) line 2465 nsSliderFrame::SetCurrentPosition(nsIContent * 0x027f5070, nsIFrame * 0x027f33f0, int 0) line 628 + 40 bytes nsSliderFrame::HandleEvent(nsSliderFrame * const 0x027f55e0, nsIPresContext & {...}, nsGUIEvent * 0x0012fbd0, nsEventStatus & nsEventStatus_eIgnore) line 490 PresShell::HandleEvent(PresShell * const 0x02676264, nsIView * 0x027f5550, nsGUIEvent * 0x0012fbd0, nsEventStatus & nsEventStatus_eIgnore) line 2110 + 38 bytes nsView::HandleEvent(nsView * const 0x027f5550, nsGUIEvent * 0x0012fbd0, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834 nsViewManager::DispatchEvent(nsViewManager * const 0x02677660, nsGUIEvent * 0x0012fbd0, nsEventStatus & nsEventStatus_eIgnore) line 1673 HandleEvent(nsGUIEvent * 0x0012fbd0) line 63 nsWindow::DispatchEvent(nsWindow * const 0x02676034, nsGUIEvent * 0x0012fbd0, nsEventStatus & nsEventStatus_eIgnore) line 342 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbd0) line 363 nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3313 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3531 nsWindow::ProcessMessage(unsigned int 512, unsigned int 1, long 11207176, long * 0x0012fdf4) line 2529 + 24 bytes nsWindow::WindowProc(HWND__ * 0x000f0e70, unsigned int 512, unsigned int 1, long 11207176) line 520 + 27 bytes USER32! 77e71820()

Well, I just saw this crash. It happened while scrolling down. Trees in general seem to be pretty messed up this morning. I never saw this before this morning.

By the way, I get "nsBlockReflowContext: Box@01F16A68 didn't set max-element-size!" messages on the console when opening/closing bookmarks. Don't know if it's related though.

is this still being seen?

I still get an crash/assertion while playing around with the scrollbar but it's a different stack trace. NS_ASSERTION(mContent, "nsGenericElement: Nothing to release!"); nsDebug::Assertion(const char * 0x019679a8, const char * 0x0196799c, const char * 0x01967964, int 1229) line 280 + 13 bytes nsGenericElement::Release(nsGenericElement * const 0x0365e0b8) line 1229 + 35 bytes nsJSUtils::nsGenericResolve(JSContext * 0x0357d280, JSObject * 0x02322f28, long 15405796) line 556 + 12 bytes ResolveElement(JSContext * 0x0357d280, JSObject * 0x02322f28, long 15405796) line 165 + 17 bytes _js_LookupProperty(JSContext * 0x0357d280, JSObject * 0x02322f28, long 28455968, JSObject * * 0x0012e948, JSProperty * * 0x0012e940, const char * 0x003348fc, unsigned int 1805) line 1643 + 24 bytes js_GetProperty(JSContext * 0x0357d280, JSObject * 0x02322f28, long 28455968, long * 0x0012efdc) line 1805 + 35 bytes js_Interpret(JSContext * 0x0357d280, long * 0x0012f168) line 2203 + 1055 bytes js_Invoke(JSContext * 0x0357d280, unsigned int 1, unsigned int 2) line 688 + 13 bytes js_InternalCall(JSContext * 0x0357d280, JSObject * 0x02312ba0, long 36776880, unsigned int 1, long * 0x0012f2e8, long * 0x0012f2a0) line 765 + 15 bytes JS_CallFunction(JSContext * 0x0357d280, JSObject * 0x02312ba0, JSFunction * 0x035c2470, unsigned int 1, long * 0x0012f2e8, long * 0x0012f2a0) line 2653 + 32 bytes nsJSContext::CallFunction(nsJSContext * const 0x0357de30, void * 0x02312ba0, void * 0x035c2470, unsigned int 1, void * 0x0012f2e8, int * 0x0012f2e4) line 231 + 39 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x03701770) line 103 + 48 bytes nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012f814, nsIDOMEvent * * 0x0012f7bc, unsigned int 2, nsEventStatus & nsEventStatus_eIgnore) line 646 + 21 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x035c0ae0, nsIPresContext & {...}, nsEvent * 0x0012f814, nsIDOMEvent * * 0x0012f7bc, unsigned int 2, nsEventStatus & nsEventStatus_eIgnore) line 2663 nsXULElement::HandleDOMEvent(nsXULElement * const 0x032d7780, nsIPresContext & {...}, nsEvent * 0x0012f814, nsIDOMEvent * * 0x0012f7bc, unsigned int 2, nsEventStatus & nsEventStatus_eIgnore) line 2667 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x0365e7b0, nsIPresContext & {...}, nsEvent * 0x0012f814, nsIDOMEvent * * 0x0012f7bc, unsigned int 2, nsEventStatus & nsEventStatus_eIgnore) line 2667 + 39 bytes nsGenericElement::HandleDOMEvent(nsIPresContext & {...}, nsEvent * 0x0012f814, nsIDOMEvent * * 0x0012f7bc, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 796 + 39 bytes AnonymousElement::HandleDOMEvent(AnonymousElement * const 0x0365e0ac, nsIPresContext & {...}, nsEvent * 0x0012f814, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 137 + 31 bytes nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x035de180, nsIPresContext & {...}, nsMouseEvent * 0x0012fbcc, nsEventStatus & nsEventStatus_eIgnore) line 992 + 42 bytes nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x035de180, nsIPresContext & {...}, nsGUIEvent * 0x0012fbcc, nsIFrame * 0x0365f410, nsEventStatus & nsEventStatus_eIgnore, nsIView * 0x0365e220) line 467 + 24 bytes PresShell::HandleEvent(PresShell * const 0x035a41d4, nsIView * 0x0365e220, nsGUIEvent * 0x0012fbcc, nsEventStatus & nsEventStatus_eIgnore) line 2178 + 43 bytes nsView::HandleEvent(nsView * const 0x0365e220, nsGUIEvent * 0x0012fbcc, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834 nsView::HandleEvent(nsView * const 0x035a4500, nsGUIEvent * 0x0012fbcc, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819 nsViewManager::DispatchEvent(nsViewManager * const 0x035a46d0, nsGUIEvent * 0x0012fbcc, nsEventStatus & nsEventStatus_eIgnore) line 1739 HandleEvent(nsGUIEvent * 0x0012fbcc) line 63 nsWindow::DispatchEvent(nsWindow * const 0x035a43c4, nsGUIEvent * 0x0012fbcc, nsEventStatus & nsEventStatus_eIgnore) line 401 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbcc) line 422 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3394 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3612 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 3277290, long * 0x0012fdf4) line 2626 + 24 bytes nsWindow::WindowProc(HWND__ * 0x000113ce, unsigned int 514, unsigned int 0, long 3277290) line 579 + 27 bytes USER32! 77e71820() JS3250! 003201ea()

Still crashed on the MAC for 10-22-15-M11 commercial build when I scroll up the scroll bar after expand/collapse IMAP folders.

Crash on the Linux, too (10-22-08-M11 build) Shouldn't this bug make as duplicate of bug#15479?

hrm, the stack traces look different. Anyway, I'll take it for now.

Dup of bug 13483?

Hrm. not sure, but it's very similar (more similar than #15479). Let's mark it dupe for now (just to keep these things straight) and if I find out what's causing the other problem, I'll reopen it. *** This bug has been marked as a duplicate of 13483 ***

checekd for duplication with bug # 13483

Mark it verified/dup