Pull, build from April 8, 1999. Solaris 2.6, gcc 2.7.2.3, purify. Loaded up local mailbox, clicked on 'Local Mailbox' in left pane, clicked on 'Name' above it to sort by name. Local mailbox had 2 children, 'Sent' and 'Inbox'. Got this coredump. **** Purify instrumented ./apprunner.pure (pid 29274) **** COR: Fatal core dump: * This is occurring while in: _p921static [crtn.o] _resetsig [sig.c] _sigon [libthread.so.1] sigaction [libthread.so.1] signal [libc.so.1] abort [libc.so.1] PR_Abort [prlog.c:461] nsDebug::Abort(const char*,int) [nsDebug.cpp:93] nsDebug::Break(const char*,int) [nsDebug.cpp:108] nsDebug::Error(const char*,const char*,int) [nsDebug.cpp:168] nsElementMap::Remove(nsIRDFResource*,nsIContent*) [nsXULDocument.cpp:288] XULDocumentImpl::RemoveElementForResource(nsIRDFResource*,nsIContent*) [nsXULDocument.cpp:2052] RDFElementImpl::SetDocument(nsIDocument*,int) [nsRDFElement.cpp:1289] RDFElementImpl::RemoveChildAt(int,int) [nsRDFElement.cpp:1563] RDFGenericBuilderImpl::OnSetAttribute(nsIDOMElement*,const nsString&,const nsString&) [nsRDFGenericBuilder.cpp:921] XULDocumentImpl::OnSetAttribute(nsIDOMElement*,const nsString&,const nsString&) [nsXULDocument.cpp:2939] RDFElementImpl::SetAttribute(const nsString&,const nsString&) [nsRDFElement.cpp:867] ElementSetAttribute(JSContext*,JSObject*,unsigned int,long*,long*) [nsJSElement.cpp:210] js_Invoke [jsinterp.c:650] js_Interpret [jsinterp.c:2183] js_Invoke [jsinterp.c:666] js_Interpret [jsinterp.c:2183] js_Invoke [jsinterp.c:666] js_Interpret [jsinterp.c:2183] js_Invoke [jsinterp.c:666] js_CallFunctionValue [jsinterp.c:735] JS_CallFunctionValue [jsapi.c:2369] nsJSEventListener::HandleEvent(nsIDOMEvent*) [nsJSEventListener.cpp:93] nsEventListenerManager::HandleEvent(nsIPresContext&,nsEvent*,nsIDOMEvent**,unsig ned int,nsEventStatus&) [nsEventListenerManager.cpp:555] RDFElementImpl::HandleDOMEvent(nsIPresContext&,nsEvent*,nsIDOMEvent**,unsigned int,nsEventStatus&) [nsRDFElement.cpp:2200] * Received signal 6 (SIGABRT - Abort) * Signal mask: * Pending signals: (SIGABRT)

reassign to putterman@netscape.com

Quoting from above the line of code where this crashes: " // XXX Don't comment out this assert: if you get here, // something has gone dreadfully, horribly // wrong. Curse. Scream. File a bug against // waterson@netscape.com. " I cursed, I screamed and now I'm reassigning. BTW, this shouldn't be trying to sort since I haven't set up anything in the folder pane to sort. I find I have to click on this twice for this assertion to occur.

Robert, this is probably due to something that I did, but I'm reassigning to you because you're more familiar with the sorting code.

Chris, do you have any ideas about this one? I think the problem is bigger than sorting, as the sorting code should now be pretty good at add/release refcnt'ing.

I might have an idea: maybe this was what you, Scott, and I were discussing in private email. The sorting code removes the elements from the element map, this releases the only reference to the resource, which destroys the resource. Inserting it back causes a different resource to be created in the map, with a different pointer. This might be it, might not. Maybe we're not nullifying the doc pointer when we remove it from the document. We could try adding a reference to each element's resource before removing it from the content model.

Guys, is this reproducible.

Re: Linux build (1999-05-11-08 m6) I do not see this problem on Linux in this build.

OK, fixed then. :^) I believe this might have been fixed due to additional NULL checking that was added at some point recently.

I have sent an email to the bug reporter to verify this bug in his environment.

changed the QA contact to the reporter so he can verify the fix. Thanks

This is a really old bug. I'm going to mark verified