steps: 1. Add a newsgroup account (I added news.mcom.com, not able to reproduce this in news.mozilla.org). 2. Select File | Subscribe. After it shows all the newsgroups, scroll down and click on the twisty in 'mcom'. It crashes. 3. If you do not see the crash in the above step, then subscribe to one of the newsgroup and click OK in subscribe window. 4. In the 3-pane click on that newsgroup. It will ask you number of headers to download. Clcik Ok. Now it crashes. I'm able to consistently reproduce this crash either in step 2 or step 4 above. Build and platform: Today's commercial build on all platforms.

Stack trace: (Using mozilla debug build. Crashed at step 2 described above) Compare(const basic_nsAReadableString<unsigned short> & {...}, const basic_nsAReadableString<unsigned short> & {...}) line 1285 + 11 bytes Compare(const basic_nsAReadableString<unsigned short> & {...}, const unsigned short * 0x08214f9c) line 1326 + 22 bytes CompareKeys(const basic_nsAReadableString<unsigned short> * 0x0821ab9c, const unsigned short * 0x08214f9c) line 181 + 13 bytes PL_HashTableRawLookup(PLHashTable * 0x00f141d0, unsigned int 2228717036, const void * 0x0821ab9c) line 181 + 28 bytes PL_HashTableRawAdd(PLHashTable * 0x00f141d0, PLHashEntry * * 0x05e9e9e8, unsigned int 1855767017, const void * 0x082c0d0c, void * 0x082c0d00) line 258 + 23 bytes NS_NewAtom(const basic_nsAReadableString<unsigned short> & {...}) line 215 + 31 bytes nsXULAttribute::SetValueInternal(const basic_nsAReadableString<unsigned short> & {...}) line 560 + 10 bytes nsXULAttribute::nsXULAttribute(nsIContent * 0x071c8ee0, nsINodeInfo * 0x03ac9930, const basic_nsAReadableString<unsigned short> & {...}) line 223 nsXULAttribute::Create(nsIContent * 0x071c8ee0, nsINodeInfo * 0x03ac9930, const basic_nsAReadableString<unsigned short> & {...}, nsXULAttribute * * 0x00129b5c) line 246 + 39 bytes nsXULElement::SetAttribute(nsXULElement * const 0x071c8ee0, nsINodeInfo * 0x03ac9930, const basic_nsAReadableString<unsigned short> & {...}, int 0) line 2710 + 21 bytes nsXULElement::SetAttribute(nsXULElement * const 0x071c8ee0, int 0, nsIAtom * 0x01d375e0, const basic_nsAReadableString<unsigned short> & {...}, int 0) line 2789 + 29 bytes nsXULTemplateBuilder::BuildContentFromTemplate(nsIContent * 0x03b9a430, nsIContent * 0x081ede90, nsIContent * 0x082880e0, int 1, nsIRDFResource * 0x07148520, int 0, Match * 0x05e8ee50, nsIContent * * 0x0012b2e4, int * 0x0012b2e8) line 5378 + 52 bytes nsXULTemplateBuilder::BuildContentFromTemplate(nsIContent * 0x03b9a580, nsIContent * 0x081ede90, nsIContent * 0x081ede90, int 1, nsIRDFResource * 0x07148520, int 0, Match * 0x05e8ee50, nsIContent * * 0x0012b2e4, int * 0x0012b2e8) line 5356 + 61 bytes nsXULTemplateBuilder::CreateContainerContents(nsIContent * 0x081ede90, nsIRDFResource * 0x06dbb9d0, int 0, nsIContent * * 0x0012b2e4, int * 0x0012b2e8) line 6127 nsXULTemplateBuilder::OpenContainer(nsXULTemplateBuilder * const 0x03b99da4, nsIContent * 0x081ede90) line 4312 + 54 bytes nsXULDocument::OpenWidgetItem(nsIContent * 0x081ede90) line 4488 + 22 bytes nsXULDocument::AttributeChanged(nsXULDocument * const 0x03a4fd40, nsIContent * 0x081ede90, int 0, nsIAtom * 0x01d42d40, int -1) line 1645 nsXULElement::SetAttribute(nsXULElement * const 0x081ede90, nsINodeInfo * 0x08281200, const basic_nsAReadableString<unsigned short> & {...}, int 1) line 2769 nsXULElement::SetAttribute(nsXULElement * const 0x081ede98, const basic_nsAReadableString<unsigned short> & {...}, const basic_nsAReadableString<unsigned short> & {...}) line 1229 + 31 bytes ElementSetAttribute(JSContext * 0x03a19290, JSObject * 0x05dc9b58, unsigned int 2, long * 0x05e72564, long * 0x0012b9b8) line 239 + 26 bytes js_Invoke(JSContext * 0x03a19290, unsigned int 2, unsigned int 0) line 731 + 23 bytes js_Interpret(JSContext * 0x03a19290, long * 0x0012c340) line 2538 + 15 bytes js_Invoke(JSContext * 0x03a19290, unsigned int 1, unsigned int 2) line 748 + 13 bytes js_InternalInvoke(JSContext * 0x03a19290, JSObject * 0x05dc9930, long 98343952, unsigned int 0, unsigned int 1, long * 0x0012c4d4, long * 0x0012c464) line 821 + 19 bytes JS_CallFunctionValue(JSContext * 0x03a19290, JSObject * 0x05dc9930, long 98343952, unsigned int 1, long * 0x0012c4d4, long * 0x0012c464) line 3175 + 31 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x03a196d0, void * 0x05dc9930, void * 0x05dc9c10, unsigned int 1, void * 0x0012c4d4, int * 0x0012c4d0, int 0) line 902 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x08280a24) line 154 + 64 bytes nsXBLEventHandler::ExecuteHandler(nsXBLEventHandler * const 0x0822ab50, const basic_nsAReadableString<unsigned short> & {...}, nsIDOMEvent * 0x08280a24) line 555 nsXBLEventHandler::MouseClick(nsIDOMEvent * 0x08280a24) line 260 + 36 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x03a4caa0, nsEvent * 0x0012d39c, nsIDOMEvent * * 0x0012d2c8, nsIDOMEventTarget * 0x081aa13c, unsigned int 2, nsEventStatus * 0x0012d694) line 861 + 23 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x081aa130, nsIPresContext * 0x03a4caa0, nsEvent * 0x0012d39c, nsIDOMEvent * * 0x0012d2c8, unsigned int 2, nsEventStatus * 0x0012d694) line 3257 nsXULElement::HandleDOMEvent(nsXULElement * const 0x081ede90, nsIPresContext * 0x03a4caa0, nsEvent * 0x0012d39c, nsIDOMEvent * * 0x0012d2c8, unsigned int 2, nsEventStatus * 0x0012d694) line 3265 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04c069c0, nsIPresContext * 0x03a4caa0, nsEvent * 0x0012d39c, nsIDOMEvent * * 0x0012d2c8, unsigned int 2, nsEventStatus * 0x0012d694) line 3265 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x067b0ef0, nsIPresContext * 0x03a4caa0, nsEvent * 0x0012d39c, nsIDOMEvent * * 0x0012d2c8, unsigned int 2, nsEventStatus * 0x0012d694) line 3265 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x0686ba60, nsIPresContext * 0x03a4caa0, nsEvent * 0x0012d39c, nsIDOMEvent * * 0x0012d2c8, unsigned int 1, nsEventStatus * 0x0012d694) line 3265 + 39 bytes PresShell::HandleEventInternal(nsEvent * 0x0012d39c, nsIView * 0x00000000, nsEventStatus * 0x0012d694) line 4040 + 45 bytes PresShell::HandleEventWithTarget(PresShell * const 0x03a4b9e0, nsEvent * 0x0012d39c, nsIFrame * 0x05e558d4, nsIContent * 0x0686ba60, nsEventStatus * 0x0012d694) line 4021 + 18 bytes nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x03969ef0, nsIPresContext * 0x03a4caa0, nsMouseEvent * 0x0012d7a4, nsEventStatus * 0x0012d694) line 1811 + 59 bytes nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x03969ef8, nsIPresContext * 0x03a4caa0, nsEvent * 0x0012d7a4, nsIFrame * 0x05e558d4, nsEventStatus * 0x0012d694, nsIView * 0x081a0e10) line 892 + 28 bytes PresShell::HandleEventInternal(nsEvent * 0x0012d7a4, nsIView * 0x081a0e10, nsEventStatus * 0x0012d694) line 4060 + 43 bytes PresShell::HandleEvent(PresShell * const 0x03a4b9e4, nsIView * 0x081a0e10, nsGUIEvent * 0x0012d7a4, nsEventStatus * 0x0012d694, int 1, int & 1) line 3975 + 23 bytes nsView::HandleEvent(nsView * const 0x081a0e10, nsGUIEvent * 0x0012d7a4, unsigned int 28, nsEventStatus * 0x0012d694, int 1, int & 1) line 379 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x03a4c790, nsGUIEvent * 0x0012d7a4, nsEventStatus * 0x0012d694) line 1429 HandleEvent(nsGUIEvent * 0x0012d7a4) line 68 nsWindow::DispatchEvent(nsWindow * const 0x081a1624, nsGUIEvent * 0x0012d7a4, nsEventStatus & nsEventStatus_eIgnore) line 614 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012d7a4) line 635 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3811 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 4021 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 3211271, long * 0x0012db20) line 2889 + 24 bytes nsWindow::WindowProc(HWND__ * 0x0d310bb0, unsigned int 514, unsigned int 0, long 3211271) line 883 + 27 bytes USER32! 77e71820() JS3250! js_WithClass + 3863 bytes

changing qa contact.

marking p1, since it is a crasher. adding nsbeta3 keyword. accepting.

I don't know why this is occurring on news.mcom.com server but is not occurring on news.mozilla.org...anyway I can reprodce this problem on news.mcom.com.....build 09-06-08-M18 commercial build

adding crash & regression for the keywords.

adding scc, wtc, and waterson to the cc list. it looks like we are crashing as a result of trying to grow the hash table in PL_HashTableRawAdd(). the call to PL_HashTableRawLookup() that causes the crash comes from this for loop at line 255 in plhash.c for (i = 0; i < n; i++) { for (he = oldbuckets[i]; he; he = next) { next = he->next; hep = PL_HashTableRawLookup(ht, he->keyHash, he->key); PR_ASSERT(*hep == 0); he->next = 0; *hep = he; } } I'll continue to debug and report back. a possible reason opening "mcom" in the subscribe dialog might expose this is the "mcom" node in the subscribe tree would have thousands of children.

Seth, seems like we should reassign this so whoever is going to fix it can get a plus on it...

#44611 seems related. (it has a similar stack.) it makes me think the problem isn't in the hash table code. waterson, would this be one for you?

Not sure -- there seem to be three different stack traces in these bugs: - nsCSSFrameConstructor::ContentInserted (bug 44611) - nsAReadableString::Compare() - PL_HashTableRawAdd() Any chance we could run purify on this test case to see if random memory is getting stomped?

waterson: I'm running purify on this beast now. I'll report back soon.

[nsbeta3+]

update: suresh and I have been trying to reproduce the crash in a purify build, but not luck yet. we'll continue to work on this today.

PDT agrees with P1 priority

the crash is still there, but suresh and I weren't able to reproduce it under purify. (we didn't see anything suspicuous in the purify logs, either.) I'll continue to investigate.

I'm not seeing this crash on the 2000091805 winnt build, but I've seen it on linux recently. I'll continue to investigate.

suresh and I are not seeing this anymore. marking worksforme. I'm not sure what change fixed it, so I won't be shocked if this bug pops up again.

Yep..Marking verified. Couldn't duplicate in today's commercial and debug build on Win32 all platforms.

my previous comment should have read "...on all platforms" ...

Reopening. On Linux build 2000920, I got the exact same crash stack trace when clicking a twisty in the Subscribe dialog. For me, it happens after downloading the full list of newgroups from the news-server (starting with nothing), and then clicking the twisty for the alt hierarchy.

Hi Matthew, I didn't see the crash using 9/20 build. Which newsserver are you using? Is it a public newsserver? Thanks!!

I'm using isp-west.usenetserver.com, which unfortuneatly isn't public. If no one else can reproduce this, I'll be happy to debug and fix it, if someone can give me some clues as to how to get started.

matthew: can you send me your hostinfo.dat file for this server? (since you are crashing, you might have to send me the hostinfo.dat file from 4.x, and I'll try to reproduce the crash in 6.0) as far as debugging / fixing it, we are always looking for contributors: start here: http://www.mozilla.org/source.html

suresh and I have a plan. we're going to try to create a beefy hostinfo.dat file to try to reproduce this problem. accepting.

Grrrrrr! I have a hostinfo.dat which can cause the crash, but I can't seem to upload it as an attachment. Uploading all 1MB of the plain text file gives some sort of SQL error, while attempting to upload a gzipped file tells me that "Mime type application/octet-sream#*#*()!(5489&*()" is simply unacceptable. If anyone wants the hostinfo.dat file, mail me, and I'll mail it back to you.

yeah, there is an attachment limit on bugzilla. can you email it to me? (sspitzer@netscape.com) thanks.

marking nsbeta3- as we should not hold PR3 for this. Nominating for RTM.

rtm-, this doesn't seem to happen outside this one known case. It may be related to huge hostinfo.dat files, but we'll have to pick that up in the next point release.

I wanted to reproduce this bug, but I couldn't find twister in the newsgroups list. What am I missing here? On a related note, is there any performance bug filled for the Subscribe dialog box? It's dog and a pig in the same time: it took 10 minutes and allocated 240! Plus it feels SO primitive: no search panel?!

the twisty refers to the triangle to the left of a row. |> netscape.public.mozilla click on the |> to see all the children, which would be netscape.public.mozilla.* yes, there are plenty of bugs logged (against me) about the subscribe dialog on servers with large numbers of groups.

LOL! Ok, then it looks that I cannot reproduce this one on my machine. I did all the steps, but other than various size/speed problems, it works fine. OS: Win2k Build from from pulling Netscape_20000922_BRANCH

*** Bug 58238 has been marked as a duplicate of this bug. ***

*** Bug 58919 has been marked as a duplicate of this bug. ***

very related to 54491

You might want to update the milestone because... M18 has already been released.

Adding self

Added blocks

cata, you could not produce the bug probably because you have win2k - it is very stable :)

changing milestone.

*** Bug 60464 has been marked as a duplicate of this bug. ***

this is a dup. tracking this in #58238 *** This bug has been marked as a duplicate of 58238 ***

Marking verified as a duplicate.