Background: Bug originated with bug 6099 ([PP] Mac, nsCOMPtr ownership doc sent as attachment crashes in PICS code) According to Neeti@netscape.com in bug 6099, "On windows, this bug was crashing in pics.dll. PICS is not enabled on the mac.There is no pics.dll on mac. So, I am not sure if this is same bug as it was on windows..." Build: Mac May 17 Seamonkey build (1999051709) running on a PPC 8500/180 and PPC Duo 2300c, OS 8.5.1 Win32 May 18 Seamonkey build (1999051809) running on Gateway P200, Win98 Linux May 18 Seamonkey build (1999051809) running on Compaq P200, Red Hat 5.2 Problem: Messenger crashes when trying to render a mail message that contains an attached web page with URL http://www.mozilla.org/projects/xpcom/Ownership.html. It crashes consistently on Mac but does not crash on Linux or win32. Note: can not test on todays Mac May 18 build (1999051809) because of bug 6680. Talkback Tracking IDs are: ERN59CNG, ERO07TMI, and ERP01DVH Steps to reproduce problem: 1) From Communicator, open a browser window 2) Go to URL - http://www.mozilla.org/projects/xpcom/Ownership.html 3) Send this page to yourself 4) Retrieve the mail message in Communicator 5) View message to ensure it has it file attachment 6 [details]) Copy the message to a local mail box 7) Exit Communicator 8) Copy this mail box to your Seamonkey mail folder 9) Start Seamonkey 10) Open Messenger from the task bar 11) Double click on the mail server to expand folder 12) Select your folder 13) Select the message that has this web attachment Crash to Macsbug Macsbug log consistently crashes in the same location. ------------ The ÒapprunnerÓ heap at 018CD380 is ok Totaling the ÒapprunnerÓ heap at 018CD380 Total Blocks Total of Block Sizes Free 00A0 #160 00214E50 #2182736 Nonrelocatable 00F8 #248 00724D5C #7490908 Relocatable 0366 #870 00058B10 #363280 Locked 0003 #3 00049480 #300160 Purgeable and not locked 0000 #0 00000000 #0 Heap size 04FE #1278 009926BC #10036924 Calling chain using A6/R1 links Back chain ISA Caller 00000000 PPC 06A04D38 022AB8C0 PPC 06A03E30 main+006C4 022AB730 PPC 0670BDD0 nsAppShellService::Run()+00018 022AB6F0 PPC 05F99754 nsAppShell::Run()+00038 022AB670 PPC 05F9A0D0 nsMacMessagePump::DoMessagePump()+0003C 022AB620 PPC 05F9A364 nsMacMessagePump::DispatchEvent(int, EventRecord*)+00158 022AB5D0 PPC 06878150 Repeater::DoRepeaters(const EventRecord&)+00030 022AB590 PPC 068707A8 TimerPeriodical::RepeatAction(const EventRecord&)+00048 022AB540 PPC 06870304 TimerImpl::Fire()+00024 022AB500 PPC 067E8B0C nsNetlibService::NetPollSocketsCallback(nsITimer*, void*)+0001C 022AB4C0 PPC 067C3960 NET_PollSockets+0002C 022AB470 PPC 067BF294 NET_ProcessNet+003C4 022AB0E0 PPC 067CC294 net_ProcessFile+000DC 022AB090 PPC 067CB968 net_read_file_chunk+00258 022AB040 PPC 068024C4 plugin_stream_write(_NET_StreamClass*, const char*, long)+0001C 022AB000 PPC 061EF180 MimePluginInstance::Write(const char*, unsigned int, unsigned in t*)+000C4 022AABB0 PPC 061FCF10 mime_display_stream_write+0004C 022AAB70 PPC 06203558 MimeObject_parse_buffer(char*, int, MimeObject*)+0003C 022AAB30 PPC 061F4000 mime_LineBuffer+001C0 022AAAD0 PPC 061F3DE8 convert_and_send_buffer(char*, int, int, int (*)(char*, unsigned int, void*), void*)+000BC 022AAA90 PPC 06200248 MimeMessage_parse_line(char*, int, MimeObject*)+00170 022AAA30 PPC 06203558 MimeObject_parse_buffer(char*, int, MimeObject*)+0003C 022AA9F0 PPC 061F3ECC mime_LineBuffer+0008C 022AA990 PPC 061F3DE8 convert_and_send_buffer(char*, int, int, int (*)(char*, unsigned int, void*), void*)+000BC 022AA950 PPC 062022E0 MimeMultipart_parse_line(char*, int, MimeObject*)+0024C 022AA900 PPC 06202D2C MimeMultipart_parse_child_line(MimeObject*, char*, int, int)+001 C4 022AA8A0 PPC 061FB620 MimeLeaf_parse_buffer(char*, int, MimeObject*)+00084 022AA860 PPC 06204D40 MimeInlineText_parse_decoded_buffer(char*, int, MimeObject*)+000 84 022AA820 PPC 061F3ECC mime_LineBuffer+0008C 022AA7C0 PPC 061F3DE8 convert_and_send_buffer(char*, int, int, int (*)(char*, unsigned int, void*), void*)+000BC 022AA780 PPC 06204EE4 MimeInlineText_rotate_convert_and_parse_line(char*, int, MimeObj ect*)+00140 022AA720 PPC 06205294 MimeInlineTextHTML_parse_line(char*, int, MimeObject*)+00050 022AA6E0 PPC 061FA9CC MimeObject_write(MimeObject*, char*, int, int)+00074 022AA690 PPC 061FA8EC MimeOptions_write(MimeDisplayOptions*, char*, int, int)+00118 022AA620 PPC 061FCDE4 mime_output_fn(char*, int, void*)+00058 022AA5E0 PPC 066C648C nsMimeEmitter::WriteBody(const char*, unsigned int, unsigned int *)+00014 022AA5A0 PPC 066C669C nsMimeEmitter::Write(const char*, unsigned int, unsigned int*)+0 0184 022AA540 PPC 0680311C nsNetConverterStream::Write(const char*, unsigned int, unsigned int*)+0002C 022AA4F0 PPC 067EC8F0 stub_put_block(_NET_StreamClass*, const char*, long)+00080 022AA4A0 PPC 0661ABF0 nsDocumentBindInfo::OnDataAvailable(nsIURL*, nsIInputStream*, un signed int)+00074 022AA450 PPC 0654B334 nsParser::OnDataAvailable(nsIURL*, nsIInputStream*, unsigned int )+001A8 022AA3F0 PPC 0654AD94 nsParser::ResumeParse(nsIDTD*)+000CC 022AA3A0 PPC 0654AED4 nsParser::BuildModel()+0006C 022AA360 PPC 06538E84 CNavDTD::BuildModel(nsIParser*, nsITokenizer*, nsITokenObserver* , nsIContentSink*)+0009C 022AA300 PPC 06539490 CNavDTD::HandleToken(CToken*, nsIParser*)+0025C 022AA2A0 PPC 065490D4 CTokenHandler::operator()(CToken*, nsIDTD*)+0002C 022AA260 PPC 06538278 NavDispatchTokenHandler(CToken*, nsIDTD*)+0005C 022AA210 PPC 0653ABF8 CNavDTD::HandleStartToken(CToken*)+0021C 022AA0F0 PPC 0653D9F4 CNavDTD::AddHeadLeaf(nsIParserNode&)+000C8 022AA0A0 PPC 0653D8D8 CNavDTD::AddLeaf(const nsIParserNode&)+00058 022AA060 PPC 062A634C HTMLContentSink::AddLeaf(const nsIParserNode&)+000BC 022AA020 PPC 062A8184 HTMLContentSink::ProcessLINKTag(const nsIParserNode&)+003EC 022A9DD0 PPC 062A7CBC HTMLContentSink::ProcessStyleLink(nsIHTMLContent*, const nsStrin g&, const nsString&, const nsString&, const nsString&, const nsString&, int)+002C8 Closing log

Stack Trace from Talkback. The crash on line 2790 of CNavDTD.cpp is consistent in all three talkback logs. The last people to update this file was in 3/17/99 by ftang, harishd, and richg. ----- Trigger Type: Program Crash Trigger Reason: PowerPC unmapped memory exception Call Stack: (Signature = 0x4c50616c 547c7aca) 0x4c50616c layout.shlb + 0x3504c (0x05c1ecbc) layout.shlb + 0x35514 (0x05c1f184) layout.shlb + 0x336dc (0x05c1d34c) CNavDTD::AddLeaf() [CNavDTD.cpp, line 2790] CNavDTD::AddHeadLeaf() [CNavDTD.cpp, line 2822] CNavDTD::HandleStartToken() [CNavDTD.cpp, line 1422] NavDispatchTokenHandler() [CNavDTD.cpp, line 249] .__cl__13CTokenHandlerFP6CTokenP6nsIDTD [nsTokenHandler.cpp, line 80] CNavDTD::HandleToken() [CNavDTD.cpp, line 675] CNavDTD::BuildModel() [CNavDTD.cpp, line 514] nsParser::BuildModel() [nsParser.cpp, line 892] nsParser::ResumeParse() [nsParser.cpp, line 844] nsParser::OnDataAvailable() [nsParser.cpp, line 1056] nsDocumentBindInfo::OnDataAvailable() [nsDocLoader.cpp, line 1498] stub_put_block() [nsStubContext.cpp, line 833]

JF, Might this be a problem including style sheets that don't exist? Just wondering because I see this in the stack trace: PPC 062A7CBC HTMLContentSink::ProcessStyleLink(nsIHTMLContent*, const nsString&, const nsString&, const nsString&, const nsString&, const nsString&, int)+002C8 - rhp

JF, Might this be a problem including style sheets that don't exist? Just wondering because I see this in the stack trace: PPC 062A7CBC HTMLContentSink::ProcessStyleLink(nsIHTMLContent*, const nsString&, const nsString&, const nsString&, const nsString&, const nsString&, int)+002C8 - rhp

In the optimized June 8 Mac build (1999-06-08-08-m7). It still crashes viewing this URL. Here is the MacsBug log: The “apprunner” heap at 07E46C60 is ok Totaling the “apprunner” heap at 07E46C60 Total Blocks Total of Block Sizes Free 009A #154 0021EF20 #2223904 Nonrelocatable 00FF #255 0073054C #7537996 Relocatable 02C4 #708 00043250 #275024 Locked 0005 #5 0002B3C0 #177088 Purgeable and not locked 0000 #0 00000000 #0 Heap size 045D #1117 009926BC #10036924 Calling chain using A6/R1 links Back chain ISA Caller 00000000 PPC 1896FF80 088251C0 PPC 1896F100 main+00904 08824FC0 PPC 18744250 nsAppShellService::Run()+00018 08824F80 PPC 186745D0 nsAppShell::Run()+00038 08824F00 PPC 18674F8C nsMacMessagePump::DoMessagePump()+0003C 08824EB0 PPC 18675244 nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 00158 08824E60 PPC 188BB024 Repeater::DoRepeaters(const EventRecord&)+00030 08824E20 PPC 188BAB44 TimerPeriodical::RepeatAction(const EventRecord&)+ 00048 08824DD0 PPC 188BA6A0 TimerImpl::Fire()+00024 08824D90 PPC 1889F2F0 nsNetlibService::NetPollSocketsCallback(nsITimer*, void*)+0001C 08824D50 PPC 1887EDE4 NET_PollSockets+0002C 08824D00 PPC 1887A718 NET_ProcessNet+003C4 08824970 PPC 18887710 net_ProcessFile+000DC 08824920 PPC 18886DE4 net_read_file_chunk+00258 088248D0 PPC 188B8844 plugin_stream_write(_NET_StreamClass*, const char*, long)+0001C 08824890 PPC 17F85168 MimePluginInstance::Write(const char*, unsigned int, unsigned in t*)+000C4 08824440 PPC 17F9386C mime_display_stream_write+0004C 08824400 PPC 17F9A314 MimeObject_parse_buffer(char*, int, MimeObject*)+ 0003C 088243C0 PPC 17F8A998 mime_LineBuffer+001C0 08824360 PPC 17F8A780 convert_and_send_buffer(char*, int, int, int (* )(char*, unsigned int, void*), void*)+000BC 08824320 PPC 17F9701C MimeMessage_parse_line(char*, int, MimeObject*)+ 0016C 088242D0 PPC 17F9A314 MimeObject_parse_buffer(char*, int, MimeObject*)+ 0003C 08824290 PPC 17F8A864 mime_LineBuffer+0008C 08824230 PPC 17F8A780 convert_and_send_buffer(char*, int, int, int (* )(char*, unsigned int, void*), void*)+000BC 088241F0 PPC 17F990A4 MimeMultipart_parse_line(char*, int, MimeObject*)+ 00248 088241A0 PPC 17F99AEC MimeMultipart_parse_child_line(MimeObject*, char*, int, int)+001 C4 08824140 PPC 17F91F98 MimeLeaf_parse_buffer(char*, int, MimeObject*)+00084 08824100 PPC 17F9BAE8 MimeInlineText_parse_decoded_buffer(char*, int, MimeObject*)+000 84 088240C0 PPC 17F8A864 mime_LineBuffer+0008C 08824060 PPC 17F8A780 convert_and_send_buffer(char*, int, int, int (* )(char*, unsigned int, void*), void*)+000BC 08824020 PPC 17F9BC8C MimeInlineText_rotate_convert_and_parse_line(char*, int, MimeObj ect*)+00140 08823FD0 PPC 17F9C038 MimeInlineTextHTML_parse_line(char*, int, MimeObject*)+00050 08823F90 PPC 17F9134C MimeObject_write(MimeObject*, char*, int, int)+00074 08823F40 PPC 17F9126C MimeOptions_write(MimeDisplayOptions*, char*, int, int)+00118 08823ED0 PPC 17F93740 mime_output_fn(char*, int, void*)+00058 08823E90 PPC 17F33474 nsMimeEmitter::WriteBody(const char*, unsigned int, unsigned int *)+00014 08823E50 PPC 17F33684 nsMimeEmitter::Write(const char*, unsigned int, unsigned int*)+0 0184 08823DF0 PPC 188B949C nsNetConverterStream::Write(const char*, unsigned int, unsigned int*)+0002C 08823DA0 PPC 188A3140 stub_put_block(_NET_StreamClass*, const char*, long)+00080 08823D50 PPC 184B2C88 nsDocumentBindInfo::OnDataAvailable(nsIURL*, nsIInputStream*, un signed int)+00074 08823D00 PPC 185AA6DC nsParser::OnDataAvailable(nsIURL*, nsIInputStream*, unsigned int )+001A8 08823CA0 PPC 185AA120 nsParser::ResumeParse(nsIDTD*)+0008C 08823C50 PPC 185AA268 nsParser::BuildModel()+00070 08823C00 PPC 18597F44 CNavDTD::BuildModel(nsIParser*, nsITokenizer*, nsITokenObserver* , nsIContentSink*)+0009C 08823BA0 PPC 185985A4 CNavDTD::HandleToken(CToken*, nsIParser*)+0025C 08823B40 PPC 185A8308 CTokenHandler::operator()(CToken*, nsIDTD*)+0002C 08823B00 PPC 18597318 NavDispatchTokenHandler(CToken*, nsIDTD*)+0005C 08823AB0 PPC 18599D50 CNavDTD::HandleStartToken(CToken*)+001E4 088239B0 PPC 1859C9F4 CNavDTD::AddHeadLeaf(nsIParserNode&)+000C8 08823960 PPC 1859C8D8 CNavDTD::AddLeaf(const nsIParserNode&)+00058 08823920 PPC 18173214 HTMLContentSink::AddLeaf(const nsIParserNode&)+000BC 088238E0 PPC 181751FC HTMLContentSink::ProcessLINKTag(const nsIParserNode& )+003EC 08823700 PPC 18174CF8 HTMLContentSink::ProcessStyleLink(nsIHTMLContent*, const nsStrin g&, const nsString&, const nsString&, const nsString&, const nsString&)+00378 08823580 PPC 183ADD9C CSSLoaderImpl::LoadStyleLink(nsIContent*, nsIURL*, const nsStrin g&, const nsString&, int, nsIParser*, int&)+00264 088234F0 PPC 183AD868 CSSLoaderImpl::LoadSheet(URLKey&, SheetLoadData*)+ 00070 Closing log

I will take a look at it...

Rich, do have have any idea which css file are we espected to get at this point?

The problem occurs only if the attached web page contains a link to a css file like it's the case for http:// www.mozilla.org/projects/xpcom/Ownership.html. CSSLoaderImpl::DidLoadStyle failed loading the css page because it try to find it localy. On Mac we crash but on Windows we just get a message in the output window but we don't crash: CSSLoaderImpl::DidLoadStyle: Load of URL 'file://c/:temp/<css filename here>' failed. Error code 1 I am still investigating...

We crash because the loader in nsCSSLoader.cpp is deleted twice. At this point I don't if an ADDREF is missing or if a RELEASE is called when it should not. Reassign this pug to peterl.

more info: the loader is first destroyed by the NS_RELEASE at the end of DoneLoadingStyle() and then by NS_IF_RELEASE at the end of nsDocumentBindInfo::OnStopBinding().

As far as I can tell, the loader is getting bad calls from netlib. *** This bug has been marked as a duplicate of 2537 ***

Verified as a duplicate of bug 2537. Wow ... reading bug 2537, there has been a number of instances of this bug (duplicate bug 5206, 6757, 2621)