Overview Description: Crash when cancelling out of Mail Account Wizard (which is blank due to bug 93558). Steps to Reproduce: 1) Create a brand new profile. Quit. 2) Start in browser. 3) Do "File->New->New Message" to start msg composition. 4) because there is no mail account, Acct. Wizard comes up. 5) The inner iframe contents are blank (bug 93558 or whatever). 6) Cancel out of the Wizard. 7) OK the confirmation dialog that then comes up. 8) Crash. Actual Results: Crash Expected Results: Cancel out. Reproducibility: 100% win2k 2001-08-09-07 trunk Haven't tried Linux and Mac (Must go play hockey now :-). Talkback sez ... GlobalWindowImpl::RunTimeout [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3419] nsGlobalWindow_RunTimeout [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3701] nsTimer::Fire [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 196] nsTimerManager::FireNextReadyTimer [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp, line 117] nsAppShell::Run [d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp, line 118] nsAppShellService::Run [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 425] netscp6.exe + 0x174d (0x0040174d) netscp6.exe + 0x121a (0x0040121a) netscp6.exe + 0x368f (0x0040368f) KERNEL32.DLL + 0x7903 (0x77e87903)

Actually, this doesn't in any way depend on the blank UI window. Even if I have worked around the blank UI (by using another code path to get that UI sucessfully into the XUL cache), I will still crash when I can out of that dialog. To summarize: I crash when I have start mailcompose directly from the browser, and do not yet have a valid account. When I then choose to cancel out of the Account Wizard, I crash when I OK the confirmation dialog. ([Un]fortunately, I can only do this in a commercial opt. build; these same steps do not crash for me in an opt. mozilla build on win2k, pulled this evening).

The same behavior is happening for me in the build that I just pulled down from the FTP server. I can reproduce this 100% in win2k build: 2001-08-13-03

So, like, duh. The timeout is running some JS, and the name of the eval string is sitting right there in the debugger!: |updateComposeItems()|. This is scheduled with a setTimeout in CommandUpdate_MsgCompose(). But, looking at this with a debug build, I get the 'real' stack, and the crash is actually here: in GlobalWindowImpl::DropTimeout(): if (aTimeout->timer) { aTimeout->timer->Cancel(); aTimeout->timer = nsnull; } and aTimeout->timer == 0xdddddddd Should this go to danm or jst? GlobalWindowImpl::DropTimeout(nsTimeoutImpl * 0x04e7b3e8, nsIScriptContext * 0x042ba4f8) line 3601 + 17 bytes GlobalWindowImpl::ClearAllTimeouts() line 3671 GlobalWindowImpl::SetNewDocument(GlobalWindowImpl * const 0x042e1e40, nsIDOMDocument * 0x00000000) line 368 DocumentViewerImpl::Close(DocumentViewerImpl * const 0x042f98a0) line 1155 nsDocShell::Destroy(nsDocShell * const 0x042e177c) line 2455 nsWebShell::Destroy(nsWebShell * const 0x042e177c) line 1339 nsXULWindow::Destroy(nsXULWindow * const 0x042e12dc) line 368 nsWebShellWindow::Destroy(nsWebShellWindow * const 0x042e12dc) line 1700 + 9 bytes nsChromeTreeOwner::Destroy(nsChromeTreeOwner * const 0x042e1ca4) line 228 GlobalWindowImpl::ReallyCloseWindow(GlobalWindowImpl * const 0x042e1e54) line 2384 GlobalWindowImpl::Close(GlobalWindowImpl * const 0x042e1e44) line 2373 + 16 bytes XPTC_InvokeByIndex(nsISupports * 0x042e1e44, unsigned int 81, unsigned int 0, nsXPTCVariant * 0x0012b770) line 139 XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode CALL_METHOD) line 1883 + 42 bytes XPC_WN_CallMethod(JSContext * 0x04e575c0, JSObject * 0x042d69d8, unsigned int 0, long * 0x04f36488, long * 0x0012b9a4) line 1252 + 11 bytes js_Invoke(JSContext * 0x04e575c0, unsigned int 0, unsigned int 0) line 807 + 23 bytes js_Interpret(JSContext * 0x04e575c0, long * 0x0012c744) line 2699 + 15 bytes js_Invoke(JSContext * 0x04e575c0, unsigned int 1, unsigned int 2) line 824 + 13 bytes js_InternalInvoke(JSContext * 0x04e575c0, JSObject * 0x04eae8e0, long 81308016, unsigned int 0, unsigned int 1, long * 0x0012c924, long * 0x0012c86c) line 896 + 20 bytes JS_CallFunctionValue(JSContext * 0x04e575c0, JSObject * 0x04eae8e0, long 81308016, unsigned int 1, long * 0x0012c924, long * 0x0012c86c) line 3349 + 31 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x04e57558, void * 0x04eae8e0, void * 0x04d8a970, unsigned int 1, void * 0x0012c924, int * 0x0012c920, int 0) line 946 + 33 bytes nsJSEventListener::HandleEvent(nsJSEventListener * const 0x04ef0fd0, nsIDOMEvent * 0x04f5760c) line 139 + 74 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x04ed3930, nsIDOMEvent * 0x04f5760c, nsIDOMEventTarget * 0x04ebc048, unsigned int 8, unsigned int 7) line 1196 + 20 bytes nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x04ed38c8, nsIPresContext * 0x04e91330, nsEvent * 0x0012d434, nsIDOMEvent * * 0x0012d2f8, nsIDOMEventTarget * 0x04ebc048, unsigned int 7, nsEventStatus * 0x0012d47c) line 2186 + 36 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04ebc040, nsIPresContext * 0x04e91330, nsEvent * 0x0012d434, nsIDOMEvent * * 0x0012d2f8, unsigned int 1, nsEventStatus * 0x0012d47c) line 3707 PresShell::HandleDOMEventWithTarget(PresShell * const 0x04e92278, nsIContent * 0x04ebc040, nsEvent * 0x0012d434, nsEventStatus * 0x0012d47c) line 5693 + 39 bytes nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x04e91330, nsGUIEvent * 0x0012d630) line 181 nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x04f205dc, nsIPresContext * 0x04e91330, nsGUIEvent * 0x0012d630, nsEventStatus * 0x0012d93c) line 128 PresShell::HandleEventInternal(nsEvent * 0x0012d630, nsIView * 0x00000000, unsigned int 1, nsEventStatus * 0x0012d93c) line 5661 + 41 bytes PresShell::HandleEventWithTarget(PresShell * const 0x04e92278, nsEvent * 0x0012d630, nsIFrame * 0x04f205dc, nsIContent * 0x04ebc040, unsigned int 1, nsEventStatus * 0x0012d93c) line 5619 + 22 bytes nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x04ef7488, nsIPresContext * 0x04e91330, nsMouseEvent * 0x0012da48, nsEventStatus * 0x0012d93c) line 2466 + 61 bytes nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x04ef7490, nsIPresContext * 0x04e91330, nsEvent * 0x0012da48, nsIFrame * 0x04f205dc, nsEventStatus * 0x0012d93c, nsIView * 0x04e91df0) line 1551 + 28 bytes PresShell::HandleEventInternal(nsEvent * 0x0012da48, nsIView * 0x04e91df0, unsigned int 1, nsEventStatus * 0x0012d93c) line 5666 + 43 bytes PresShell::HandleEvent(PresShell * const 0x04e9227c, nsIView * 0x04e91df0, nsGUIEvent * 0x0012da48, nsEventStatus * 0x0012d93c, int 1, int & 1) line 5573 + 25 bytes nsView::HandleEvent(nsView * const 0x04e91df0, nsGUIEvent * 0x0012da48, unsigned int 28, nsEventStatus * 0x0012d93c, int 1, int & 1) line 377 nsViewManager::DispatchEvent(nsViewManager * const 0x04e91be0, nsGUIEvent * 0x0012da48, nsEventStatus * 0x0012d93c) line 2058 HandleEvent(nsGUIEvent * 0x0012da48) line 68 nsWindow::DispatchEvent(nsWindow * const 0x04e91e8c, nsGUIEvent * 0x0012da48, nsEventStatus & nsEventStatus_eIgnore) line 720 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012da48) line 741 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 4251 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 4500 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 22872255, long * 0x0012de70) line 3210 + 24 bytes nsWindow::WindowProc(HWND__ * 0x001a02fe, unsigned int 514, unsigned int 0, long 22872255) line 988 + 27 bytes USER32! 77e13eb0() USER32! 77e1401a() USER32! 77e192da() nsXULWindow::ShowModal(nsXULWindow * const 0x04e453f0) line 276 nsWebShellWindow::ShowModal(nsWebShellWindow * const 0x04e453f0) line 1042 nsContentTreeOwner::ShowAsModal(nsContentTreeOwner * const 0x04d377c4) line 394 nsWindowWatcher::OpenWindowJS(nsWindowWatcher * const 0x00dad87c, nsIDOMWindow * 0x042e1e44, const char * 0x04e07998, const char * 0x04302e20, const char * 0x03df5138, int 1, unsigned int 1, long * 0x04e8a0d4, nsIDOMWindow * * 0x0012e5b8) line 701 GlobalWindowImpl::OpenInternal(GlobalWindowImpl * const 0x042e1e40, const nsAString & {...}, const nsAString & {...}, const nsAString & {...}, int 1, long * 0x04e8a0c8, unsigned int 4, nsISupports * 0x00000000, nsIDOMWindow * * 0x0012e988) line 3132 + 129 bytes GlobalWindowImpl::OpenDialog(GlobalWindowImpl * const 0x042e1e48, nsIDOMWindow * * 0x0012e988) line 2329 + 59 bytes XPTC_InvokeByIndex(nsISupports * 0x042e1e48, unsigned int 14, unsigned int 1, nsXPTCVariant * 0x0012e988) line 139 XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode CALL_METHOD) line 1883 + 42 bytes XPC_WN_CallMethod(JSContext * 0x042ba600, JSObject * 0x042d69d8, unsigned int 4, long * 0x04e8a0c8, long * 0x0012ebbc) line 1252 + 11 bytes js_Invoke(JSContext * 0x042ba600, unsigned int 4, unsigned int 0) line 807 + 23 bytes js_Interpret(JSContext * 0x042ba600, long * 0x0012f9d0) line 2699 + 15 bytes js_Execute(JSContext * 0x042ba600, JSObject * 0x042d69d8, JSScript * 0x04df0ab0, JSStackFrame * 0x00000000, unsigned int 0, long * 0x0012f9d0) line 986 + 13 bytes JS_EvaluateUCScriptForPrincipals(JSContext * 0x042ba600, JSObject * 0x042d69d8, JSPrincipals * 0x033d6a84, const unsigned short * 0x0012fa8c, unsigned int 23, const char * 0x04e790e8, unsigned int 120, long * 0x0012f9d0) line 3302 + 25 bytes nsJSContext::EvaluateString(nsJSContext * const 0x042ba4f8, const nsAString & {...}, void * 0x042d69d8, nsIPrincipal * 0x033d6a80, const char * 0x04e790e8, unsigned int 120, const char * 0x0111869c, nsAString & {...}, int * 0x0012fa70) line 611 + 85 bytes GlobalWindowImpl::RunTimeout(nsTimeoutImpl * 0x04e89ec0) line 3418 + 97 bytes nsGlobalWindow_RunTimeout(nsITimer * 0x04e89ca0, void * 0x04e89ec0) line 3698 + 15 bytes nsTimer::Fire() line 194 + 17 bytes nsTimerManager::FireNextReadyTimer(nsTimerManager * const 0x033d6988, unsigned int 0) line 117 nsAppShell::Run(nsAppShell * const 0x00d7d070) line 118 nsAppShellService::Run(nsAppShellService * const 0x00d17158) line 425 main1(int 1, char * * 0x00357b60, nsISupports * 0x00000000) line 1296 + 32 bytes main(int 1, char * * 0x00357b60) line 1610 + 37 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! 77e87903()

I'll take it. Johnny's probably doing something else important.

Dan, this yet one more symptom of bug 55459, I know what the problem is, so don't spend time on this unless you really want to :-)

Duping, I'm about to attach a fix to bug 55459 *** This bug has been marked as a duplicate of 55459 ***

verified dup (same stack)