bring up mail news. click on a message in the thread page. the first message works, second message you click causes this crash: #0 0x400ae2ea in nsWidget::Destroy (this=0x82f83c8) at nsWidget.cpp:128 #1 0x400ae15e in nsWidget::~nsWidget (this=0x82f83c8, __in_chrg=3) at nsWidget.cpp:87 #2 0x400b0a2e in nsWindow::~nsWindow (this=0x82f83c8, __in_chrg=3) at nsWindow.cpp:101 #3 0x400b1a97 in ChildWindow::~ChildWindow (this=0x82f83c8, __in_chrg=3) at nsWindow.cpp:661 #4 0x400b1b7c in nsBaseWidget::Release (this=0x82f83c8) at nsBaseWidget.cpp:31 #5 0x402aae9b in nsWebShell::~nsWebShell (this=0x82f7d38, __in_chrg=3) at nsWebShell.cpp:522 #6 0x402ab3a3 in nsWebShell::Release (this=0x82f7d38) at nsWebShell.cpp:600 #7 0x402ab20f in nsWebShell::ReleaseChildren (this=0x82056d8) at nsWebShell.cpp:581 #8 0x402ab907 in nsWebShell::Embed (this=0x82056d8, aContentViewer=0x83079d0, aCommand=0x83a1da0 "view", aExtraInfo=0x0) at nsWebShell.cpp:732 #9 0x402a7659 in nsDocumentBindInfo::OnStartBinding (this=0x841a9a0, aURL=0x833f988, aContentType=0x824a710 "text/html") at nsDocLoader.cpp:2180 #10 0x402885ab in NET_NGLayoutConverter (format_out=38, converter_obj=0x0, URL_s=0x833fa80, context=0x83074f0) at nsStubContext.cpp:942 #11 0x402614dd in NET_StreamBuilder (format_out=38, URL_s=0x833fa80, context=0x83074f0) at mkstream.c:237 #12 0x40238c9b in NET_PluginStream (fmt=38, data_obj=0x0, URL_s=0x833fa80, w=0x83074f0) at cvplugin.cpp:214 #13 0x402614dd in NET_StreamBuilder (format_out=38, URL_s=0x833fa80, context=0x83074f0) at mkstream.c:237 #14 0x401a173f in net_setup_file_stream (cur_entry=0x8307638) at mkfile.c:783 #15 0x401a2511 in net_ProcessFile (cur_entry=0x8307638) at mkfile.c:1319 #16 0x4025846f in NET_ProcessNet (ready_fd=0x0, fd_type=1) at mkgeturl.c:3355 #17 0x40260351 in NET_PollSockets () at mkselect.c:298 #18 0x40281a72 in nsNetlibService::NetPollSocketsCallback (aTimer=0x83074c8, aClosure=0x8124118) at nsNetService.cpp:1263 #19 0x4016ade9 in TimerImpl::FireTimeout (this=0x83074c8) at nsTimer.cpp:73 #20 0x4016b2d2 in nsTimerExpired (aCallData=0x83074c8) at nsTimer.cpp:189 #21 0x40a98c11 in ?? () from /usr/lib/libglib-1.2.so.0 #22 0x40a97dd2 in ?? () from /usr/lib/libglib-1.2.so.0 #23 0x40a983bb in ?? () from /usr/lib/libglib-1.2.so.0 #24 0x40a98571 in ?? () from /usr/lib/libglib-1.2.so.0 #25 0x409bf15b in ?? () from /usr/lib/libgtk-1.2.so.0 #26 0x400a28d8 in nsAppShell::Run (this=0x809a940) at nsAppShell.cpp:202 #27 0x40019c59 in nsAppShellService::Run (this=0x8133500) at nsAppShellService.cpp:186 #28 0x804b884 in main (argc=2, argv=0xbffffa24) at nsAppRunner.cpp:447 this is after I rebuilt with mscott's fix for 5477

setting milestone to m5, like bug 5477

Seth, how did you build up your Inbox? Did you do Get New Msgs or did you add the messages from 4.5 to your Inbox and then compacted. There was a problem with pop that David B and I just fixed a few minutes ago, that was causing only one message to really get written to your berkley mail folder. Here's an idea: del your Inbox and Inbox.msf files. Run 4.5 and add a few messages to your Inbox. Compact the folder. Now run mozilla. Can you display more than just the first message now? If yes, then we already fixed this bug, if no then we have a M5 bug =). My linux build isn't done yet. As soon as it is I'll investigate.

I followed you instructions and create a new Inbox. I still get the crash.

Can you display any message as the first message or just the first message? i.e. can you select the 5th one see it display correctly and then selecting the 3rd one crashes? Or is a bug where you can only see message number 1 and all others crash...

no matter which one it is, the first message I click on works. the second one I click on crashes, no matter which one it is.

Adding Kipp to the cc list. Kipp, I've been going through the build logs and see that you checked in some refcounting bug fixes into gtk on the 19th. Before your fixes the child window never called nsWidget::Destroy. Now it does and now we're crashing when loading another message in the thread pane. The stack trace is part of this bug report. I don't *think* (doesn't mean there isn't one) there is a ref counting problem on the mailnews side. We have a web shell and we are loading a new document into that web shell. You can see at the beginning of the stack trace where the docloader gets the on start binding for the new xml file representing the message. The webshell then turns around and releases all children which are causing this crash. This is an M5 stopper for us. I'm hoping you might have some insight. Thanks!

*** Bug 5581 has been marked as a duplicate of this bug. ***

I'm going to re-assign this to kipp. The ref counting logic between a webshell, a widget and a window are pretty far below the mailnews level of asking a webshell to load a document. I've looked through the build logs and it looks like Kipp made some recent changes to this code to fix some ref counting problems. One extra piece of information that may help Kipp: when displaying a message, we actually load html code into the webshell for the message pane which causes creation of two iframes (and two new webshells inside the message pane webshell) to display the header and the body of the message. Let me know if I can help....

*** Bug 5600 has been marked as a duplicate of this bug. ***

Since we don't have today's builds yet to work with, I'll just mention this crash I'm seeing on Windows NT using 4/27 build which may be this same root cause. I'll check again when the new builds are out, but wanted to note the problem. On 4/27 windows build there is no problem displaying messages in sequence. I can display several messages in sequence with no crash. However, I can crash consistently if I click ahead, i.e. rapidly click down the thread pane's list of messages or select various messages rapidly out of sequence. After a few clicks, messages seem to mismatch or display can't keep up with my clicks/selections. On my machine it crashes within about 4-5 clicks, on faster machines it takes more clicks/selections. In the three machine cases I've tried, all were using basic text messages.

*** Bug 5626 has been marked as a duplicate of this bug. ***

*** Bug 5618 has been marked as a duplicate of this bug. ***

Putting on QA Blocker radar.

My comments dated 4/28 about Windows build crasher when selecting quickly through the inbox has been moved to new bug #5719 and assigned to mscott as he requested.

Fixed. I tested it by using the "Get news" button and the "news demo" menu item to switch back and forth between messages several times. I failed miserably to get it to read a copy of my 4.5 sent mail folder (copied and renamed to inbox in a new directory that I hand configured into prefs50.js...)

I pulled and built, and it seems to be fixed my build. (kipp, if you are having problems setting up mail / news, let me know and I'll be glad to help.)

Works OK using 1999043008 on Linux. Marking verified.