(I have no idea what component this is, actually.) Overview Description: Crash when opening mail compose window with 5 accounts set up Steps to Reproduce: 1) Have five mail or news accounts set up. (I had 1 pop, 2 imap, 2 news.) 2) Open mail compose window. Actual Results: The window will mostly draw, but the app will crash before it finishes. There is no need to do anything with the accounts before clicking "new msg." Expected Results: The app does not crash. Build Date & Platform Bug Found: June 29 Linux. About to try June 30 Windows. Additional Builds and Platforms Tested On: None, but same build was tested on 2 different Linux machines with 2 completely different preference files / test accounts. Additional Information: I asked nbaca to see if she could reproduce this. She found: "I duplicated your findings with the 6/29 build using a profile with 2 pop/2imap/1news account. I tried other variations but these did not produce a crash and they include: - 1imap - 1pop/1imap - 2imap - 2pop " Stack: Program received signal SIGSEGV, Segmentation fault. 0x405422d4 in main_arena () (gdb) where #0 0x405422d4 in main_arena () #1 0xbc840000 in ?? () #2 0x40149f4a in nsSupportsArray::ElementAt () #3 0x4014a75e in nsSupportsArray::GetElementAt () #4 0x40164832 in XPTC_InvokeByIndex () #5 0x40bc1472 in nsXPCWrappedNativeClass::CallWrappedMethod () #6 0x40bc202c in WrappedNative_CallMethod () #7 0x402fc2a2 in js_Invoke () #8 0x40301f3e in js_Interpret () #9 0x402fc2f0 in js_Invoke () #10 0x40301f3e in js_Interpret () #11 0x402fc2f0 in js_Invoke () #12 0x40301f3e in js_Interpret () #13 0x402fc2f0 in js_Invoke () #14 0x40301f3e in js_Interpret () #15 0x402fc2f0 in js_Invoke () #16 0x40301f3e in js_Interpret () #17 0x402fc2f0 in js_Invoke () #18 0x402fc4c5 in js_InternalCall () #19 0x402e7311 in JS_CallFunctionValue () #20 0x4028cd2c in nsJSEventListener::HandleEvent () #21 0x4091f74d in nsEventListenerManager::HandleEvent () #22 0x406f3757 in RDFElementImpl::HandleDOMEvent () #23 0x406f420f in RDFElementImpl::ExecuteJSCode () #24 0x406f3f1e in RDFElementImpl::ExecuteOnChangeHandler () #25 0x406f2b22 in RDFElementImpl::SetAttribute () #26 0x40706134 in RDFXULBuilderImpl::AddAttribute () #27 0x40702ae6 in RDFXULBuilderImpl::OnAssert () #28 0x406de146 in CompositeDataSourceImpl::OnAssert () #29 0x406dfe70 in InMemoryDataSource::Assert () #30 0x406dd860 in CompositeDataSourceImpl::Assert () #31 0x40703b45 in RDFXULBuilderImpl::OnSetAttribute () #32 0x4070cdb3 in XULDocumentImpl::OnSetAttribute () #33 0x406f0bc6 in RDFElementImpl::SetAttribute () #34 0x4074591e in setAttribute () #35 0x407459dc in nsArgCallbacks::ConstructBeforeJavaScript () #36 0x401034f8 in nsWebShellWindow::ExecuteStartupCode () #37 0x40102b01 in nsWebShellWindow::OnEndDocumentLoad () #38 0x401f6d3a in nsWebShell::OnEndDocumentLoad ()

changing severity since this is a crash.

Happens on June 30 Win build, too. See http://cyclone/reports/incidenttemplate.CFM?reportID=1058&style=0&tc=11&cp=1&bbi d=10590136. (I think talkback reports are internal to Netscape only; sorry, others, but it looks somewhat like the stack above.) I should also add that the June 28 Linux build did not do this. I had 2 pop, 2 imap, and one news.

(Platform, qa-assigned, cc housecleaning.)

For win32, the crash is in: nsSupportsArray::ElementAt [d:\builds\seamonkey\mozilla\xpcom\ds\nsSupportsArray.cpp, line 119]

<added to release notes tracking bug for M8>

reassigning to me. I think I have a fix for this. This bug has caused me a lot of pain!!!

I checked in the fix for this at 8:05. I think it made it into this morning's build, but it might not have in which case it will be in this afternoon's build.

I guess I'm supposed to add some more info to this. The problem was that nsSupportsArray::AppendElements was copying over the wrong number of bytes when growing the array. In fact it was only copying over enough bytes to cover 1 identity. However, it was setting the size to be the correct size. Therefore, with a size of 5 and only 1 identity, the moment it tries to access the 2nd or greater identity it crashes. The fix is to copy over all of the identities. I tested this by bringing up the compose window with 5 identities. It didn't crash for me as it had for the past 6 painful hours so I considered it a success.

<adding a note to verah to remove this from the M8 release notes>

OK using jul13 builds on Linux rh5.2, Mac OS 8.51 and NT 4.0. I have a side problem with 5 identities on linux, but will investigate further and log that as a separate issue -- launching compose window with 5 identities present is OK.