145175 - Dragging and repositioning item on personal toolbar can cause a crash [@ objc_msgSend_stret]

Status: VERIFIED FIXED

(Camino Graveyard :: General, defect)

Description

[Chris Petersen]

Build: 0.2.7
Platform: OS X 10.1.4
Expected Results: Item should be repositioned on toolbar
What I got: Application crashes

Steps to reproduce:

1) Hold down Control key , double-click and mouse down on a item on personal
toolbar.
2) With mouse down, drag the items slightly left of it's original position. You
should see a insertion carat appear. Mouse up to place item down.

3) Crash occurs.



Date/Time:  2002-05-16 23:43:59 -0700
OS Version: 10.1.4 (Build 5Q125)

Command:    Navigator
PID:        596

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xe000003d

Thread 0 Crashed:
 #0   0x706bad20 in objc_msgSend_stret
 #1   0x00024928 in -[CHBookmarksToolbar insertionRectForButton:position:]
 #2   0x000235d8 in -[CHBookmarksToolbar drawRect:]
 #3   0x70c39cf8 in -[NSView _drawRect:clip:]
 #4   0x70c829c8 in -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:]
 #5   0x70bac610 in -[NSView
_recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
 #6   0x70baca00 in -[NSView
_recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
 #7   0x70baca00 in -[NSView
_recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
 #8   0x70bb0760 in -[NSFrameView
_recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
 #9   0x70bac4bc in -[NSThemeFrame
_recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
 #10  0x70be25c8 in -[NSView
_displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:]
 #11  0x70bfc4fc in -[NSView displayIfNeeded]
 #12  0x70c06040 in -[NSWindow displayIfNeeded]
 #13  0x70be31f0 in _handleWindowNeedsDisplay
 #14  0x7017baa4 in __CFRunLoopDoObservers
 #15  0x7017bdd4 in __CFRunLoopRun
 #16  0x701b7100 in CFRunLoopRunSpecific
 #17  0x7017b8e0 in CFRunLoopRunInMode
 #18  0x7312d8f4 in RunEventLoopInModeUntilEventArrives
 #19  0x73140794 in ReceiveNextEventCommon
 #20  0x731715ec in BlockUntilNextEventMatchingListInMode
 #21  0x70bd70b8 in _DPSNextEvent
 #22  0x70bfe5d8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
 #23  0x70c23468 in -[NSApplication run]
 #24  0x70c91ed0 in NSApplicationMain
 #25  0x0000214c in _start
 #26  0x00001f7c in start

Thread 1:
 #0   0x700252fc in select
 #1   0x0015b758 in poll
 #2   0x00157e70 in _pr_poll_with_poll
 #3   0x0204330c in nsSocketTransportService::Run(void)
 #4   0x0022f7e4 in nsThread::Main(void *)
 #5   0x0015932c in _pt_root
 #6   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00154418 in PR_WaitCondVar
 #3   0x0204d4a0 in nsDNSService::DequeuePendingQ(void)
 #4   0x0204cea8 in nsDNSService::Run(void)
 #5   0x0022f7e4 in nsThread::Main(void *)
 #6   0x0015932c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x001541b4 in pt_TimedWait
 #4   0x0015442c in PR_WaitCondVar
 #5   0x0023326c in TimerThread::Run(void)
 #6   0x0022f7e4 in nsThread::Main(void *)
 #7   0x0015932c in _pt_root
 #8   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00154418 in PR_WaitCondVar
 #3   0x00230904 in nsThreadPool::GetRequest(nsIThread *)
 #4   0x00231258 in nsThreadPoolRunnable::Run(void)
 #5   0x0022f7e4 in nsThread::Main(void *)
 #6   0x0015932c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7086c34c in -[NSConditionLock lockWhenCondition:]
 #3   0x70ba1358 in -[NSUIHeartBeat _heartBeatThread:]
 #4   0x70842358 in forkThreadForFunction
 #5   0x7002054c in _pthread_body

Thread 6:
 #0   0x7000497c in syscall
 #1   0x70557600 in BSD_waitevent
 #2   0x7002054c in _pthread_body

Thread 7:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x705593ec in CarbonOperationThreadFunc
 #3   0x7002054c in _pthread_body

Thread 8:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body

PPC Thread State:
  srr0: 0x706bad20 srr1: 0x0000d030                vrsave: 0x00000000
   xer: 0x00000018   lr: 0x00024928  ctr: 0x706bad04   mq: 0x00000000
    r0: 0x00024928   r1: 0xbfffe3f0   r2: 0x03d00ef0   r3: 0xbfffe430
    r4: 0x039cfb40   r5: 0x706e5bf8   r6: 0x039cfb40   r7: 0x00000002
    r8: 0x00000003   r9: 0x000347cc  r10: 0x03d72010  r11: 0x00049318
   r12: 0xe000003d  r13: 0x00000000  r14: 0x00000000  r15: 0x00000000
   r16: 0x00000001  r17: 0x00000000  r18: 0x00000001  r19: 0x00000000
   r20: 0xbffff118  r21: 0x00000001  r22: 0xbfffeb80  r23: 0x02e73ea0
   r24: 0x00000001  r25: 0x00000000  r26: 0x02e86c50  r27: 0x02e86c50
   r28: 0xbfffe4f0  r29: 0x706e5bf8  r30: 0x039cfb40  r31: 0x000247cc

**********

Comment 1

[Greg K.]

WorksForMe using Chimera/20020602.

Comment 2

[Chris Petersen]

Still occurs for me in the 2002-06-04-05 trunk build. The placing the position
of bookmark is important in order to crash. Attaching a screen shot of how to
position bookmark when dragging.

Comment 3

[Chris Petersen]

Attachment: Screenshot of where the bookmark should be moved to before mousing up

Comment 4

[Winnie Lam]

Reproduced on 06-04-05 build.  OS 10.1.4.  Attaching crash log.

Comment 5

[Winnie Lam]

Attachment: Crash log after repositioning item on personal toolbar

Comment 6

[Mike Pinkerton (not reading bugmail)]

-> hewitt, who did the work

Comment 7

[Chris Petersen]

Not only does this crash the browser, it also deletes the bookmark that was
being repositioned on the toolbar. Upon relaunching the application, the
bookmark is missing from the toolbar.

Comment 8

[Winnie Lam]

Attachment: Crash log

Reattaching proper crash log.  Attached wrong crash log in comment #5.

Comment 9

[Mike Pinkerton (not reading bugmail)]

over to brade to see if it happens to be fixed by other bookmark stuff, if not,
we need to fix this.

Comment 10

[Kathleen :Brade]

probably depends on bug 143094 patch

Comment 11

[Mike Pinkerton (not reading bugmail)]

well, personal toolbar bookmark re-arranging has been turned off (*shrug*, don't
ask me why), but even if it was still on, i'm pretty sure that the patch for
143094 would have taken care of it. it does a lot to guarantee you're not
dropping things on themselves.

Comment 12

[Winnie Lam]

Yes, I can no longer rearrange bookmarks on the personal toolbar.  Marking this
as verified.

06-26 build on OS 10.1.5.

Comment 13

[Chris Petersen]

Hmm.. You also can't drag and drop any url to the bookmark toolbar now. Is this
part of the fix too ?

Comment 14

[Mike Pinkerton (not reading bugmail)]

not quite. you can drag items from your bookmarks menu there, but not from the
page proxy or content area. file a new bug.