179548 - browser crashes when "close window" mouse gesture is used - Trunk [@ PresShell::HandleEventInternal]

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Philipp Hanes]

User-Agent:       Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.2b) Gecko/20021107
Build Identifier: nightly 2002-11-11-08-trunk [Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.2b) Gecko/2002xxxx]

Other gestures seem to work fine, but the "close window/tab" gesture closes that
window/tab, then crashes Mozilla.
Happens with latest Phoenix build (and a previous mozgest XPI) too.
Did not happen with same mozgest and nightly build from 7 Nov 2002

Reproducible: Always

Steps to Reproduce:
1. Install an optimoz/mozgest XPI
2. restart browser (to get mozgest working)
3. Open a new window or tab, then use "close window/tab" gesture

Actual Results:  
tab or window is closed, then browser crashes

Expected Results:  
just closed the window/tab.  *NOT* crashed.

using classic theme.
Talkback incident IDs:
TB13798895H
TB13799094G
TB13799829E
TB13800770K
TB13800779M
TB13801163E
TB13802401K

Comment 1

[David Bradley]

Attachment: Stack for 13798895

Stack ends with:
PresShell::HandleEventInternal
PresShell::HandleEvent

Comment 2

[Matthias Versen [:Matti]]

-> Events

Comment 3

[Matthias Versen [:Matti]]

*** Bug 179591 has been marked as a duplicate of this bug. ***

Comment 4

[Travis Crump]

'cvs update -j3.578 -j3.576 mozilla/layout/html/base/src/nsPresShell.cpp' fixes
this bug for me on linux so the problem is obviously with that checkin.

Comment 5

[Frederic Bezies]

*** Bug 179792 has been marked as a duplicate of this bug. ***

Comment 6

[Kevin Candiloro]

Error message given:

The instruction at "0x6162a17a" referenced memory at "0x00000000". The memory
could not be "read".

Comment 7

[Jay Patel [:jay]]

Adding topcrash+ and testcase keywords and Trunk [@
PresShell::HandleEventInternal] to summary for tracking.  This crash has spiked
recently with MozillaTrunk builds.

Comment 8

[Jay Patel [:jay]]

Here is the latest from Talkback:

PresShell::HandleEventInternal   50
		 107578 	 RESO 	 FIXE 	 [e-mail] 	 mozilla0.9.9 	 2002-04-17 
BBID range: 13790784 - 13866948
Min/Max Seconds since last crash: 10 - 189817
Min/Max Runtime: 38 - 198840
Crash data range: 2002-11-11 to 2002-11-12
Build ID range: 2002110308 to 2002111208
Keyword List : crash(4), 
Stack Trace: 

	 PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6230]
	 PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6135]
	 nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp  line 2209]
	 nsView::HandleEvent	[c:/builds/seamonkey/mozilla/view/src/nsView.cpp  line 304]
	 nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp  line 1949]
	 HandleEvent	[c:/builds/seamonkey/mozilla/view/src/nsView.cpp  line 83]
	 nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1073]
	 nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1090]
	 nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 5283]
	 ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 5538]
	 nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 4065]
	 nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1339]
	 USER32.dll + 0x3a5f (0x77d43a5f)
	 USER32.dll + 0x3b2e (0x77d43b2e)
	 USER32.dll + 0x3d6a (0x77d43d6a)
	 USER32.dll + 0x3dd0 (0x77d43dd0)
	 nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp  line 472]
	 main1	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1557]
	 main	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1905]
	 WinMain	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1925]
	 WinMainCRTStartup()
	 kernel32.dll + 0x1eb69 (0x77e7eb69)
 
 	Source File : c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp
line : 6230
     (13849053)	Comments: crashes when closing tab with mouse gesture
     (13847326)	Comments: going back one page
     (13847307)	URL: http://www.idg.se
     (13846981)	URL: http://www.idg.se
     (13846981)	Comments: Doing a mouse gesture
     (13835101)	Comments: Repeatable - install mozgest  open up a tab  and close
it with the down-right gesture.  The tab will close  the current tab's page will
repaint  then it crashes.  
     (13829311)	Comments: I just startet mozilla more times in short time with a
hot-key. during this I've clicked the focus on one of this new windows. thats all
     (13823732)	Comments: closing window with mouse gesture
     (13823611)	Comments: Closing browser with mouse gesture
     (13802401)	Comments: close window/tab mouse gesture
     (13801163)	Comments: useing "close window" gesture from optimez/mozgest. 
window closes  then browser crashes.
     (13799710)	Comments: Closing a tab.
     (13799465)	Comments: closed a tab with the down-left mozgest gesture
     (13793120)	Comments: Using mouse gestures to close mozilla causes it to crash.

Comment 9

[Jay Patel [:jay]]

bryner was the last person to touch the code at the line number of the crash (6229):

6221       //Continue with second dispatch to system event handlers
6222       if (mCurrentEventContent) {
6223         rv = mCurrentEventContent->HandleDOMEvent(mPresContext, aEvent,
nsnull, 
6224                                            aFlags |
NS_EVENT_FLAG_SYSTEM_EVENT, aStatus);
6225       }
6226       else {
6227         nsIContent* targetContent;
6228         if (NS_OK == mCurrentEventFrame->GetContentForEvent(mPresContext,
aEvent, &targetContent) && nsnull != targetContent) {
6229           rv = targetContent->HandleDOMEvent(mPresContext, aEvent, nsnull, 
6230                                              aFlags |
NS_EVENT_FLAG_SYSTEM_EVENT, aStatus);
6231           NS_RELEASE(targetContent);
6232         }
6233       }

cc'ing bryner in case he might help.  his last checkin was on 11/8.  if we can
determine that was the cause of this spike in crashes, this bug should be made
zt4newcrash.

Comment 10

[Olivier Cahagne]

bug 180187 should be duped to this one, however, it has a HTML testcase (doesn't
require mouse gesture).

Comment 11

[Brian Ryner (not reading)]

Attachment: fix

Make sure we still have a frame when we dispatch the event to the system event
group, in case the first pass caused the presshell to be destroyed.

Comment 12

[Jay Patel [:jay]]

*** Bug 180187 has been marked as a duplicate of this bug. ***

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 106287 [details] [diff] [review]
fix

(Perhaps it's worth a comment on why you're null-checking, though.)

Comment 14

[Brian Ryner (not reading)]

checked in.