195011 - Dismissing Junk Mail Log dialog crashes Mozilla [@ nsEventListenerManager::HandleEvent]

Status: VERIFIED FIXED

(MailNews Core :: Filters, defect)

Description

[Chris Andrichak]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.3b) Gecko/20030221
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.3b) Gecko/20030221

with spam filtering enabled, if i attempt to turn on the spam log, mozilla
crashes. I have yet to be able to turn on the spam log, it crashed every attempt.
Running Mac OS X 10.2.3

Reproducible: Always

Steps to Reproduce:
1. launch
2. open mail news
3. open spam dialogue
4. attempt to turn on spam log

Actual Results:  
entire browser crashes. Full circle logging does not start.

Expected Results:  
Enabled logging

Comment 1

[Greg K.]

chris, since TalkBack doesn't run, please try to record a stack trace using the
Console application's crash reporting feature.

Also, by "open spam dialog," do you mean Tools/Junk Mail Controls...?

Comment 2

[Chris Andrichak]

Attachment: Crash log

I open the junk mail controls, click on the junk mail log button, and when I
click on the enable logging check box, that's when the program crashes. All I
get then is and alert box saying the program died.
The crash log from the console program is attached.

Comment 3

[Greg K.]

Confirmed using FizzillaMach/2003022103. Merely dismissing the Junk Mail Log
dialog by clicking the OK button is enough to cause the crash.

Comment 4

[Greg K.]

Attachment: Crash report generated by FizzillaMach/2003022103 showing crash at nsEventListenerManager::HandleEvent

Better-formatted crash report.

Comment 5

[Greg K.]

(Do we need a meta-bug about non-TalkBack crashers?)

Comment 6

[Greg K.]

Possible dup of bug 188974.

Comment 7

[Greg K.]

*** Bug 195751 has been marked as a duplicate of this bug. ***

Comment 8

[(not reading, please use [e-mail] instead)]

I'll investigate.

Comment 9

[(not reading, please use [e-mail] instead)]

I'm able to reproduce this with the 1.3 final bits, as well as my own debug
build, but I had to create a new profile to do it.  

(not sure why it wasn't a problem with my existing profile yet.)

Comment 10

[(not reading, please use [e-mail] instead)]

this is some sort of infinite loop where

nsEventStateManager::ShiftFocus() calls ::ShiftFocusInternal() calls
::TabIntoDocument() calls ::ShiftFocus() ...

this could be a dup of #137191

Comment 11

[(not reading, please use [e-mail] instead)]

note, I can reproduce this crash in the classic skin, but not modern.

Comment 12

[(not reading, please use [e-mail] instead)]

here's the stack, early on in the infinite loop.

#0  nsEventStateManager::TabIntoDocument(nsIDocShell*, int) (this=0xe556ec0,
aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5106
#1  0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105
#2  0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246
#3  0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971
#4  0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218
#5  0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971
#6  0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int)
(this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139
#7  0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105
#8  0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246
#9  0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971
#10 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218
#11 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971
#12 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int)
(this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139
#13 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105
#14 0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246
#15 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971
#16 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218
#17 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971
#18 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int)
(this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139
#19 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105
#20 0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246
#21 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971
#22 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218
#23 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971
#24 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int)
(this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139
#25 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105
#26 0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246
#27 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971
#28 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218
#29 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971
#30 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int)
(this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139
#31 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe54faf0) at nsEventStateManager.cpp:3105
#32 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*)
(this=0xe556ec0, aForward=1, aStart=0xe54faf0) at nsEventStateManager.cpp:2971
#33 0x09ac4230 in nsFocusController::MoveFocus(int, nsIDOMElement*)
(this=0xe5494c0, aForward=1, aElt=0xe54faf4) at nsFocusController.cpp:259
#34 0x0f0b555c in
nsXULCommandDispatcher::AdvanceFocusIntoSubtree(nsIDOMElement*) (this=0xe52a120,
aElt=0xe54faf4) at nsXULCommandDispatcher.cpp:206
#35 0x00e50be8 in _XPTC_InvokeByIndex ()
#36 0x00e4ff20 in XPTC_InvokeByIndex (that=0xe52a120, methodIndex=14,
paramCount=1, params=0xbfffa820) at xptcinvoke_ppc_rhapsody.cpp:144
#37 0x022bf45c in XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode) (ccx=@0xbfffab10, mode=CALL_METHOD) at
xpcwrappednative.cpp:2022
#38 0x022c877c in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*,
long*) (cx=0xe549660, obj=0xd727928, argc=1, argv=0xe5b1548, vp=0xbfffac20) at
xpcwrappednativejsops.cpp:1292
#39 0x003b8528 in js_Invoke (cx=0xe549660, argc=1, flags=0) at jsinterp.c:843
#40 0x003c9544 in js_Interpret (cx=0xe549660, result=0xbfffb2f0) at jsinterp.c:2811
#41 0x003b85b0 in js_Invoke (cx=0xe549660, argc=1, flags=2) at jsinterp.c:860
#42 0x003b89c4 in js_InternalInvoke (cx=0xe549660, obj=0xd726680,
fval=225605816, flags=0, argc=1, argv=0x57ef550, rval=0xbfffb590) at jsinterp.c:935
#43 0x00377140 in JS_CallFunctionValue (cx=0xe549660, obj=0xd726680,
fval=225605816, argc=1, argv=0x57ef550, rval=0xbfffb590) at jsapi.c:3432
#44 0x09ac0698 in nsJSContext::CallEventHandler(void*, void*, unsigned, void*,
int*, int) (this=0xe549590, aTarget=0xd726680, aHandler=0xd7278b8, argc=1,
argv=0x57ef550, aBoolResult=0xbfffb6c4, aReverseReturnResult=0) at
nsJSEnvironment.cpp:1039
#45 0x09ada120 in GlobalWindowImpl::RunTimeout(nsTimeoutImpl*) (this=0xe549390,
aTimeout=0x57ef500) at nsGlobalWindow.cpp:4745
#46 0x09adafbc in GlobalWindowImpl::TimerCallback(nsITimer*, void*)
(aTimer=0x57ef5b0, aClosure=0x57ef500) at nsGlobalWindow.cpp:5104
#47 0x00e28d48 in nsTimerImpl::Fire() (this=0x57ef5b0) at nsTimerImpl.cpp:382
#48 0x00e28ff4 in handleTimerEvent(TimerEventType*) (event=0x57ef5f0) at
nsTimerImpl.cpp:447
#49 0x00e1f024 in PL_HandleEvent (self=0x57ef5f0) at plevent.c:663
#50 0x00e1edcc in PL_ProcessPendingEvents (self=0xe547950) at plevent.c:593
#51 0x00e1f740 in _md_EventReceiverProc (nextHandler=0xbfffbb80,
inEvent=0x783f1a89, userData=0xe547950) at plevent.c:1540
#52 0x969a2784 in DispatchEventToHandlers ()
#53 0x969a2aec in SendEventToEventTargetInternal ()
#54 0x969a5efc in SendEventToEventTargetWithOptions ()
#55 0x969b2308 in ToolboxEventDispatcherHandler(OpaqueEventHandlerCallRef*,
OpaqueEventRef*, void*) ()
#56 0x969a283c in DispatchEventToHandlers ()
#57 0x969a2aec in SendEventToEventTargetInternal ()
#58 0x969b4e5c in SendEventToEventTarget ()
#59 0x969b6c20 in ToolboxEventDispatcher(OpaqueEventRef*) ()
#60 0x969c8198 in CallEventDispatchHook ()
#61 0x969b3658 in TryEventDispatcher ()
#62 0x969a40a0 in GetOrPeekEvent ()
#63 0x969a3d4c in GetNextEventMatchingMask ()
#64 0x969a7b70 in WNEInternal ()
#65 0x969ada34 in WaitNextEvent ()
#66 0x067621f4 in nsMacMessagePump::GetEvent(EventRecord&) (this=0xe54ef90,
theEvent=@0x67fd490) at nsMacMessagePump.cpp:408
#67 0x0674e630 in nsAppShell::GetNativeEvent(int&, void*&) (this=0xe54ef70,
aRealEvent=@0xbfffc238, aEvent=@0xbfffc234) at nsAppShell.cpp:231
#68 0x058317f0 in nsXULWindow::ShowModal() (this=0xe547ac0) at nsXULWindow.cpp:293
#69 0x0584909c in nsWebShellWindow::ShowModal() (this=0xe547ac0) at
nsWebShellWindow.cpp:1105
#70 0x0582dad4 in nsContentTreeOwner::ShowAsModal() (this=0xe54dfe0) at
nsContentTreeOwner.cpp:446
#71 0x02b44550 in nsWindowWatcher::OpenWindowJS(nsIDOMWindow*, char const*, char
const*, char const*, int, unsigned, long*, nsIDOMWindow**) (this=0x2fd490,
aParent=0xd5ad2d4, aUrl=0xe5477a0 "chrome://messenger/content/junkLog.xul",
aName=0xbfffc930 "junkLog", aFeatures=0xbfffc870
"chrome,modal,titlebar,resizable,centerscreen", aDialog=1, argc=1,
argv=0xe5456e8, _retval=0xbfffc8c0) at nsWindowWatcher.cpp:789
#72 0x09ad8e7c in GlobalWindowImpl::OpenInternal(nsAString const&, nsAString
const&, nsAString const&, int, long*, unsigned, nsISupports*, nsIDOMWindow**)
(this=0xd5ad2d0, aUrl=@0xbfffca80, aName=@0xbfffcb10, aOptions=@0xbfffcba0,
aDialog=1, argv=0xe5456dc, argc=4, aExtraArgument=0x0, aReturn=0xbfffcdb0) at
nsGlobalWindow.cpp:4385
#73 0x09ad2ec4 in GlobalWindowImpl::OpenDialog(nsIDOMWindow**) (this=0xd5ad2d0,
_retval=0xbfffcdb0) at nsGlobalWindow.cpp:3069
#74 0x00e50be8 in _XPTC_InvokeByIndex ()
#75 0x00e4ff20 in XPTC_InvokeByIndex (that=0xd5ad2d8, methodIndex=16,
paramCount=1, params=0xbfffcdb0) at xptcinvoke_ppc_rhapsody.cpp:144
#76 0x022bf45c in XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode) (ccx=@0xbfffd0a0, mode=CALL_METHOD) at
xpcwrappednative.cpp:2022
#77 0x022c877c in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*,
long*) (cx=0xd618630, obj=0x88cc08, argc=4, argv=0xe5456dc, vp=0xbfffd1b0) at
xpcwrappednativejsops.cpp:1292
#78 0x003b8528 in js_Invoke (cx=0xd618630, argc=4, flags=0) at jsinterp.c:843
#79 0x003c9544 in js_Interpret (cx=0xd618630, result=0xbfffd880) at jsinterp.c:2811
#80 0x003b85b0 in js_Invoke (cx=0xd618630, argc=1, flags=2) at jsinterp.c:860
#81 0x003b89c4 in js_InternalInvoke (cx=0xd618630, obj=0x40dbbf8,
fval=225600904, flags=0, argc=1, argv=0xbfffdb94, rval=0xbfffdb20) at jsinterp.c:935
#82 0x00377140 in JS_CallFunctionValue (cx=0xd618630, obj=0x40dbbf8,
fval=225600904, argc=1, argv=0xbfffdb94, rval=0xbfffdb20) at jsapi.c:3432
#83 0x09ac0698 in nsJSContext::CallEventHandler(void*, void*, unsigned, void*,
int*, int) (this=0xd618560, aTarget=0x40dbbf8, aHandler=0xd726588, argc=1,
argv=0xbfffdb94, aBoolResult=0xbfffdd14, aReverseReturnResult=0) at
nsJSEnvironment.cpp:1039
#84 0x09b0f2e8 in nsJSEventListener::HandleEvent(nsIDOMEvent*) (this=0xd7251f0,
aEvent=0xe53e7c8) at nsJSEventListener.cpp:180
#85 0x0eef899c in nsEventListenerManager::HandleEventSubType(nsListenerStruct*,
nsIDOMEvent*, nsIDOMEventTarget*, unsigned, unsigned) (this=0xd7251b0,
aListenerStruct=0xd611740, aDOMEvent=0xe53e7c8, aCurrentTarget=0xd5c17e0,
aSubType=8, aPhaseFlags=7) at nsEventListenerManager.cpp:1217
#86 0x0eefc2d4 in nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*,
nsIDOMEvent**, nsIDOMEventTarget*, unsigned, nsEventStatus*) (this=0xd7251b0,
aPresContext=0x1e3dbc0, aEvent=0xbfffe7c0, aDOMEvent=0xbfffe2e0,
aCurrentTarget=0xd5c17e0, aFlags=7, aEventStatus=0xbfffe7b4) at
nsEventListenerManager.cpp:2216
#87 0x0f0a735c in nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*,
nsIDOMEvent**, unsigned, nsEventStatus*) (this=0xd725170,
aPresContext=0x1e3dbc0, aEvent=0xbfffe7c0, aDOMEvent=0xbfffe2e0, aFlags=7,
aEventStatus=0xbfffe7b4) at nsXULElement.cpp:3315
#88 0x0ed3f844 in PresShell::HandleDOMEventWithTarget(nsIContent*, nsEvent*,
nsEventStatus*) (this=0xd60ec10, aTargetContent=0xd725170, aEvent=0xbfffe7c0,
aStatus=0xbfffe7b4) at nsPresShell.cpp:6322
#89 0x0ee47d74 in nsButtonBoxFrame::MouseClicked(nsIPresContext*, nsGUIEvent*)
(this=0xd73ce58, aPresContext=0x1e3dbc0, aEvent=0xbfffeb00) at
nsButtonBoxFrame.cpp:199
#90 0x0ee478bc in nsButtonBoxFrame::HandleEvent(nsIPresContext*, nsGUIEvent*,
nsEventStatus*) (this=0xd73ce58, aPresContext=0x1e3dbc0, aEvent=0xbfffeb00,
aEventStatus=0xbffff014) at nsButtonBoxFrame.cpp:143
#91 0x0ed3f664 in PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned,
nsEventStatus*) (this=0xd60ec10, aEvent=0xbfffeb00, aView=0x0, aFlags=1,
aStatus=0xbffff014) at nsPresShell.cpp:6290
#92 0x0ed3f164 in PresShell::HandleEventWithTarget(nsEvent*, nsIFrame*,
nsIContent*, unsigned, nsEventStatus*) (this=0xd60ec10, aEvent=0xbfffeb00,
aFrame=0xd73ce58, aContent=0xd725170, aFlags=1, aStatus=0xbffff014) at
nsPresShell.cpp:6228
#93 0x0ef09ff4 in nsEventStateManager::CheckForAndDispatchClick(nsIPresContext*,
nsMouseEvent*, nsEventStatus*) (this=0xd59fb50, aPresContext=0x1e3dbc0,
aEvent=0xbffff410, aStatus=0xbffff014) at nsEventStateManager.cpp:2850
#94 0x0ef06ee4 in nsEventStateManager::PostHandleEvent(nsIPresContext*,
nsEvent*, nsIFrame*, nsEventStatus*, nsIView*) (this=0xd59fb50,
aPresContext=0x1e3dbc0, aEvent=0xbffff410, aTargetFrame=0xd73ce58,
aStatus=0xbffff014, aView=0x1e3e260) at nsEventStateManager.cpp:1847
#95 0x0ed3f6d8 in PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned,
nsEventStatus*) (this=0xd60ec10, aEvent=0xbffff410, aView=0x1e3e260, aFlags=1,
aStatus=0xbffff014) at nsPresShell.cpp:6295
#96 0x0ed3ee44 in PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*,
int, int&) (this=0xd60ec10, aView=0x1e3e260, aEvent=0xbffff410,
aEventStatus=0xbffff014, aForceHandle=1, aHandled=@0xbffff084) at
nsPresShell.cpp:6183
#97 0x0ce8325c in nsViewManager::HandleEvent(nsView*, nsGUIEvent*, int)
(this=0x1e3e090, aView=0x1e3e260, aEvent=0xbffff410, aCaptured=1) at
nsViewManager.cpp:2206
#98 0x0ce71940 in nsView::HandleEvent(nsViewManager*, nsGUIEvent*, int)
(this=0x1e3e260, aVM=0x1e3e090, aEvent=0xbffff410, aCaptured=1) at nsView.cpp:308
#99 0x0ce825c0 in nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*)
(this=0x1e3e090, aEvent=0xbffff410, aStatus=0xbffff260) at nsViewManager.cpp:1938
#100 0x0ce70d68 in HandleEvent(nsGUIEvent*) (aEvent=0xbffff410) at nsView.cpp:80
#101 0x06788860 in nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&)
(this=0x1e3e2d0, event=0xbffff410, aStatus=@0xbffff320) at nsWindow.cpp:1986
#102 0x06788958 in nsWindow::DispatchWindowEvent(nsGUIEvent&) (this=0x1e3e2d0,
event=@0xbffff410) at nsWindow.cpp:2001
#103 0x06788aa0 in nsWindow::DispatchMouseEvent(nsMouseEvent&) (this=0x1e3e2d0,
aEvent=@0xbffff410) at nsWindow.cpp:2027
#104 0x0675f480 in nsMacEventHandler::HandleMouseUpEvent(EventRecord&)
(this=0xd59c970, aOSEvent=@0xbffff6c0) at nsMacEventHandler.cpp:1658
#105 0x0675cb28 in nsMacEventHandler::HandleOSEvent(EventRecord&)
(this=0xd59c970, aOSEvent=@0xbffff6c0) at nsMacEventHandler.cpp:534
#106 0x0676a5a8 in nsMacWindow::DispatchEvent(void*, int*) (this=0xd608e00,
anEvent=0xbffff6c0, _retval=0xbffff570) at nsMacWindow.cpp:1710
#107 0x0676370c in nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&,
OpaqueWindowPtr*) (this=0x300d80, anEvent=@0xbffff6c0, aWindow=0xd60ca30) at
nsMacMessagePump.cpp:1046
#108 0x06763238 in nsMacMessagePump::DoMouseUp(EventRecord&) (this=0x300d80,
anEvent=@0xbffff6c0) at nsMacMessagePump.cpp:824
#109 0x06762330 in nsMacMessagePump::DispatchEvent(int, EventRecord*)
(this=0x300d80, aRealEvent=1, anEvent=0xbffff6c0) at nsMacMessagePump.cpp:447
#110 0x0676206c in nsMacMessagePump::DoMessagePump() (this=0x300d80) at
nsMacMessagePump.cpp:313
#111 0x0674e124 in nsAppShell::Run() (this=0x2f97b0) at nsAppShell.cpp:120
#112 0x0583de8c in nsAppShellService::Run() (this=0x2f1c10) at
nsAppShellService.cpp:479
#113 0x00006ad4 in main1(int, char**, nsISupports*) (argc=1, argv=0xbffffb84,
nativeApp=0x725b10) at nsAppRunner.cpp:1269
#114 0x000072cc in main (argc=1, argv=0xbffffb84) at nsAppRunner.cpp:1640
#115 0x000027bc in _start (argc=1, argv=0xbffffb84, envp=0xbffffb8c) at
/SourceCache/Csu/Csu-45/crt.c:267
#116 0x0000263c in start ()

Comment 13

[(not reading, please use [e-mail] instead)]

we appear to be bouncing back and forth between two event state managers, I
think one is for the window and one is for the junk log (a browser xul element)

Comment 14

[timeless]

*** This bug has been marked as a duplicate of 137191 ***

Comment 15

[(not reading, please use [e-mail] instead)]

re-opening, not 100% certain this is a dup yet.

that other bug is on winnt, but this is mac only.

the are definitely related.

Comment 16

[(not reading, please use [e-mail] instead)]

see http://bugzilla.mozilla.org/show_bug.cgi?id=137191#c11

"What is the accessibility.tabfocus pref set to?

That pref corresponds to this:
  enum nsTabFocusModel {
  //eTabFocus_textControlsMask = (1<<0),  // unused - textboxes always tabbable
    eTabFocus_formElementsMask = (1<<1),  // non-text form elements
    eTabFocus_linksMask = (1<<2),         // links
    eTabFocus_any = 1 + (1<<1) + (1<<2),  // everything that can be focused
  };

At minimum, textfields are always focusable. However, if that pref is set to 0
or 1, I could imagine an infinite recursion scenario if there are no textfields."

we set this pref to 1 in macprefs.js, which is why this bug is mac only.

Comment 17

[Asa Dotzler [:asa]]

setting aas blocker for now. may not last.

Comment 18

[(not reading, please use [e-mail] instead)]

Attachment: not sure if this is correct, but it's a start. need to talk to aaron and bryner

on win32, this (or something like it?) might fix bug #137191

Comment 19

[(not reading, please use [e-mail] instead)]

I think in both bugs, we the problem is this:

on tab, we find nothing, but there is an iframe (the browser element).  so we 
descend into it, but find nothing to focus, so we pop back out.

when we pop back out, there is nothing, but there is an iframe (the browser 
element).  and now we are looping.

I'll continue to debug.

Comment 20

[(not reading, please use [e-mail] instead)]

Attachment: safeguard against nsEventStateManager::TabIntoDocument() calling itsself (indirectly)

note, this hack will probably only work when there is only one <browser>
elements.

Comment 21

[(not reading, please use [e-mail] instead)]

hmm, I need to look into what mTabbedThroughDocument is for, and if it was
supposed to prevent this type of thing or not.

Comment 22

[(not reading, please use [e-mail] instead)]

mTabbedThroughDocument was for bryner's fix for bug #108791

this bug (and #137191) are different, as they are for a xul document with an
iframe (browser element), and no other focusable widgets.

I've cleaned up the patch slightly, and I'll attach a new version.

Comment 23

[(not reading, please use [e-mail] instead)]

Attachment: updated fix

Comment 24

[(not reading, please use [e-mail] instead)]

should make it for 1.4 alpha, but would be good for 1.3 final.

Comment 25

[(not reading, please use [e-mail] instead)]

Comment on attachment 116913 [details] [diff] [review]
updated fix

locally, I've fixed the comment:

// see bug #95011 and bug #37191
// see bug #195011 and bug #137191

Comment 26

[(not reading, please use [e-mail] instead)]

Comment on attachment 116913 [details] [diff] [review]
updated fix

hoping for review from aaronl and sr (or r) from bryner.

Comment 27

[Aaron Leventhal]

Comment on attachment 116913 [details] [diff] [review]
updated fix

I don't really understand logic in the method TabIntoDocument here:
5135   PRBool focusDocument;
5136   if (!aForward || (itemType == nsIDocShellTreeItem::typeChrome))
5137	 focusDocument = PR_FALSE;
5138   else {
5139	 // Check for a frameset document
5140	 focusDocument = !(IsFrameSetDoc(aDocShell));
5141   }

Why do we only focus a document if we're moving forward and we're in content.
The part about not being in a frameset doc makes sense.

Anyway, why do we only want to set mTabbedDocument if focusDocument is true?

Also, were there any crashes or infinite loops when shift+tab, f6 or shift+f6
are used? [shift]+F6 are the shortcuts for move by document.

What do you think  about renaming mTabbedDocument to something more specific,
something like mTabbingFromDocShell? Just a thought.

Comment 28

[Aaron Leventhal]

> Why do we only focus a document if we're moving forward and we're in content.

I suppose I can answer my own question, after some thought. We don't want to
focus on a XUL document itself, just the things inside of it.

Perhaps the moving forward requirement has to do with the tab order. When you
shift+tab onto a document you want to focus on the last element. When you tab
onto a document you want to focus on the document itself first.

Perhaps we want to put this information comments somewhere in that code.

I guess I understand the patch now. Let me know if it works with [shift]+F6 and
[shift]+Tab, what you think about renaming mTabbingDocument and perhaps
commenting up TabIntoDocument() since you're touching that code anyway.

Comment 29

[Brian Ryner (not reading)]

Comment on attachment 116913 [details] [diff] [review]
updated fix

This is certainly an improvement.  To make the fix completely generic, I think
we'd actually need to keep track of all of the documents that we've recursed
into, and check before we call TabIntoDocument that the document doesn't appear
_anywhere_ on the list.

Comment 30

[(not reading, please use [e-mail] instead)]

aaronl, it does the right thing with with tab, [shift]+tab, F6, and [shift]+F6.

I'll work to modify the fix to work for all sub_shells, as bryner suggests.

Comment 31

[(not reading, please use [e-mail] instead)]

Attachment: patch, following bryner's suggestion. still need to test this...

Comment 32

[(not reading, please use [e-mail] instead)]

should be

+ if (mTabbedDocuments && NS_SUCCEEDED(mTabbedDocuments->GetIndexOf(sub_shell,
&idx)) && idx != -1)

new patch coming...

Comment 33

[Aaron Leventhal]

I still think mTabbedDocuments sounds too much like it relates to tabbed
browsing, could cause confusion.

Comment 34

[(not reading, please use [e-mail] instead)]

Attachment: updated patch

Comment 35

[(not reading, please use [e-mail] instead)]

Comment on attachment 116913 [details] [diff] [review]
updated fix

clearing r/sr requests

Comment 36

[(not reading, please use [e-mail] instead)]

Comment on attachment 117223 [details] [diff] [review]
updated patch

seeing r/sr from aaronl and bryner.

this patch is more generic (as bryner suggested), and the member variable is
named mTabbingThroughDocShells, per aaronl's suggestion in a previous comment.

Comment 37

[(not reading, please use [e-mail] instead)]

actually, would mTabbingFromDocShells be better than mTabbingThroughDocShells?

I'll wait for aaronl or bryner to comment.

Comment 38

[Aaron Leventhal]

Comment on attachment 117223 [details] [diff] [review]
updated patch

Yes, I like mTabbingFromDocShells better :-)

Would it be good to have any safeguards to make sure the array doesn't ever
grow somehow? For example, to clear it out whenever the esm is finished
handling a navigation key?

Comment 39

[(not reading, please use [e-mail] instead)]

Attachment: patch

fix member variable name, and make it so the 
place we add / remove is "fool proof".

still need to re-test.

Comment 40

[(not reading, please use [e-mail] instead)]

Attachment: a version that compiles!

Comment 41

[(not reading, please use [e-mail] instead)]

Comment on attachment 117369 [details] [diff] [review]
a version that compiles!

this is a simpler patch, one where you can see the add and remove are paired
up.

hmm, when written this way, is a isupports array still needed, or is it
overkill?

Comment 42

[Aaron Leventhal]

Comment on attachment 117369 [details] [diff] [review]
a version that compiles!

r=aaronl

Comment 43

[Brian Ryner (not reading)]

Comment on attachment 117369 [details] [diff] [review]
a version that compiles!

nsISupportsArray is deprecated; you can use nsCOMArray instead.

Comment 44

[(not reading, please use [e-mail] instead)]

Attachment: version of the patch that uses nsCOMArray

Comment 45

[(not reading, please use [e-mail] instead)]

Comment on attachment 117454 [details] [diff] [review]
version of the patch that uses nsCOMArray

a version that uses nsCOMArray.

Comment 46

[(not reading, please use [e-mail] instead)]

fixed.

asa, if there was going to be another release off the 1.3 branch, we'd want this.

Comment 47

[(not reading, please use [e-mail] instead)]

*** Bug 188974 has been marked as a duplicate of this bug. ***

Comment 48

[(not reading, please use [e-mail] instead)]

back ported to the 1.3.1 branch.

Comment 49

[esther]

Using trunk build 20030415 on mac osx and retested on winxp and linux with trunk
build 20030415 this does not crash and does work. Verified.