19542 - [DOGFOOD] [CRASH] Changing order of bookmarks crashes browser.

Status: VERIFIED FIXED

(SeaMonkey :: General, defect, P3)

Description

[kinmoz]

The browser crashes when I try to change the order of bookmarks in my list.

To reproduce:

1. Start the browser.
2. Select Bookmarks->Manage Bookmarks from the menus
3. Click and hold the mouse button on a bookmark in the list and drag it to
another place in the list and let go of the button.

You should crash with the following stack trace:


nsEventStateManager::UpdateCursor(nsIPresContext & {...}, nsPoint & {...},
nsIFrame * 0x040814d0, nsEventStatus & nsEventStatus_eIgnore) line 923 + 21
bytes
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x0406ded0,
nsIPresContext & {...}, nsGUIEvent * 0x0012fbd0, nsIFrame * 0x040814d0,
nsEventStatus & nsEventStatus_eIgnore, nsIView * 0x04026380) line 178
PresShell::HandleEvent(PresShell * const 0x040243f4, nsIView * 0x04026380,
nsGUIEvent * 0x0012fbd0, nsEventStatus & nsEventStatus_eIgnore) line 2432 + 43
bytes
nsView::HandleEvent(nsView * const 0x04026380, nsGUIEvent * 0x0012fbd0, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 840
nsViewManager::DispatchEvent(nsViewManager * const 0x040250c0, nsGUIEvent *
0x0012fbd0, nsEventStatus & nsEventStatus_eIgnore) line 1724
HandleEvent(nsGUIEvent * 0x0012fbd0) line 69
nsWindow::DispatchEvent(nsWindow * const 0x04026244, nsGUIEvent * 0x0012fbd0,
nsEventStatus & nsEventStatus_eIgnore) line 438 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbd0) line 459
nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3493 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line
3711
nsWindow::ProcessMessage(unsigned int 512, unsigned int 1, long 6160435, long *
0x0012fdfc) line 2756 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00b10684, unsigned int 512, unsigned int 1, long
6160435) line 625 + 27 bytes
USER32! 77e71250()

Comment 1

[Eli Goldberg]

[qa assigning to claudius.]

Comment 2

[Claudius Gayle]

reassigning to likely guilty parties. Guys, is this supposed to work now or should it
just not crash at this point? and what component should bugs like this be under?

Comment 3

[Mike Pinkerton (not reading bugmail)]

placing on dogfood radar.

Comment 4

[Robert John Churchill]

Giving Pink some bug luv...

Comment 5

[leger]

Putting on the PDT- radar.  Must fix for beta, but not mandatory for dogfood.

Comment 6

[Mike Pinkerton (not reading bugmail)]

accepting.

Comment 7

[Mike Pinkerton (not reading bugmail)]

m13, unless you want to take a look at this one, rjc?

Comment 8

[Robert John Churchill]

Mike, try this patch (add the two "RemoveEventListener" lines to the DTOR) and
see if it fixes the crash for you (it does for me):


// Destructor
nsTreeRowGroupFrame::~nsTreeRowGroupFrame()
{
  nsCOMPtr<nsIContent> content;
  GetContent(getter_AddRefs(content));
  nsCOMPtr<nsIDOMEventReceiver> reciever(do_QueryInterface(content));

**  reciever->RemoveEventListener("dragover", mDragCapturer, PR_TRUE);
**  reciever->RemoveEventListener("dragexit", mDragCapturer, PR_TRUE);

  // NOTE: the Remove will delete the drag capturer
  reciever->RemoveEventListenerByIID((nsIDOMDragListener *)mDragCapturer,
nsIDOMDragListener::GetIID());

  NS_IF_RELEASE(mContentChain);
}

Comment 9

[Mike Pinkerton (not reading bugmail)]

this seemed to work. after talking with hyatt, he said just called
RemoveEventListenerByIID() should be enough, but obviously it isn't ;)

good catch rjc, i'll check this in when hyatt's tree regressions clear ;)

Comment 10

[Mike Pinkerton (not reading bugmail)]

fixes checked in. thanks again rjc.

Comment 11

[Steve Lamm]

*** Bug 20525 has been marked as a duplicate of this bug. ***

Comment 12

[Claudius Gayle]

VERIFIED Fixed with 2000011808 build