283478 - crash when dropping Favicon dragged from Location bar - Trunk [@ nsNativeDragTarget::ProcessDrag][@ 0x00000013 | 0x00000010 - nsDragService::StartInvokingDragSession ]

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Hermann Schwab]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050224
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050224

tried to drag Favicon from Location Bar to Personal Toolbar, Folder in Personal
toolbar, content area, bar above Location Bar.
Dropping lets Mozilla crash. The Folders on Personal Toolbar don´t open, when I
want to drag a Favicon into them, they do open, if I drag a link from the
content area.

Reproducible: Always

Steps to Reproduce:
1. drag the little dragon from the Location Bar
2. drop it to Personal Toolbar or somewhere else
3. crash

Actual Results:  
it immediately crashed at releasing the mouse.

Expected Results:  
drop the favicon, just like it does with links dragged from content area.

Talkback IDs Mozilla Suite: TB3908477X, TB3908473W, TB3908143Q, TB3907901X
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3907901X
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3908143Q
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=3907901#id

searching for the signature, I found:
Firefox:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=3907901#id

maybe same:
Bug 283463  	Crash when removing items with Customize Toolbar
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=3909213#id

Comment 1

[Hermann Schwab]

Firefox Bug 283463 Crash when removing items with Customize Toolbar
is looking very similar.

My first crash was moving bookmarks in bookmarks manager, but wasn´t
reproducible. The Favicon crashes reproducible.

Incident ID: 3907901
Stack Signature	0x00000013 c7cbb99e
Product ID	MozillaTrunk
Build ID	2005022405
Trigger Time	2005-02-24 08:26:46.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	
URL visited	
User Comments	Moving bookmarks in Bookmark Manager using drag&drop, crashed at
third bookmark.
Since Last Crash	196 sec
Total Uptime	196 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x00000013
OLE32.DLL + 0x53014 (0x7ff73014)
OLE32.DLL + 0x534c2 (0x7ff734c2)
nsDragService::StartInvokingDragSession 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp,
line 183]
nsDragService::InvokeDragSession 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp,
line 144]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2067]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1293]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3568]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1313]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1390]
JS_CallFunctionValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3804]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1384]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1521]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1618]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2046]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2065]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2065]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2065]
nsEventStateManager::GenerateDragGesture 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1525]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 498]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5994]
PresShell::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5841]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2490]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2212]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1127]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5490]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5747]
KERNEL32.DLL + 0x2317 (0xbff72317)
MouseTrailer::TimerProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsToolkit.cpp,
line 1026]
0xd6f60003
0x61259a09

Comment 2

[Hermann Schwab]

bug Bug 283463 comment 2 mentions timeframe for Firefox Beast build about this:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-23+10%3A00&maxdate=2005-02-24+04%3A43&cvsroot=%2Fcvsroot

my uneducated guess is:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-23+13%3A46&maxdate=2005-02-23+13%3A46&cvsroot=%2Fcvsroot

Comment 3

[timeless]

*** Bug 283463 has been marked as a duplicate of this bug. ***

Comment 4

[u49640]

in case you need any more: TB3908593G, TB3908559H (happend while dragging "Go"
Button from the Toolbar)

Comment 5

[Hermann Schwab]

Firefox Talkbacks: TB3916020Q, TB3915533Y, TB3915483W

minimal testcases:
1. drag favicon a few pixels to the right, then back and drop.
Cursor changes from 'hand' to 'circle' to 'packet'. As long as hand and circle
stay inside the URL box, you can drop without crashing. When it changes to
'packet', the 'packet' is hanging outside the URL-box,  from this point on
Firefox will crash, when you drop, doesn´t matter where.

2. Bookmark Manager
 drag&drop bookmark inside, no crash
 drag bookmark to search filter, crash on drop.
 drag bookmark from BM to somewhere else outside BM, and back in: crash on drop

 

Comment 6

[TimoT]

backing out the fix for bug 125386 fixes this

Comment 7

[Hermann Schwab]

raising Severity to blocker, as Mozilla is pretty unusable on Win9x. You find
yourself dragging, when you didn´t want to, and you know, as soon as you release
the mouse key your browser will crash :-(

can this bugfix be checked out, until it also works on Win9x?


Bug 125386. Turn MOUSE_EXIT events into MOUSE_MOVEs when the mouse didn't
actually leave the top level widget. r+sr=bzbarsky

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-23+13%3A46&maxdate=2005-02-23+13%3A46&cvsroot=%2Fcvsroot

Comment 8

[Boris Zbarsky [:bzbarsky]]

To roc.  We need more testing for this fix, not less, so I would be against
backing it out until we know we won't have a fix anytime soon.

Comment 9

[Bob Clary [:bc] (inactive)]

Crash in 2004-02-24 tbird and seamonkey dragging a message from junk folder in
imap back to inbox in imap. Stack from seamonkey:

nsNativeDragTarget::ProcessDrag(nsNativeDragTarget * const 0x0012ea04,
IDataObject * 0x00000000, unsigned int 1401, unsigned long 2, _POINTL {...},
unsigned long * 0x00000000) line 222 + 6 bytes
nsNativeDragTarget::DragOver(nsNativeDragTarget * const 0x02d24d60, unsigned
long 1, _POINTL {...}, unsigned long * 0x0012eb68) line 288
OLE32! 775f8ede()
OLE32! 775f90c8()
OLE32! 775cfbdf()
OLE32! 775d0038()
nsDragService::StartInvokingDragSession(nsDragService * const 0x02ffcf98,
IDataObject * 0x02ff4d80, unsigned int 3) line 183
nsDragService::InvokeDragSession(nsDragService * const 0x00bfb518, nsIDOMNode *
0x00000001, nsISupportsArray * 0x031bdeb0, nsIScriptableRegion * 0x02ff4d80,
unsigned int 3) line 144 + 15 bytes
XPTC_InvokeByIndex(nsISupports * 0x00bfb518, unsigned int 3, unsigned int 4,
nsXPTCVariant * 0x0012ec10) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
115357528) line 2067 + 22 bytes
XPC_WN_CallMethod(JSContext * 0x02c9a710, JSObject * 0x02e03758, unsigned int 4,
long * 0x00bacd58, long * 0x00bacd40) line 1287 + 10 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 4, unsigned int 0) line 1293 + 17
bytes
js_Interpret(JSContext * 0x02c9a710, unsigned char * 0x02ebd918, long *
0x0012f0ec) line 3568
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 1313 + 12
bytes
js_InternalInvoke(JSContext * 0x02c9a738, JSObject * 0x02ebdd68, long 11804768,
unsigned int 0, unsigned int 1, long * 0x0012f2b0, long * 0x0012f2c0) line 1390
+ 13 bytes
JS_CallFunctionValue(JSContext * 0x02c9a710, JSObject * 0x02ebdd68, long
11804768, unsigned int 1, long * 0x0012f2b0, long * 0x0012f2c0) line 3804 + 26 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x0012ea04, JSObject *
0x02ebdd68, JSObject * 0x00b42060, unsigned int 1, long * 0x0012f2b0, long *
0x0012f2c0) line 1384 + 24 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02c9a710, nsIDOMEvent
* 0x03101ca0) line 184 + 74 bytes
nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const
0x0012ea04, nsListenerStruct * 0x02ecab84, nsIDOMEvent * 0x03101ca0,
nsIDOMEventTarget * 0x030f6e40, unsigned int 51387560, unsigned int 11628784)
line 1521 + 11 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02c348c8,
nsPresContext * 0x00000000, nsEvent * 0x00000001, nsIDOMEvent * * 0x0012f6b0,
nsIDOMEventTarget * 0x030f6e40, unsigned int 7, nsEventStatus * 0x0012f750) line
1618 + 32 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0012ea04, nsPresContext *
0x02d24558, nsEvent * 0x02f4f3d0, nsIDOMEvent * * 0x0012f6b0, unsigned int 7,
nsEventStatus * 0x0012f750) line 2046
nsEventStateManager::GenerateDragGesture(nsEventStateManager * const 0x0012ea04,
nsPresContext * 0x02d24558, nsGUIEvent * 0x02c341d0) line 1525
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x02ca3b28,
nsPresContext * 0x02d24558, nsEvent * 0x0012f9f0, nsIFrame * 0x02f4e504,
nsEventStatus * 0x0012f938, nsIView * 0x02f50aa0) line 498
PresShell::HandleEventInternal(PresShell * const 0x0012ea04, nsEvent *
0x00000000, nsIView * 0x02f50aa0, unsigned int 1, nsEventStatus * 0x0012f938)
line 5994
PresShell::HandleEvent(PresShell * const 0x00000000, nsIView * 0x02f50aa0,
nsGUIEvent * 0x0012f9f0, nsEventStatus * 0x0012f938, int 0, int & 18825368) line
5841 + 19 bytes
nsViewManager::HandleEvent(nsViewManager * const 0x0012ea04, nsView *
0x00000000, nsGUIEvent * 0x0012f9f0, int 0) line 2490
nsViewManager::DispatchEvent(nsViewManager * const 0x02c7e2d8, nsGUIEvent *
0x02f50aa0, nsEventStatus * 0x0012f9ac) line 2212 + 32 bytes
HandleEvent(nsGUIEvent * 0x0012f9f0) line 174
nsWindow::DispatchEvent(nsWindow * const 0x02f50b04, nsGUIEvent * 0x0012f9f0,
nsEventStatus & nsEventStatus_eIgnore) line 1127 + 3 bytes
nsWindow::DispatchWindowEvent(nsWindow * const 0x0012ea04, nsGUIEvent *
0x00000000) line 1148
nsWindow::DispatchMouseEvent(nsWindow * const 0x0012ea04, unsigned int 300,
unsigned int 1, nsPoint * 0x00000000) line 5490
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x0012ea04, unsigned int
300, unsigned int 1, nsPoint * 0x00000000) line 5747 + 19 bytes
nsWindow::ProcessMessage(nsWindow * const 0x0012ea04, unsigned int 512, unsigned
int 1, long 393401, long * 0x0012fd2c) line 4126
nsWindow::WindowProc(HWND__ * 0x00040344, unsigned int 512, unsigned int 1, long
49613572) line 1419 + 16 bytes
USER32! 77d48709()
USER32! 77d487eb()
USER32! 77d489a5()
USER32! 77d489e8()
nsAppShell::Run(nsAppShell * const 0x00ba91c8) line 159
nsAppStartup::Run(nsAppStartup * const 0x00b68830) line 207
main1(int 0, char * * 0x00283f00, nsISupports * 0x00000000) line 1324 + 9 bytes
main(int 1, char * * 0x00283f00) line 1811 + 22 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x00152368,
HINSTANCE__ * 0x00400000) line 1839 + 23 bytes
MOZILLA! WinMainCRTStartup + 308 bytes

  // Set the current action into the Gecko specific type
  nsCOMPtr<nsIDragSession> currSession;
  mDragService->GetCurrentSession ( getter_AddRefs(currSession) );  
=> currSession->SetDragAction(geckoAction);

-	currSession	{...}
-	nsCOMPtr_base	{...}
+	mRawPtr	0x00000000
	geckoAction	2
-	mDragService	0x000001e6
-	nsISupports	{...}
	__vfptr	CXX0030: Error: expression cannot be evaluated
-	this	0x0012ea04
-	IDropTarget	{...}
-	IUnknown	{...}
+	__vfptr	0x00000000
	m_cRef	1239608
+	mHWnd	0x775f8ede
	mCanMove	47336800
+	mWindow	0x00000001
+	mDragService	0x000001e6

Comment 10

[Andreas]

I encountered the same behaviour on Windows 2000 Trunk build 24-Feb.
So this is not isolated to Win 98 alone.
It is not reproducible all the time.

Comment 11

[Hermann Schwab]

(In reply to comment #10)
> I encountered the same behaviour on Windows 2000 Trunk build 24-Feb.
> It is not reproducible all the time.

Did you try the steps to repeat (minimal testcases) I described in comment 5?
They are reproducable crashing, tested on Firefox 20050224 trunk nightly. 

6 talkbacks Firefox:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=283478&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

7 Talkbacks Mozilla:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=0x00000013&vendor=All&product=MozillaTrunk&platform=All&buildid=&sdate=02%2F23%2F2005&stime=00%3A00%3A00&edate=&etime=&sortby=bbid

Comment 12

[Patrick]

also on winxp, Gecko/20050224 Firefox/1.0+, zipped build.
TB3929744Q, TB3929780Z

Comment 13

[Ere Maijala (slow)]

I reopened bug 125386.

Comment 14

[[e-mail]]

*** Bug 283717 has been marked as a duplicate of this bug. ***

Comment 15

[Stephen Donner [:stephend] Not actively reading bugmail]

BTW, this affects Mail, too.  Dragging a message to a folder crashes.

Comment 16

[Steffen Wilberg]

*** Bug 283846 has been marked as a duplicate of this bug. ***

Comment 17

[Rasmus Dietrich]

(In reply to comment #5)
> Firefox Talkbacks: TB3916020Q, TB3915533Y, TB3915483W


Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050225
Firefox/1.0+
On Windows 2000 both testcases are always reproducible
1. As long as the icon doesn't change to "packet", I can drop it without crash.
As soon as it becomes packet, Firefox crashes no matter where I drop it.
2. Crashes only occur when dragging to the search filter or outside of the manager.
I have also experienced the crash wen removing an icon from the toolbar, it
doesn't happen adding one.

Comment 18

[Stephen Donner [:stephend] Not actively reading bugmail]

*** Bug 283894 has been marked as a duplicate of this bug. ***

Comment 19

[:Gavin Sharp [email: [e-mail]]]

*** Bug 283916 has been marked as a duplicate of this bug. ***

Comment 20

[R.K.Aa.]

*** Bug 283927 has been marked as a duplicate of this bug. ***

Comment 21

[Boris Zbarsky [:bzbarsky]]

Guys, we know exactly what's going on here; see discussion in bug 125386.

Comment 22

[Bill Gianopoulos [:WG9s]]

*** Bug 283963 has been marked as a duplicate of this bug. ***

Comment 23

[Hermann Schwab]

*** Bug 283965 has been marked as a duplicate of this bug. ***

Comment 24

[timeless]

*** Bug 283993 has been marked as a duplicate of this bug. ***

Comment 25

[Bill Gianopoulos [:WG9s]]

*** Bug 284011 has been marked as a duplicate of this bug. ***

Comment 26

[Bill Gianopoulos [:WG9s]]

*** Bug 284021 has been marked as a duplicate of this bug. ***

Comment 27

[Bill Gianopoulos [:WG9s]]

This regression was fixed by an additional check-in for bug 125386.

Comment 28

[Hermann Schwab]

Bookmarking my usual way is working again since the patch was checked in.

Comment 29

[Jay Patel [:jay]]

Adding Trunk [@ nsNativeDragTarget::ProcessDrag] to summary since a lot of
Talkback reports are being reported under that stack signature as well. Looks
like a regression from 2/24, hopefully the backout from 125386 fixes this.  I'll
keep an eye on the latest Talkback data.

Comment 30

[timeless]

[e-mail]: there is no backout..., only extra patches