Closed Bug 288406 Opened 19 years ago Closed 19 years ago

crash when dragging bookmark proxy icon (favicon) from Location Bar [@ 0x00000013 + OLE32.DLL - nsDragService::StartInvokingDragSession]

Categories

(Core :: Widget: Win32, defect)

Product:
Core
Component:
Widget: Win32
Platform:
x86
Windows 98
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.8beta2

People

(Reporter: hhschwab, Assigned: roc)

References

Details

(Keywords: crash, regression)

Crash Data

Attachments

(2 files)

backtrace
8.31 KB, text/plain
Details
fix?
3.60 KB, patch
bzbarsky
: review+
bzbarsky
: superreview+
asa
: approval1.8b2+
Details | Diff | Splinter Review 
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050330

crash when dragging bookmark proxy icon (favicon) from Location Bar to Folder in
Personal Toolbar or to Windows Desktop. Working Bookmark on Desktop invokes
Browser when clicked, but can´t be dragged into Location bar.

Talkback Ids: TB4729029G, TB4728956W, TB4728931Z, TB4728904W

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4728904W

Stack Trace  	
0x00000013
OLE32.DLL + 0x52f3a (0x65f52f3a)
OLE32.DLL + 0x533e8 (0x65f533e8)
nsDragService::StartInvokingDragSession 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp,
line 188]
nsDragService::InvokeDragSession 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp,
line 149]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2065]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1293]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3568]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1313]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1390]
JS_CallFunctionValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3804]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1384]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1545]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1642]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2046]
nsEventStateManager::GenerateDragGesture 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1534]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 486]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6285]
PresShell::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6132]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2497]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2217]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1150]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5764]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 6017]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1442]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00638bea
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050329
regressed 1.8b2: 2005033006
Keywords: regression
wfm   Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050329 Firefox/1.0+
crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050330 Firefox/1.0+

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4732278Z

1 day timeframe for regression:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-03-29+00%3A00&maxdate=2005-03-30+06%3A00&cvsroot=%2Fcvsroot

maybe: Bug 255863 unfocused links cannot be drag&dropped quickly ?
Dupe of bug 288006?
(In reply to comment #3)
> Dupe of bug 288006?

No, I´ve not seen this bug on 2 computers, win98 and win98SE, using the 20050329
builds. Using Gecko/20050330 it always is seen on Mozilla suite and tested once
Firefox.

bug 288006 is rv:1.7.6 Gecko/20050318, so older, and Branch instead of Trunk.
Or has this bug been ported yesterday?


Asking for blocking 1.8b2, as it is a recent regression.
Flags: blocking1.8b2?
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050330
I just tested bug 288006, didn´t see it crash. I've dragged the gif below
between two windows. Dragging the favicon instamtly crashed. I also don´t
understand why bug 288006 is filed on trunk, as the crashes are seen on branch only.

https://bugzilla.mozilla.org/mozilla-banner.gif

TB4732893Q

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4732893Q

maybe related:
Bug 233211 Dragging favicon from Location Bar to Personal Toolbar crashes
Mozilla at dropping
Bug 283478 crash when dropping Favicon dragged from Location bar - Trunk [@
nsNativeDragTarget::ProcessDrag][@ 0x00000013 | 0x00000010 -
nsDragService::StartInvokingDragSession ]

Seems I´ve got a subscription on that bug, where can I cancel?
Hermann: Forget about bug 288006, it was my very fast impression, when I saw
XPTC_InvokeByIndex in stack and dragging in description.
Anyone with a debugger on Windows want to give me a hand? A stack trace from the
debugger with local variables would be helpful!
roc, from similar crashes, odds favor one of aDataObj, mNativeDragSrc being
null. i'm very tempted to make all the objects we pass to windows functions not
be properties of this (and no, i can't explain why this would happen) but
instead local variables that have addrefed the corresponding member variables.
Well, one question is whether this is really WIndows only or can be reproduced
somehow on Linux.
Summary: crash when dragging bookmark proxy icon (favicon) from Location Bar → crash when dragging bookmark proxy icon (favicon) from Location Bar [@ 0x00000013 + OLE32.DLL - nsDragService::StartInvokingDragSession]
can't answer that, sorry, we're only developing/testing windows in house :(
Well, I can't reproduce it on Linux. Hmm.
Attached file backtrace — 
Well, this is a backtrace from my freshly debug Mozilla build, in case it is
still needed. I got the crash when dragging a personal bookmark item to the url
bar, though.
If someone needs local variables, I probably need some help to get those, as
I'm not really good at this debugging stuff.
[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050325] (nightly) (W98SE)

(works fine)

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050401] (nightly) (W98SE)

1st time: (I don't find my report on the talkback server :-()

2nd time:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=4817376

We really need to fix this, but it's going to be hard if I can't get it to crash.

Timeless, can you do a Purify run?

I'll try making a GTK1 build in case it crashes there.
My GTK1 build doesn't crash :-(
This bug already regressed twice, seen on Win9x, WinNT4.0, Win2k, WinXP:
Bug 233211 Dragging favicon from Location Bar ... 
was caused/fixed by check-in/backing out 
Bug 20022 :hover state not set until mouse move 

Bug 283478 crash when dropping Favicon dragged from Location bar - Trunk [@
nsNativeDragTarget::ProcessDrag][@ 0x00000013 | 0x00000010 -
nsDragService::StartInvokingDragSession ]
was caused by 
Bug 125386 flyout menu disappears when mouse passes over scrollable div or iframe
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-23+13%3A46&maxdate=2005-02-23+13%3A46&cvsroot=%2Fcvsroot

This regression was fixed by an additional check-in for bug 125386.


Bug 283478 Comment #1 shows a talkback using same functions with slightly
different line numbers, compare to these current Talkbacks:
MozillaTrunk Build ID 2005040805
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4961172W
MozillaTrunk Build ID 2005040905
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4963133W

from comparing the talkbacks you also could reopen 283478.
I´m adding this bugspam as I got new talkbacks when I forgot I shouldn´t drag ...
Blocks: 289705
*** Bug 289721 has been marked as a duplicate of this bug. ***
Blocks: 289642
Assignee: location-bar → win32
Component: Location Bar → Widget: Win32
QA Contact: ian
Attached patch fix? — — Splinter Review 
From discussions on IRC it appears that somehow GenerateDragGesture is being
reentered inside its call to HandleDOMEvent, or something like that. It leads
to drag state being cleared out before we get to use it.

This patch might fix the bug. It should prevent us from doing
GenerateDragGesture again inside HandleDOMEvent.
Assignee: win32 → roc
Status: NEW → ASSIGNED
I'd appreciate it if people could try this patch and give a verdict...
I don't crash so I can't test that aspect but the attached patch does fix bug 288509
For whoever was crashing here (Ctho?) I need feedback on this patch if it's to
make 1.8b2
Blocks: 288509
(In reply to comment #23)
> For whoever was crashing here (Ctho?) I need feedback on this patch if it's to
> make 1.8b2

Seems to work.  I couldn't reproduce well before, but after a lot of dragging
and dropping, it still hasn't crashed.
Comment on attachment 180533 [details] [diff] [review]
fix?

Stop tracking the drag gesture before we fire the DOM event. This prevents us
reentering and reinitiating a new drag/drop session while we're already doing
one. This seems to fix the crash and duplicate drop regressions.
Attachment #180533 - Flags: superreview?(bzbarsky)
Attachment #180533 - Flags: review?(bzbarsky)
Attachment #180533 - Flags: superreview?(bzbarsky)
Attachment #180533 - Flags: superreview+
Attachment #180533 - Flags: review?(bzbarsky)
Attachment #180533 - Flags: review+
Comment on attachment 180533 [details] [diff] [review]
fix?

fixes drag-drop crash regression on Windows, and also fixes "drag-drop drops
twice" bug that screws up bookmark folders.
Attachment #180533 - Flags: approval1.8b2?
Comment on attachment 180533 [details] [diff] [review]
fix?

a=asa
Attachment #180533 - Flags: approval1.8b2? → approval1.8b2+
checked in
Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
Target Milestone: --- → mozilla1.8beta2
This caused bug 291537
Depends on: 291537
Flags: blocking1.8b2?
Crash Signature: [@ 0x00000013 + OLE32.DLL - nsDragService::StartInvokingDragSession]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: