41138 - Dragging address to compose window crash after 3rd address

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect, P2)

Description

[selmer (gone)]

Open a mail compose window.  Drag several addresses into it from the address
book.  After the third one, no new ones show up in the list even though the drop
zone indicates willingness to have them.

Comment 1

[kmurray1115]

Nominating. Seems like we should be able to drag more than 3 addresses into the 
compose window from the AB.

Comment 2

[Jean-Francois Ducarroz]

Accepting

Comment 3

[Peter Trudelle]

[nsbeta2-]

Comment 4

[sol]

Moving to m18, and added "nsbeta3" and "correctness" keywords. 

If D&D of more than 3 addresses is too difficult, we should not provide D&D for 
any addresses.

Comment 5

[scottputterman]

I'm not sure how you did this, but when dragging them individually it worked 
fine.  However, when multiple selecting addresses and dragging them I crash 
consistently.

Comment 6

[lchiang]

+ per mail triage, but lower priority than other + bugs.

Comment 7

[Jean-Francois Ducarroz]

The easy way to reproduce the problem is to drag several addresses at the same 
time. The crash occurs into nsXULElement::HandleDOMEvent while processing a 
onblurr event. On Mac, we don't crash but hang as we loop for ever in 
HandleDOMEven.

step to reproduce the crash/hang:

1) open a new compose window
2) open the address book
3) have at least 2 entries into you addressbook (personnal or collected AB)
4) select 2 or more addresses and drag them into the compose window adressing 
widget
5) wait few seconds
6) if you are still alive, repeat step 4 & 5
7) ==> Application crash or hang

here is the stack trace (window)
nsXULElement::HandleDOMEvent(nsXULElement * const 0x049002d0, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3355 + 3 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x04905aa0, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3357
nsXULElement::HandleDOMEvent(nsXULElement * const 0x03bc7160, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3357
nsXULElement::HandleDOMEvent(nsXULElement * const 0x03bc6b50, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3357
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0520d520, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3357
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0520d3c0, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3357
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0520d260, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3357
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0520fec0, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3357
nsXULElement::HandleDOMEvent(nsXULElement * const 0x05210a10, nsIPresContext * 
0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 
0x00000004, nsEventStatus * 0x00034468) line 3357
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x0432f390, nsEvent * 
0x00034444, nsIDOMEvent * * 0x00034068, unsigned int 0x00000001, nsEventStatus * 
0x00034468) line 1370
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x0521081c, 
nsIPresContext * 0x0432f390, nsEvent * 0x00034444, nsIDOMEvent * * 0x00000000, 
unsigned int 0x00000001, nsEventStatus * 0x00034468) line 855 + 31 bytes
nsEventStateManager::SendFocusBlur(nsEventStateManager * const 0x04742480, 
nsIPresContext * 0x0432f390, nsIContent * 0x0521081c) line 2344
nsEventStateManager::SetContentState(nsEventStateManager * const 0x04742488, 
nsIContent * 0x0521081c, int 0x00000002) line 2197
nsHTMLInputElement::SetFocus(nsHTMLInputElement * const 0x0521081c, 
nsIPresContext * 0x0432f390) line 664
nsHTMLInputElement::Focus(nsHTMLInputElement * const 0x05210810) line 642 + 28 
bytes
HTMLInputElementFocus(JSContext * 0x042d1540, JSObject * 0x0402fb58, unsigned 
int 0x00000000, long * 0x04036c98, long * 0x000346cc) line 812 + 15 bytes
js_Invoke(JSContext * 0x042d1540, unsigned int 0x00000000, unsigned int 
0x00000000) line 716 + 23 bytes
js_Interpret(JSContext * 0x042d1540, long * 0x00035008) line 2517 + 15 bytes
js_Invoke(JSContext * 0x042d1540, unsigned int 0x00000001, unsigned int 
0x00000002) line 732 + 13 bytes
js_InternalInvoke(JSContext * 0x042d1540, JSObject * 0x0402f8f8, long 
0x0404c638, unsigned int 0x00000000, unsigned int 0x00000001, long * 0x0003519c, 
long * 0x0003512c) line 805 + 19 bytes
JS_CallFunctionValue(JSContext * 0x042d1540, JSObject * 0x0402f8f8, long 
0x0404c638, unsigned int 0x00000001, long * 0x0003519c, long * 0x0003512c) line 
2817 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x042d1b30, void * 0x0402f8f8, 
void * 0x0404c638, unsigned int 0x00000001, void * 0x0003519c, int * 0x00035198, 
int 0x00000000) line 847 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x052e4394) line 154 + 64 bytes
nsXBLEventHandler::ExecuteHandler(nsXBLEventHandler * const 0x05212c40, const 
nsString & {"focus"}, nsIDOMEvent * 0x052e4394) line 688
nsXBLEventHandler::Focus(nsIDOMEvent * 0x052e4394) line 278 + 44 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x0432f390, nsEvent * 
0x00035ec0, nsIDOMEvent * * 0x00035b84, nsIDOMEventTarget * 0x0520fed0, unsigned 
int 0x00000002, nsEventStatus * 0x00035ee8) line 1153 + 23 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0520fec0, nsIPresContext * 
0x0432f390, nsEvent * 0x00035ec0, nsIDOMEvent * * 0x00035b84, unsigned int 
0x00000002, nsEventStatus * 0x00035ee8) line 3368
nsXULElement::HandleDOMEvent(nsXULElement * const 0x05210a10, nsIPresContext * 
0x0432f390, nsEvent * 0x00035ec0, nsIDOMEvent * * 0x00035b84, unsigned int 
0x00000002, nsEventStatus * 0x00035ee8) line 3391 + 39 bytes
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x0432f390, nsEvent * 
0x00035ec0, nsIDOMEvent * * 0x00035b84, unsigned int 0x00000001, nsEventStatus * 
0x00035ee8) line 1395 + 39 bytes
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x0521081c, 
nsIPresContext * 0x0432f390, nsEvent * 0x00035ec0, nsIDOMEvent * * 0x00000000, 
unsigned int 0x00000001, nsEventStatus * 0x00035ee8) line 855 + 31 bytes
nsEventStateManager::SendFocusBlur(nsEventStateManager * const 0x04742480, 
nsIPresContext * 0x0432f390, nsIContent * 0x0521081c) line 2425
nsEventStateManager::SetContentState(nsEventStateManager * const 0x04742488, 
nsIContent * 0x0521081c, int 0x00000002) line 2197
nsHTMLInputElement::SetFocus(nsHTMLInputElement * const 0x0521081c, 
nsIPresContext * 0x0432f390) line 664
nsHTMLInputElement::Focus(nsHTMLInputElement * const 0x05210810) line 642 + 28 
bytes
HTMLInputElementFocus(JSContext * 0x042d1540, JSObject * 0x0402fb58, unsigned 
int 0x00000000, long * 0x04036c6c, long * 0x000361e8) line 812 + 15 bytes
js_Invoke(JSContext * 0x042d1540, unsigned int 0x00000000, unsigned int 
0x00000000) line 716 + 23 bytes
js_Interpret(JSContext * 0x042d1540, long * 0x00036b24) line 2517 + 15 bytes
js_Invoke(JSContext * 0x042d1540, unsigned int 0x00000001, unsigned int 
0x00000002) line 732 + 13 bytes
js_InternalInvoke(JSContext * 0x042d1540, JSObject * 0x0402f8f8, long 
0x0404c5b8, unsigned int 0x00000000, unsigned int 0x00000001, long * 0x00036cb8, 
long * 0x00036c48) line 805 + 19 bytes
JS_CallFunctionValue(JSContext * 0x042d1540, JSObject * 0x0402f8f8, long 
0x0404c5b8, unsigned int 0x00000001, long * 0x00036cb8, long * 0x00036c48) line 
2817 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x042d1b30, void * 0x0402f8f8, 
void * 0x0404c5b8, unsigned int 0x00000001, void * 0x00036cb8, int * 0x00036cb4, 
int 0x00000000) line 847 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x052e3814) line 154 + 64 bytes
nsXBLEventHandler::ExecuteHandler(nsXBLEventHandler * const 0x05212c40, const 
nsString & {"focus"}, nsIDOMEvent * 0x052e3814) line 688
nsXBLEventHandler::Focus(nsIDOMEvent * 0x052e3814) line 278 + 44 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x0432f390, nsEvent * 
0x000379dc, nsIDOMEvent * * 0x000376a0, nsIDOMEventTarget * 0x0520fed0, unsigned 
int 0x00000002, nsEventStatus * 0x00037a04) line 1153 + 23 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0520fec0, nsIPresContext * 
0x0432f390, nsEvent * 0x000379dc, nsIDOMEvent * * 0x000376a0, unsigned int 
0x00000002, nsEventStatus * 0x00037a04) line 3368
nsXULElement::HandleDOMEvent(nsXULElement * const 0x05210a10, nsIPresContext * 
0x0432f390, nsEvent * 0x000379dc, nsIDOMEvent * * 0x000376a0, unsigned int 
0x00000002, nsEventStatus * 0x00037a04) line 3391 + 39 bytes
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x0432f390, nsEvent * 
0x000379dc, nsIDOMEvent * * 0x000376a0, unsigned int 0x00000001, nsEventStatus * 
0x00037a04) line 1395 + 39 bytes
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x0521081c, 
nsIPresContext * 0x0432f390, nsEvent * 0x000379dc, nsIDOMEvent * * 0x00000000, 
unsigned int 0x00000001, nsEventStatus * 0x00037a04) line 855 + 31 bytes
nsEventStateManager::SendFocusBlur(nsEventStateManager * const 0x04742480, 
nsIPresContext * 0x0432f390, nsIContent * 0x0521081c) line 2425
nsEventStateManager::SetContentState(nsEventStateManager * const 0x04742488, 
nsIContent * 0x0521081c, int 0x00000002) line 2197
nsHTMLInputElement::SetFocus(nsHTMLInputElement * const 0x0521081c, 
nsIPresContext * 0x0432f390) line 664
nsHTMLInputElement::Focus(nsHTMLInputElement * const 0x05210810) line 642 + 28 
bytes
[...]

Comment 8

[Jean-Francois Ducarroz]

Something wrong when setting the focus. I tried with autocomplete widget disable 
and the problem still occurs. Reassign to xptoolkit team.

Comment 9

[Heikki Toivonen (remove -bugzilla when emailing directly)]

I see this crash on Linux as well, changing OS to all. Changing severity to 
critical since this is a crasher.

When I run this I get an assertion in 
nsXULTreeOuterGroupFrame::FindRowContentAtIndex. The code is:

  if (!startContent) {
    NS_ERROR("The tree's tick array is confused!");
    return;
  }

At this point the stack trace looks like:

NTDLL! 77f7629c()
nsDebug::Assertion(const char * 0x022bdca8, const char * 0x100c04e0, const char 
* 0x022bdc6c, int 741) line 246 + 13 bytes
nsDebug::Error(const char * 0x022bdca8, const char * 0x022bdc6c, int 741) line 
366 + 22 bytes
nsXULTreeOuterGroupFrame::FindRowContentAtIndex(int & 20, nsIContent * 
0x0475e110, nsIContent * * 0x0012ebf8) line 741 + 21 bytes
nsXULTreeOuterGroupFrame::InternalPositionChanged(nsXULTreeOuterGroupFrame * 
const 0x02f8d468, int 0, int 20) line 543 + 49 bytes
nsXULTreeOuterGroupFrame::EnsureRowIsVisible(int 22) line 949
nsXULTreeFrame::EnsureRowIsVisible(nsXULTreeFrame * const 0x02f8d324, int 22) 
line 117
nsTreeBoxObject::EnsureIndexIsVisible(nsTreeBoxObject * const 0x04b626e0, int 
22) line 85 + 27 bytes
XPTC_InvokeByIndex(nsISupports * 0x04b626e0, unsigned int 3, unsigned int 1, 
nsXPTCVariant * 0x0012ee74) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x04566570, 
nsXPCWrappedNative * 0x04b63160, const XPCNativeMemberDescriptor * 0x04b63274, 
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 1, long * 
0x0411040c, long * 0x0012f024) line 915 + 43 bytes
WrappedNative_CallMethod(JSContext * 0x04566570, JSObject * 0x03f85158, unsigned 
int 1, long * 0x0411040c, long * 0x0012f024) line 226 + 34 bytes
js_Invoke(JSContext * 0x04566570, unsigned int 1, unsigned int 0) line 716 + 23 
bytes
js_Interpret(JSContext * 0x04566570, long * 0x0012f9dc) line 2517 + 15 bytes
js_Execute(JSContext * 0x04566570, JSObject * 0x02f8bcb8, JSScript * 0x0546bba0, 
JSFunction * 0x00000000, JSStackFrame * 0x00000000, unsigned int 0, long * 
0x0012f9dc) line 887 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x04566570, JSObject * 0x02f8bcb8, 
JSPrincipals * 0x00f6fa44, const unsigned short * 0x0012fa98, unsigned int 14, 
const char * 0x0546b610, unsigned int 463, long * 0x0012f9dc) line 2770 + 27 
bytes
nsJSContext::EvaluateString(nsJSContext * const 0x04567100, const nsString & 
{"_awSetFocus();"}, void * 0x02f8bcb8, nsIPrincipal * 0x00f6fa40, const char * 
0x0546b610, unsigned int 463, const char * 0x002fd468, nsString & {""}, int * 
0x0012fa7c) line 525 + 55 bytes
GlobalWindowImpl::RunTimeout(nsTimeoutImpl * 0x0546b6d0) line 3635 + 97 bytes
nsGlobalWindow_RunTimeout(nsITimer * 0x0546b5b0, void * 0x0546b6d0) line 3900 + 
15 bytes
nsTimer::Fire() line 194 + 17 bytes
nsTimerManager::FireNextReadyTimer(nsTimerManager * const 0x00f2a7d0, unsigned 
int 0) line 117
nsAppShell::Run(nsAppShell * const 0x00f2b500) line 113
nsAppShellService::Run(nsAppShellService * const 0x00f28b30) line 387
main1(int 2, char * * 0x00a93070, nsISupports * 0x00000000) line 913 + 32 bytes
main(int 2, char * * 0x00a93070) line 1093 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77f1ba06()

If I just continue I will hit the focus weirdness and eventual crash. (Or 
actually, now that I have worked on my tree a bit I will not hit the focus stuff 
but die somewhere in JS engine).

To recap what I have learned about the way to reproduce this bug:

1. File > New > Message
2. Tasks > Address Book
3.1 Select enough addresses so that one you drag and drop them onto the new 
message address field it wont fit (i.e it must scroll) OR
3.2 Select and D&D one address at a time to the message address space, one under 
the other. It should not crash. Then, drag an address over the first visible 
address so that it actually scrolls upward and presents you with an empty space 
first in the list. Drop the address and you will crash.

Hyatt, I am wondering if this condition of the XUL tree that precedes the crash 
is the real cause. Can you have a look? Pass it back to joki's list if you think 
it is irrelevant or something...

Comment 10

[Peter Trudelle]

As Sol said, we can fix this by disabling d&d here, and we should do that if it
is easier. This is not worth spending a lot of time on, just stop it from
crashing.  Is it just addresses, or are other multiple drags crashing?  cc saari
& pinkerton. 

Comment 11

[Mike Pinkerton (not reading bugmail)]

my push is to fix the crash, not disable the feature.

Comment 12

[David Hyatt]

Drag and drop --> pink

Comment 13

[Mike Pinkerton (not reading bugmail)]

i tried playing with this on macOS and while i couldn't get it to crash, the tree 
got very very confused. There's nothing that d&d could be doing to the tree that 
would confuse it so, it's probably something in the RDF or the tree itself.

Comment 14

[David Hyatt]

Mass-accepting.

Comment 15

[Peter Trudelle]

P2

Comment 16

[Jan Carpenter]

changing qa contact to ckritzer

Comment 17

[Phil Peterson]

PDT agrees P2

Comment 18

[David Hyatt]

Fixed.

Comment 19

[ckritzer (gone)]

Marking VERIFIED FIXED on:
- LinuxRH62 2000-09-07-08-M18 Commercial
- Win98     2000-09-07-08-M18 Mozilla
- MacOS86   2000-09-07-04-M18 Commercial