Closed Bug 55909 Opened 24 years ago Closed 24 years ago

crash dragging items in trees, e.g. "manage bookmarks" window

Categories

(Core :: XUL, defect, P3)

Product:
Core
Component:
XUL
Type:
defect

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: waterson, Assigned: hyatt)

References

Details

(Keywords: crash, topcrash, Whiteboard: [dogfood-] [rtm-])

Attachments

(1 file)

Patch
1.25 KB, patch
Details | Diff | Splinter Review 
To reproduce,

1. Open the "Manage Bookmarks" window (Bookmarks->Manage Bookmarks)
2. Open the "Personal Toolbar Folder" folder
3. Add a folder to the "Personal Toolbar Folder" folder called "Test".
4. Return to the browser window. Bookmark a page using "Bookmarks->Add
   Bookmark". This is "Bookmark One"
5. Return to the "Manage Bookmarks" window. Use drag and drop to place
   bookmark one in the folder called "Test"
6. Turn the twisty on "Test" so that it's contents are visible.
7. Return to the browser window. Bookmark another page using "Bookmarks->Add
   Bookmark". This is "Bookmark Two".
8. Return to the "Manage Bookmarks" window. Drag bookmark two between
   the "Test" folder and bookmark one.

Expected: bookmark is added to "Test" folder.
Actual: crash!

Looks to be like we're QI()-ing a nuked frame. Here's the stack trace.

02e6378c()
nsXULTreeGroupFrame::GetFirstTreeBox(nsXULTreeGroupFrame * const 0x02dc3944, 
int * 0x00000000) line 223
nsTreeLayout::LazyRowCreator(nsTreeLayout * const 0x02dd5b68, nsBoxLayoutState 
& {...}, nsXULTreeGroupFrame * 0x00000285) line 308 + 14 bytes
nsTreeLayout::LazyRowCreator(nsTreeLayout * const 0x02dd5b68, nsBoxLayoutState 
& {...}, nsXULTreeGroupFrame * 0x00000285) line 320
nsXULTreeOuterGroupFrame::ReflowFinished(nsXULTreeOuterGroupFrame * const 
0x02dd5b68, nsIPresShell * 0x020a1768, int * 0x0012c56c) line 1248
PresShell::HandlePostedReflowCallbacks(PresShell * const 0x02dc3944) line 3658
PresShell::ProcessReflowCommands(PresShell * const 0x02dc3944, int 0) line 4712
PresShell::FlushPendingNotifications(PresShell * const 0x020a1768) line 3722
PresShell::AppendReflowCommand(PresShell * const 0x020a1768, nsIReflowCommand * 
0x02e41b10) line 2717
nsFrame::CreateAndPostReflowCommand(nsIPresShell * 0x02e41b10, nsIFrame * 
0x02d844e8, nsIReflowCommand::ReflowType ReflowDirty, nsIFrame * 0x00000000, 
nsIAtom * 0x00000000 {???}, nsIAtom * 0x00000000 {???}) line 3600
nsContainerFrame::ReflowDirtyChild(nsContainerFrame * const 0x02d844b0, 
nsIPresShell * 0x020a1768, nsIFrame * 0x02d844e8) line 313 + 20 bytes
nsBox::RelayoutDirtyChild(nsBox * const 0x21c01004, nsBoxLayoutState & {...}, 
nsIBox * 0x020a1768) line 460 + 18 bytes
nsBox::RelayoutDirtyChild(nsBox * const 0x21801004, nsBoxLayoutState & {...}, 
nsIBox * 0x02db6438) line 454 + 11 bytes
nsBox::RelayoutDirtyChild(nsBox * const 0x20c01034, nsBoxLayoutState & {...}, 
nsIBox * 0x02e014d8) line 454 + 11 bytes
nsBox::RelayoutDirtyChild(nsBox * const 0x00801034, nsBoxLayoutState & {...}, 
nsIBox * 0x02db6f64) line 454 + 11 bytes
nsBox::RelayoutDirtyChild(nsBox * const 0x20c01004, nsBoxLayoutState & {...}, 
nsIBox * 0x02e0080c) line 454 + 11 bytes
nsBox::RelayoutDirtyChild(nsBox * const 0x20c03004, nsBoxLayoutState & {...}, 
nsIBox * 0x02db6e6c) line 454 + 11 bytes
nsBox::RelayoutDirtyChild(nsBox * const 0x00803030, nsBoxLayoutState & {...}, 
nsIBox * 0x02dc38b4) line 454 + 11 bytes
nsBox::RelayoutDirtyChild(nsBox * const 0x00801024, nsBoxLayoutState & {...}, 
nsIBox * 0x00000000) line 454 + 11 bytes
nsBox::MarkDirtyChildren(nsBox * const 0x02dc38b4, nsBoxLayoutState & {...}) 
line 292
nsXULTreeGroupFrame::ReverseDestroyRows(nsXULTreeGroupFrame * const 0x02dc3944, 
int & 0) line 611
nsXULTreeGroupFrame::ReverseDestroyRows(nsXULTreeGroupFrame * const 0x02dc3944, 
int & 0) line 589
nsXULTreeOuterGroupFrame::InternalPositionChanged(nsXULTreeOuterGroupFrame * 
const 0x02e10f20, int 1, int 1) line 675
nsXULTreeOuterGroupFrame::ScrollToIndex(nsXULTreeOuterGroupFrame * const 
0x02dc3944, int 1) line 1161
nsXULTreeGroupFrame::OnContentRemoved(nsXULTreeGroupFrame * const 0x02dc3944, 
nsIPresContext * 0x00000002, nsIFrame * 0x02e3692c, int 5) line 484
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x0226f590, 
nsIPresContext * 0x02debdf8, nsIContent * 0x00c2f2e0 {"treechildren"}, 
nsIContent * 0x02e8c2d0, int 5) line 9214
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x0226f0a8, nsIPresContext * 
0x01f4e558, nsIContent * 0x02e391a8, nsIContent * 0x02e8c2d0, int 5) line 1166
PresShell::ContentRemoved(PresShell * const 0x020a1770, nsIDocument * 
0x00d2c1a0, nsIContent * 0x02e391a8, nsIContent * 0x02e8c2d0, int 5) line 3866
nsXULDocument::ContentRemoved(nsXULDocument * const 0x00d2c1a0, nsIContent * 
0x02e391a8, nsIContent * 0x02e8c2d0, int 5) line 1785
nsXULElement::RemoveChildAt(nsXULElement * const 0x02de6e80, int 5, int 1) line 
2513
nsXULTemplateBuilder::RemoveMember(nsXULTemplateBuilder * const 0x02dc3944, 
nsIContent * 0x0227f570, nsIRDFResource * 0x02e8c2d0, int 1) line 6020 + 15 
bytes
nsXULTemplateBuilder::Retract(nsXULTemplateBuilder * const 0x02dc3944, 
nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 
{"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 4771
nsXULTemplateBuilder::OnUnassert(nsXULTemplateBuilder * const 0x01ff9be0, 
nsIRDFDataSource * 0x0229b6f0, nsIRDFResource * 0x00d6a550 
{"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 
{"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 4814
CompositeDataSourceImpl::OnUnassert(CompositeDataSourceImpl * const 0x00000000, 
nsIRDFDataSource * 0x00d6a4f4, nsIRDFResource * 0x00d6a550 
{"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 
{"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 1473 
+ 16 bytes
nsBookmarksService::OnUnassert(nsBookmarksService * const 0x00000004, 
nsIRDFDataSource * 0x00d6c3f0, nsIRDFResource * 0x00d6a550 
{"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 
{"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 4715
InMemoryDataSource::Unassert(InMemoryDataSource * const 0x00000001, 
nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 
{"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 1262
nsBookmarksService::Unassert(nsBookmarksService * const 0x00d6a4f4, 
nsIRDFResource * 0x00d6a550 {"NC:BookmarksRoot"}, nsIRDFResource * 0x01eceb00 
{"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, nsIRDFNode * ...) line 2977 
+ 16 bytes
RDFContainerImpl::RemoveElementAt(RDFContainerImpl * const 0x01eceb00 
{"http://www.w3.org/1999/02/22-rdf-syntax-ns#_16"}, int 32303536, int 1, 
nsIRDFNode * * 0x0012cd38) line 346
XPTC_InvokeByIndex(nsISupports * 0x02e867f8, unsigned int 11, unsigned int 3, 
nsXPTCVariant * 0x0012cd18) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(nsXPCWrappedNativeClass * const 
0x02dc3944, JSContext * 0x02191808, nsXPCWrappedNative * 0x02e86aa8, const 
XPCNativeMemberDescriptor * 0x02e8694c, nsXPCWrappedNativeClass::CallMode 
50331648, unsigned int 3, long * 0x02e6f698, long * 0x0012ce98) line 913 + 41 
bytes
WrappedNative_CallMethod(JSContext * 0x02275d58, JSObject * 0x02e6e2f0, 
unsigned int 3, long * 0x02e6f698, long * 0x0012ce98) line 228 + 99 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 3, unsigned int 0) line 790 + 17 
bytes
js_Interpret(JSContext * 0x02191808, long * 0x0012d0d4) line 2589 + 14 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 807 + 10 
bytes
js_InternalInvoke(JSContext * 0x00000000, JSObject * 0x02288a10, long 48685720, 
unsigned int 0, unsigned int 1, long * 0x0012d294, long * 0x0012d1dc) line 879 
+ 13 bytes
JS_CallFunctionValue(JSContext * 0x02191808, JSObject * 0x02288a10, long 
48685720, unsigned int 1, long * 0x0012d294, long * 0x0012d1dc) line 3193 + 25 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x00b7eae8, void * 
0x02288a10, void * 0x02e6e298, unsigned int 1, void * 0x0012d294, int * 
0x0012d298, int 0) line 907 + 25 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02dc3944, 
nsIDOMEvent * 0x02e8626c) line 154 + 32 bytes
nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const 
0x02dc3944, nsListenerStruct * 0x021419b0, nsIDOMEvent * 0x02e8626c, 
nsIDOMEventTarget * 0x0227f578, unsigned int 48783988, unsigned int 12788032) 
line 788 + 8 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02dc3944, 
nsIPresContext * 0x00000000, nsEvent * 0x0012e508, nsIDOMEvent * * 0x00000000, 
nsIDOMEventTarget * 0x0227f578, unsigned int 2, nsEventStatus * 0x0012e4d4) 
line 1511 + 16 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, 
nsEventStatus * 0x0012e4d4) line 3301
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, 
nsEventStatus * 0x0012e4d4) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, 
nsEventStatus * 0x0012e4d4) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, 
nsEventStatus * 0x0012e4d4) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, 
nsEventStatus * 0x0012e4d4) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, 
nsEventStatus * 0x0012e4d4) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, 
nsEventStatus * 0x0012e4d4) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 2, 
nsEventStatus * 0x0012e4d4) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012e508, nsIDOMEvent * * 0x0012e2ec, unsigned int 1, 
nsEventStatus * 0x0012e4d4) line 3320
PresShell::HandleEventInternal(PresShell * const 0x02dc3944, nsEvent * 
0x02e566b8, nsIView * 0x02e08518, unsigned int 1, nsEventStatus * 0x0012e4d4) 
line 4420 + 22 bytes
PresShell::HandleEvent(PresShell * const 0x020a1768, nsIView * 0x02e08518, 
nsGUIEvent * 0x0012e508, nsEventStatus * 0x0012e4d4, int 0, int & 1) line 4349 
+ 17 bytes
nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x0012e508, 
unsigned int 8, nsEventStatus * 0x0012e4d4, int 0, int & 1) line 379
nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x02e08518, 
unsigned int 8, nsEventStatus * 0x0012e4d4, int 0, int & 1) line 352
nsView::HandleEvent(nsView * const 0x00000006, nsGUIEvent * 0x020ed210, 
unsigned int 28, nsEventStatus * 0x0012e4d4, int 1, int & 1) line 352
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x00000726, nsGUIEvent * 
0x000000b1, nsEventStatus * 0x0012e4d4) line 1439
HandleEvent(nsGUIEvent * 0x02104008) line 68
nsWindow::DispatchEvent(nsWindow * const 0x02190d44, nsGUIEvent * 0x0012e508, 
nsEventStatus & nsEventStatus_eIgnore) line 681 + 6 bytes
nsNativeDragTarget::DispatchDragDropEvent(nsNativeDragTarget * const 
0x02dc3944, unsigned int 0, _POINTL {...}) line 183 + 26 bytes
nsNativeDragTarget::ProcessDrag(nsNativeDragTarget * const 0x02dc3944, 
IDataObject * 0x02e7dd38, unsigned int 1403, unsigned long 2, _POINTL {...}, 
unsigned long * 0x00c78efc) line 209
nsNativeDragTarget::Drop(nsNativeDragTarget * const 0x02e08178, IDataObject * 
0x02e7dd38, unsigned long 0, _POINTL {...}, unsigned long * 0x0012e70c) line 308
OLE32! 77b1f8fa()
OLE32! 77b1fad1()
OLE32! 77af5545()
OLE32! 77af5307()
nsDragService::StartInvokingDragSession(nsDragService * const 0x00000002, 
IDataObject * 0x02e7dd38, unsigned int 3) line 144
nsDragService::InvokeDragSession(nsDragService * const 0x00c78ef8, nsIDOMNode * 
0x02e75678, nsISupportsArray * 0x02e75678, nsIScriptableRegion * 0x00000001, 
unsigned int 3) line 110 + 15 bytes
XPTC_InvokeByIndex(nsISupports * 0x00c78ef8, unsigned int 3, unsigned int 4, 
nsXPTCVariant * 0x0012e788) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(nsXPCWrappedNativeClass * const 
0x02dc3944, JSContext * 0x02191808, nsXPCWrappedNative * 0x02e7dac8, const 
XPCNativeMemberDescriptor * 0x02dd71fc, nsXPCWrappedNativeClass::CallMode 
67108864, unsigned int 4, long * 0x02e6f52c, long * 0x0012e908) line 913 + 41 
bytes
WrappedNative_CallMethod(JSContext * 0x00d40400, JSObject * 0x02e6d760, 
unsigned int 4, long * 0x02e6f52c, long * 0x0012e908) line 228 + 99 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 4, unsigned int 0) line 790 + 17 
bytes
js_Interpret(JSContext * 0x02191808, long * 0x0012eb44) line 2589 + 14 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 807 + 10 
bytes
js_InternalInvoke(JSContext * 0x00000000, JSObject * 0x02288a10, long 48682216, 
unsigned int 0, unsigned int 1, long * 0x0012ed04, long * 0x0012ec4c) line 879 
+ 13 bytes
JS_CallFunctionValue(JSContext * 0x02191808, JSObject * 0x02288a10, long 
48682216, unsigned int 1, long * 0x0012ed04, long * 0x0012ec4c) line 3193 + 25 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x00b7eae8, void * 
0x02288a10, void * 0x02e6d4e8, unsigned int 1, void * 0x0012ed04, int * 
0x0012ed08, int 0) line 907 + 25 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02dc3944, 
nsIDOMEvent * 0x02e76bd4) line 154 + 32 bytes
nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const 
0x02dc3944, nsListenerStruct * 0x021419b0, nsIDOMEvent * 0x02e76bd4, 
nsIDOMEventTarget * 0x0227f578, unsigned int 48720860, unsigned int 12788232) 
line 788 + 8 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02dc3944, 
nsIPresContext * 0x00000000, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x00000000, 
nsIDOMEventTarget * 0x0227f578, unsigned int 2, nsEventStatus * 0x0012f7cc) 
line 1511 + 16 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f71c, unsigned int 2, 
nsEventStatus * 0x0012f7cc) line 3301
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f71c, unsigned int 2, 
nsEventStatus * 0x0012f7cc) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f71c, unsigned int 2, 
nsEventStatus * 0x0012f7cc) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f71c, unsigned int 2, 
nsEventStatus * 0x0012f7cc) line 3320
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x01f4e558, nsEvent * 0x02e76bdc, nsIDOMEvent * * 0x0012f71c, unsigned int 1, 
nsEventStatus * 0x0012f7cc) line 3320
nsEventStateManager::GenerateDragGesture(nsEventStateManager * const 
0x02dc3944, nsIPresContext * 0x01f4e558, nsGUIEvent * 0x02e33dd0) line 781
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x02d88028, 
nsIPresContext * 0x01f4e558, nsEvent * 0x0012fafc, nsIFrame * 0x02e54820, 
nsEventStatus * 0x0012fabc, nsIView * 0x02e08518) line 304
PresShell::HandleEventInternal(PresShell * const 0x02dc3944, nsEvent * 
0x0012fafc, nsIView * 0x02e08518, unsigned int 1, nsEventStatus * 0x0012fabc) 
line 4411
PresShell::HandleEvent(PresShell * const 0x020a1768, nsIView * 0x02e08518, 
nsGUIEvent * 0x0012fafc, nsEventStatus * 0x0012fabc, int 1, int & 1) line 4349 
+ 17 bytes
nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x0012fafc, 
unsigned int 28, nsEventStatus * 0x0012fabc, int 1, int & 1) line 379
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x00000339, nsGUIEvent * 
0x00000254, nsEventStatus * 0x0012fabc) line 1439
HandleEvent(nsGUIEvent * 0x02104008) line 68
nsWindow::DispatchEvent(nsWindow * const 0x02190d44, nsGUIEvent * 0x0012fafc, 
nsEventStatus & nsEventStatus_eIgnore) line 681 + 6 bytes
nsWindow::DispatchWindowEvent(nsWindow * const 0x02dc3944, nsGUIEvent * 
0x00000000) line 702
nsWindow::DispatchMouseEvent(nsWindow * const 0x02dc3944, unsigned int 300, 
nsPoint * 0x04d626f2 {x=??? y=???}) line 3892
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x02dc3944, unsigned int 
300, nsPoint * 0x00000000 {x=??? y=???}) line 4099 + 15 bytes
nsWindow::ProcessMessage(nsWindow * const 0x02dc3944, unsigned int 512, 
unsigned int 1, long 39059511, long * 0x0012fd04) line 2985
nsWindow::WindowProc(HWND__ * 0x003401d4, unsigned int 512, unsigned int 1, 
long 0) line 950 + 18 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x00ae0848) line 408
main1(int 1, char * * 0x00372758, nsISupports * 0x003727a8) line 1031 + 9 bytes
main(int 1, char * * 0x00372758) line 1212 + 25 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x00133a54, 
HINSTANCE__ * 0x00400000) line 1230 + 21 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e87903()
Keywords: crash, rtm
Wah! This is dogfood because it means I can't arrange bookmarks into folders
that are nested >1 level deep.
Keywords: dogfood
this was also reported in bug 49894 (Solaris) and more recently in
bug 55646 (win98)
Since nsTreeLayout::LazyRowCreator is new (I believe) with evaughan checkin
on the trunk, these really are distinct from any prior drag/crashes in trees.

Oddly, I could not reproduce this in my own opt build for the trunk on win2k
(pulled Sat 2am), but in today's release opt trunk build, just dragging up
from the bottom of the tree will trigger this crash (at the point where
scrolling is initiated as I drag above the first visible row).
Assignee: hyatt → evaughan
Um, I take that back. I can reproduce this in my own opt. build.
investigating
Status: NEW → ASSIGNED
I hate crashers, but this seems too esay to "work around" to be a dogfood use
stopper. Marking dogfood-minus.

...but as a crasher, it sure would be nice to at least stop the crash for RTM
;-).  IMO, it would be nice to have the functionality, but stopping the crash
would (at this late date) be very acceptable.
Whiteboard: [dogfood-]
This is fixed by the following patch. It has been reviewed by hyatt and is 
already in the branch. Just needs to go in the trunk.
Attached patch Patch — — Splinter Review 

    
    

    
  
rtm need info/m18.  How did this get into the branch without a double-plus?  Who
else reviewed it? Why isn't it on the trunk?
Whiteboard: [dogfood-] → [dogfood-] [rtm need info]
Target Milestone: --- → M18

    
    

    
  
This was a regression in the original patch. It worked with the original tree
and broke with my patch. So I had hyatt look at it and we fixed the patch. Then
we landed the patch on the branch as planned. Its not on the trunk yet because
hyatt and I found the real fix last night and want to land it on the trunk.
Reassigning to hyatt to attach is drag and drop fix.
Assignee: evaughan → hyatt
Status: ASSIGNED → NEW

    
    

    
  
*** Bug 56350 has been marked as a duplicate of this bug. ***

    
    

    
  
rtm-, fixed on branch, need a more extensive fix on trunk.
Whiteboard: [dogfood-] [rtm need info] → [dogfood-] [rtm-]
Target Milestone: M18 → Future

    
    

    
  
Adding topcrash keyword.  This is showing up in talkback reports under
signatures "0x00000000" (some of them, not all) and
"nsQueryInterface::operator()".  User comments mention dragging bookmarks and
dragging messages in mail (and one said "preferences").

See http://www.mozilla.org/projects/seamonkey/reports/ns6analysis.html
Keywords: topcrash

    
    

    
  
See also bug 56349. RDF is sending too many "remove" notifications to the tree
widget, which may be wedging it when combined with async reflow.

    
    

    
  
*** Bug 57407 has been marked as a duplicate of this bug. ***

    
    

    
  
ooh look, a bookmarks related bug that claudius wasn't cc'd on tsk,tsk. Bug 55646 will soon
be marked as a dupe of this.
Bug 55646 was observed on all platforms and is easily repro'd by dragging any BM enough
such that the window has to autoscroll.
So if I'm reading correctly this should not be an issue on new branch builds?


    
    

    
  
Yes, this should not appear in the branch builds. (Sorry for no CC. Although
this can happen in any tree).

    
    

    
  
I cannot reproduce the crash in 2000-10-23-15 using the original instructions.
Feel free to close the bug, hyatt.

    
    

    
  
There don't seem to be any talkback reports of this crash since 10-19 (Saturdays
and Sundays are usually slow, but not Fridays, I don't think...).

    
    

    
  
I still see this in a new _trunk_ build from today...?

    
    

    
  
Oh wait, maybe I'm dumb.  Is bug 55646 now covering the crash in the trunk?  Or 
what?

    
    

    
  
No, it could just be nobody was using talkback builds on Friday...

    
    

    
  
*** Bug 55646 has been marked as a duplicate of this bug. ***

    
    

    
  
This is still crashing in the trunk, and this is the bug for this "autoscroll"
crash in tree widgets (including the bookmarks manager).
Severity: major → critical
Summary: crash dragging items in "manage bookmarks" window → crash dragging items in trees, e.g. "manage bookmarks" window

    
    

    
  
Another way to reproduce:
1. Mailnews
2. Open so many folders that you get a vert. scrollbar in the folder pane.
3. Drag msg to bottom of folder pane -> autoscroll
4. Drag over window border (i.e. outside the Mozilla Mailnews window)
Crash.
No crash with attached patch applied.

Can we please get the patch into the trunk until a better solution is in hand?

    
    

    
  
Seeing this on Linux -> All, all.
Keywords: mozilla0.9
OS: Windows 2000 → All
Hardware: PC → All

    
    

    
  
Sounds reasonable to me, ->m18.
Target Milestone: Future → M18

    
    

    
  
*** Bug 58224 has been marked as a duplicate of this bug. ***

    
    

    
  
*** Bug 57767 has been marked as a duplicate of this bug. ***

    
    

    
  
*** Bug 58394 has been marked as a duplicate of this bug. ***

    
    

    
  
Fixed.

Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED

    
  
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: jrgmorrison → xptoolkit.widgets

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: