8608 - crash when double clicking on items in pref panels

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[chris hofmann]

These crashes poking around in pref panels were pretty easy to hit
on M7 candidates from Saturday.

Do we know want is going on there?


 Trigger Type:  Program Crash
 Trigger Reason:  Access violation

 Call Stack:    (Signature = RDFElementImpl::AddScriptEventListener 46fa5bec)
  RDFElementImpl::AddScriptEventListener

[d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp, line 2000]
  RDFElementImpl::SetAttribute

[d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp, line 1950]
  RDFXULBuilderImpl::AddAttribute

[d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFXULBuilder.cpp, line 2465]
  RDFXULBuilderImpl::CreateXULElement

[d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFXULBuilder.cpp, line 2216]
  RDFXULBuilderImpl::CreateOrReuseElement

[d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFXULBuilder.cpp, line 1872]
  RDFXULBuilderImpl::CreateRootContent

[d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFXULBuilder.cpp, line 542]
  XULDocumentImpl::SetRootResource

[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 2361]
  XULContentSinkImpl::OpenTag

[d:\builds\seamonkey\mozilla\rdf\datasource\src\nsXULContentSink.cpp, line 1373]
  XULContentSinkImpl::OpenContainer

[d:\builds\seamonkey\mozilla\rdf\datasource\src\nsXULContentSink.cpp, line 592]
  CWellFormedDTD::HandleToken

[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 468]
  CWellFormedDTD::BuildModel

[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 254]
  nsParser::BuildModel

[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 903]
  nsParser::ResumeParse

[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 852]
  nsParser::EnableParser

[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 587]
  CSSLoaderImpl::Cleanup

[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 613]
  CSSLoaderImpl::SheetComplete

[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 683]
  CSSLoaderImpl::ParseSheet

[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 718]
  CSSLoaderImpl::DidLoadStyle

[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 748]
  DoneLoadingStyle

[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 555]
  nsUnicharStreamLoader::OnStopBinding

[d:\builds\seamonkey\mozilla\network\module\nsNetStreamLoader.cpp, line 158]
  nsDocumentBindInfo::OnStopBinding

[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1601]
  OnStopBindingProxyEvent::HandleEvent

[d:\builds\seamonkey\mozilla\network\module\nsNetThread.cpp, line 594]
  StreamListenerProxyEvent::HandlePLEvent

[d:\builds\seamonkey\mozilla\network\module\nsNetThread.cpp, line 474]
  PL_HandleEvent
                                         [plevent.c, line 492]
  PL_ProcessPendingEvents
                                         [plevent.c, line 453]
  _md_EventReceiverProc
                                         [plevent.c, line 881]
  KERNEL32.DLL + 0x3663 (0xbff73663)

  KERNEL32.DLL + 0x22894 (0xbff92894)

  0x00768178


1984               RDFElementImpl::AddScriptEventListener(nsIAtom* aName, const
nsString& aValue, REFNSIID
aIID)
1985 hyatt    1.14 {
1986 waterson 1.16     if (! mDocument)
1987                       return NS_OK; // XXX
1988
1989                   nsresult ret = NS_OK;
1990                   nsIScriptContext* context;
1991                   nsIScriptContextOwner* owner;
1992
1993                   owner = mDocument->GetScriptContextOwner();
1994 hyatt    1.62
1995                   nsAutoString tagStr;
1996                   mTag->ToString(tagStr);
1997
1998 waterson 1.16     if (NS_OK == owner->GetScriptContext(&context)) {
1999 hyatt    1.62       if (tagStr == "window") {
2000                       nsIDOMEventReceiver *receiver;
2001                       nsIScriptGlobalObject *global =
context->GetGlobalObject();
2002
2003                       if (nsnull != global && NS_OK ==
global->QueryInterface(kIDOMEventReceiverIID,
(void**)&receiver)) {
2004                         nsIEventListenerManager *manager;
2005                         if (NS_OK ==
receiver->GetListenerManager(&manager)) {
2006                           nsIScriptObjectOwner *mObjectOwner;
2007                           if (NS_OK ==
global->QueryInterface(kIScriptObjectOwnerIID, (void**)&mObjectOwner)) {
2008                             ret = manager->AddScriptEventListener(context,
mObjectOwner, aName, aValue, aIID);
2009                             NS_RELEASE(mObjectOwner);
2010                           }
2011                           NS_RELEASE(manager);
2012                         }
2013                         NS_RELEASE(receiver);
2014                       }
2015                       NS_IF_RELEASE(global);
2016                     }
2017                     else {
2018 waterson 1.16         nsIEventListenerManager *manager;
2019                       if (NS_OK == GetListenerManager(&manager)) {
2020                           nsIScriptObjectOwner* owner;
2021                           if (NS_OK ==
QueryInterface(kIScriptObjectOwnerIID,
2022                                                       (void**) &owner)) {
2023                               ret =
manager->AddScriptEventListener(context, owner,
2024                                                                     aName,
aValue, aIID);
2025                               NS_RELEASE(owner);
2026                           }
2027                           NS_RELEASE(manager);
2028 hyatt    1.14         }
2029                       NS_RELEASE(context);
2030 hyatt    1.62       }
2031 waterson 1.16     }
2032                   NS_RELEASE(owner);
2033
2034                   return ret;
2035 hyatt    1.14 }
2036 waterson 1.1



     Subject:
           C5.0-apprunner last 7 days
 Resent-Date:
           Sun, 20 Jun 1999 07:16:20 -0700 (PDT)
 Resent-From:
           [e-mail]
       Date:
           Sun, 20 Jun 1999 07:13:27 -0700
       From:
           Netscape Communications Corporation <[e-mail]>
         To:
           "[e-mail]"
<[e-mail]>



Latest C5.0 boxes from apprunner.

1 C5.0 boxes (1675 Incidents)



 Incident

                                          1–50 of 1675
 Incident
       Trigger
       Time
       (Day)
             Call Stack Signature
                                        Trigger Source File Name

  Build ID

          User Email Address

                          User Comments
 10179418
       06/19/99
       10:33AM
             RDFElementImpl::AddScriptEventListener
             46fa5bec

d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp

  1999061909

          [e-mail]

                          click around on pref window from mail
 10179417
       06/19/99
       10:25AM
             RDFElementImpl::AddScriptEventListener
             46fa5bec

d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp

  1999061909

          [e-mail]

                          open up pref window and click around.
 10179415
       06/19/99
       05:40AM
             RDFElementImpl::AddScriptEventListener
             46fa5bec

d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp

  1999061808

          [e-mail]

                          just double click on top level navigator

                          pref in pref pannel
 10179414
       06/19/99
       05:36AM
             RDFElementImpl::AddScriptEventListener
             46fa5bec

d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp

  1999061808

          [e-mail]

                          bring up pref window, pick a few prefs, pick

                          top level navigator pref. crash.

Comment 1

[Chris Waterson]

First off, we're not checking for a null pointer from
GetScriptContentOwner(), which is bad. But there's something even more sinister
going on here.

Since this tree control has no "ondblclk" handler set up, a double click turns
into two mouse clicks. Thanks to all of Simon's memory fixes, this triggers the
same page to be loaded *twice* in rapid succession. It seems like this is the
recipe for some kind of race condition; somebody is trying to set up a script
event listener on the document that is about to get destroyed.

Fixing this is _probably_ as simple as just checking each call to
GetScriptContextOwner() for a null return value, and bailing if we find one
(the rest of the tear-down code should take care of cleanup).

John: you might also want to add some front-end JS to your "onclick" handler
s.t. it checks to see if the page that got clicked is actually loaded before
trying to re-load it.

Comment 2

[mcmullen]

Wouldn't adding ondblclick="" work around it, too?

Comment 3

[Peter Trudelle]

In either case, who should own this?

Comment 4

[chris hofmann]

waterson,  dup of the fix you put in a few days ago?
what extra work might be needed here?

Comment 5

[Chris Waterson]

This works for me now, so marking as FIXED.

Comment 6

[ckritzer (gone)]

Verified fixed on Win95 apprunner build 1999070908.

Comment 7

[leger]

BULK MOVE: Changing component from XUL to XP Toolkit/Widgets: XUL.  XUL 
component will be deleted.