286212 - Crash dragging over about:config

Status: RESOLVED DUPLICATE of bug 241503

(Core :: DOM: Copy & Paste and Drag & Drop, defect)

Description

[Peter Weilbacher]

This applies to both Firefox and Seamonkey of the current trunk: If I call up
about:config and then drag an URL object over the listbox containing the hidden
entries, the browser crashes. I am not sure if I can take Andy's remark on the
newsgroup (thread "static seamonky build") as a confirmation...

Some POPUPLOG entries of optimized builds point to
    nsJSEventListener::HandleEvent(nsIDOMEvent* aEvent)
But then I tried to debug this with last week's debug build and ICSDebug tells
me that it crashes at nsTreeBodyFrame.cpp line 2035:

   else if (aEvent->message == NS_DRAGDROP_EXIT) {
     // Clear out all our tracking vars.
 
     if (mSlots->mDropAllowed) {        <------ debugger pointed here

I tried to debug further, but for every d'n'd operation under the debugger I
have to wait through a hang of 50 seconds before the WPS resets itself, so I am
giving up here.

Comment 1

[Mike Kaply [:mkaply]]

I'm not seeing this in yesterday's build...

Comment 2

[Andy Willis (abwillis)]

I am not sure I understand the hidden entries... if I drag a url object from
mail and drop it onto the browser it is crashing regardless if the about:config
is open.  I haven't tested on a non-static build yet.  

Comment 3

[Peter Weilbacher]

No, I meant a _WPS_ URL object. That stuff dropped from within Mozilla make it
crash is 286207 and has a temporary workaround checked in since today. To make
this one happen I drag an URL object from the WPS above Mozilla across the URL
bar, the tab bar, the filter line, and the column headings. When the mouse
pointer reaches the list of prefs, Mozilla or Firefox crash for me.

Comment 4

[Rich Walsh]

This is the same old "dragging an email to a folder in Thunderbird causes a
crash" bug.  These windows fail to get a drag-enter msg when entered from
another XP window, so they never initialize mSlots.  When it later gets
referenced, down she goes.

I have copies of Fx & Moz built from the same source and get a trap at the exact
same location in gklayout when dragging:  a file over about:config in Moz & Fx
_and_ when dragging text from a Moz preference page into the page selection tree
at the left side of the notebook.

FWIW... if you put a native window over part of the tree window, then enter the
tree via the overlapping window, no crash occurs because native drags generate
the needed drag-enter msg.

Comment 5

[Andy Willis (abwillis)]

Ok, I understand what you are doing now... I read the other bug after this one.
 I can't duplicate the about:config crash with this build.  I did get some
interesting affects trying to duplicate it.  I could drag the WP-url all over
the browser window but no matter where I dropped it, even back in the original
folder, Mozilla would then crash.  Dragging the URL from mail I could hit esc
and it would just cancel the drag... if I hit esc after dragging the WP-url over
the browser the browser would crash.  It would also crash when dropped it was
dropped on the browser. I do have dragover turned on so that Mozilla would come
into focus when something is dragged over it but haven't tested it with dragover
turned off.  Firefox did not crash but it was running with libpathstrict=t so I
don't know if that affects the crash (don't suppose it should but can't confirm
until I am done with this and didn't think to try before I started this). 
Assuming these are related to bug 286207 then is it possible you were seeing a
specialized case of this?

Comment 6

[Andy Willis (abwillis)]

I repeated the process of dragging, dropping, restarting the browser about 5
times and now after I posted it here and was trying again I can't get it to
crash now.

Comment 7

[Peter Weilbacher]

No, Rich is right, this is a different nuance of bug 241503.

*** This bug has been marked as a duplicate of 241503 ***