455438 - crash [@ nsViewManager::IsViewInserted] is induced with the control key after applying a filter

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[Greg]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
Build Identifier: version 2.0.0.16 (20080708)

This is a freakish but easily reproduced crash when using the filter system.

If the filter's input field has focus, the mouse is outside the text field, but within the filter's panel in the toolbar, thunderbird crashes when you press control.


Reproducible: Always

Steps to Reproduce:
1. Give the filter input field keyboard focus (it doesn't matter if it's subject, recipient, etc.)
2. Type any character
3. Move the mouse just below the text field but within the vertical and horizontal boundaries of the filter toolbar.
4. Press the control key

Thunderbird crashes every time.

Comment 1

[Greg]

note that this is referring to the inline filter tool found in the toolbar. NOT the "message filters" feature.

Comment 2

[Magnus Melin [:mkmelin]]

If it doesn't work in nderbird safe-mode, give the talkback crash id. <http://kb.mozillazine.org/Talkback> Also, does it work in thunderbird3.0a2, or a nightly build?

Comment 3

[Greg]

crash ID is TB49666810M

i can't say whether or not it works in those other builds. i wish i had the time to dig into it more, but i can't.

Comment 4

[Magnus Melin [:mkmelin]]

nsViewManager::IsViewInserted  [mozilla/view/src/nsViewManager.cpp, line 3247]
nsPopupSetFrame::ActivatePopup  [mozilla/layout/xul/base/src/nsPopupSetFrame.cpp, line 618]
nsPopupSetFrame::HidePopup  [mozilla/layout/xul/base/src/nsPopupSetFrame.cpp, line 440]
nsPopupBoxObject::HidePopup  [mozilla/layout/xul/base/src/nsPopupBoxObject.cpp, line 145]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1386]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3957]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1405]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1480]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4367]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1500]
nsJSEventListener::HandleEvent  [mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsGenericElement::HandleDOMEvent  [mozilla/content/base/src/nsGenericElement.cpp, line 2234]
nsHTMLInputElement::HandleDOMEvent  [mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 1559]
nsEventStateManager::PreHandleEvent  [mozilla/content/events/src/nsEventStateManager.cpp, line 963]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6536]
PresShell::HandleEvent  [mozilla/layout/base/nsPresShell.cpp, line 6377]
nsViewManager::HandleEvent  [mozilla/view/src/nsViewManager.cpp, line 2521]
nsViewManager::DispatchEvent  [mozilla/view/src/nsViewManager.cpp, line 2253]
HandleEvent  [mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 1319]
nsWindow::DispatchFocus  [mozilla/widget/src/windows/nsWindow.cpp, line 6515]
nsWindow::ProcessMessage  [mozilla/widget/src/windows/nsWindow.cpp, line 5088]
nsWindow::WindowProc  [mozilla/widget/src/windows/nsWindow.cpp, line 1507]
USER32.dll + 0x8734 (0x7e418734)
USER32.dll + 0x8816 (0x7e418816)
USER32.dll + 0x18ea0 (0x7e428ea0)
USER32.dll + 0x18eec (0x7e428eec)
ntdll.dll + 0xe453 (0x7c90e453)
USER32.dll + 0x18dd9 (0x7e428dd9)
USER32.dll + 0x18d77 (0x7e428d77)
nsWindow::DefaultWindowProc  [mozilla/widget/src/windows/nsWindow.cpp, line 1533]
USER32.dll + 0x8734 (0x7e418734)
USER32.dll + 0x8816 (0x7e418816)
USER32.dll + 0x1a013 (0x7e42a013)
USER32.dll + 0x1a039 (0x7e42a039)
nsWindow::WindowProc  [mozilla/widget/src/windows/nsWindow.cpp, line 1514]
USER32.dll + 0x8734 (0x7e418734)
USER32.dll + 0x8816 (0x7e418816)
USER32.dll + 0x18ea0 (0x7e428ea0)
USER32.dll + 0x18eec (0x7e428eec)
ntdll.dll + 0xe453 (0x7c90e453)
USER32.dll + 0x9402 (0x7e419402)
nsAppShell::Run  [mozilla/widget/src/windows/nsAppShell.cpp, line 128]
nsAppStartup::Run  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [mozilla/mail/app/nsMailApp.cpp, line 62]
kernel32.dll + 0x17067 (0x7c817067)

Comment 5

[Wayne Mery (:wsmwk)]

Greg, can you reproduce in version 3?

Comment 6

[Brian R. Bondy [:bbondy]]

Recent crash:
https://crash-stats.mozilla.com/report/index/c65b552b-6219-4434-a8d4-273e32120124

Comment 7

[Mats Palmgren (inactive)]

WFM, Earlybird 20.0a2 (2013-02-08)

Comment 8

[Wayne Mery (:wsmwk)]

Brian, what is your opinion of this crash?

TB12 bp-68fb30f9-936e-4f2f-9000-b4b3a2120622
TB18.0a1 bp-805f776a-7fb8-4922-8d88-045b12120919
TB17 bp-45bbbb33-5cf3-461b-97a5-1c1042130102 (andy)

All (including firefox) are same source line - the last line of ...
mwu@79445 1088bool nsViewManager::IsViewInserted(nsView *aView)
hg@1 1089{
hg@1 1090 if (mRootView == aView) {
ehsan@80486 1091 return true;
ayg@106838 1092 } else if (aView->GetParent() == nullptr) {
ehsan@80486 1093 return false;
hg@1 1094 } else {
hg@1 1095 nsView* view = aView->GetParent()->GetFirstChild();
ayg@106838 1096 while (view != nullptr) {
hg@1 1097 if (view == aView) {
ehsan@80486 1098 return true;
hg@1 1099 }
hg@1 1100 view = view->GetNextSibling(); 

There are a few firefox crashes at same source line..

https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=nsViewManager%3A%3AIsViewInserted%28nsView*%29&reason_type=contains&date=02%2F09%2F2013%2013%3A48%3A09&range_value=4&range_unit=weeks&hang_type=any&process_type=all&do_query=1&admin=1&signature=nsViewManager%3A%3AIsViewInserted%28nsView*%29

bp-1226bb9b-1d8a-4b8b-b192-40f152130201
bp-f8591502-0efd-4381-8c57-c88862130118

Comment 9

[Brian R. Bondy [:bbondy]]

I unassigned myself, I think someone that is more familiar with the /view code should look at this.

Comment 10

[Mats Palmgren (inactive)]

Zero crash reports on crash-stats in the past 28 days.
Please reopen the bug if you can reproduce it in a recent version.