1208517 - dragging a word in a text box will make firefox crash

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[[e-mail]]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150925171101

Steps to reproduce:

Last good revision: 8bdf0fb54af38f04133f875afe3fbe9e84576273
First bad revision: f23c63830ae5e3ba26858dcfd118b180884c98d7

seems to be Bug 1072150

Comment 1

[Boris Zbarsky [:bzbarsky]]

I'm not sure what "a work" means here.  What are the actual steps to reproduce this bug?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Oh, and the cited range is http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=8bdf0fb54af38f04133f875afe3fbe9e84576273&tochange=f23c63830ae5e3ba26858dcfd118b180884c98d7 which certainly does pinpoint bug 1072150.  ;)

Comment 3

[Bobby Holley (:bholley)]

Can you please link us to a crash report from |about:crashes|? That should give us all the information we need to fix this.

Comment 4

[[e-mail]]

bp-6bc8a2f2-83e1-447b-a042-2c7092150925
	2015/9/26	5:58
bp-4954d9e3-5a64-4c57-83bf-442562150925
	2015/9/26	5:58
bp-796fc260-6bdb-4036-a200-e691a2150925
	2015/9/26	5:58
bp-b848f208-4e64-4d26-90c3-8d11d2150925
	2015/9/26	5:58
8329f083-cfc7-4b45-9613-284b4ccceb3b
	2015/9/25	23:37
536a6016-e00d-4346-8283-d4aae2530f46
	2015/9/25	23:29
bp-e103dc3a-60f3-4104-8198-5e3932150925
	2015/9/25	21:47

Comment 5

[Bobby Holley (:bholley)]

dmajor, any idea why these symbols aren't showing up?

Comment 6

[[e-mail]]

Attachment: crash.PNG

Comment 7

[Bobby Holley (:bholley)]

Unfortunately none of your crash reports in comment 4 have symbols - are you using a custom build or something? Can you try with an official Nightly build from https://nightly.mozilla.org/ and post a crash report?

Comment 8

[Loic]

I can't reproduce it with the latest Nightly, or the STR are not very clear...

Comment 9

[[e-mail]]

(In reply to Bobby Holley (:bholley) from comment #7)
> Unfortunately none of your crash reports in comment 4 have symbols - are you
> using a custom build or something? Can you try with an official Nightly
> build from https://nightly.mozilla.org/ and post a crash report?

I'm using inbound builds. 

following is from my custom builds.

00007ffa`e8ab6b5b : 0000000b`d19fd0d0 0000000b`dd56d4b0 0000000b`dd686080 0000000b`d76a7870 : xul!nsContentUtils::IsCallerChrome+0x16 [f:\develop\mozilla\central\dom\base\nscontentutils.cpp @ 2068]
00007ffa`e904ffdb : 0000000b`ec74ac00 0000000b`d19fd108 0000000b`ec74ace0 0000000b`d76a7870 : xul!nsContentUtils::CanAccessNativeAnon+0xb [f:\develop\mozilla\central\dom\base\nscontentutils.cpp @ 6113]
00007ffa`e904fef3 : 00000366`000005a0 0000000b`d19fd120 00000366`000005a0 0000000b`dc788550 : xul!mozilla::dom::UIEvent::GetRangeParent+0x9b [f:\develop\mozilla\central\dom\events\uievent.cpp @ 233]
00007ffa`e94e97b5 : 0000000b`d76a7910 00000000`00000050 0000000b`e7470240 00007ffa`e954833d : xul!mozilla::dom::InputEvent::GetRangeParent+0x33 [f:\develop\mozilla\central\obj\obj-vc64\dist\include\mozilla\dom\compositionevent.h @ 27]
00007ffa`e94e9720 : 0000000b`dd5177e0 0000000b`dd517700 0000000b`e60e8670 0000000b`e60e8670 : xul!nsEditorEventListener::DragOver+0x65 [f:\develop\mozilla\central\editor\libeditor\nseditoreventlistener.cpp @ 849]
00007ffa`e950047e : 0000000b`e374ed00 0000000b`e607f000 00000000`00000000 0000000b`d19fd239 : xul!nsEditorEventListener::DragEnter+0x130 [f:\develop\mozilla\central\editor\libeditor\nseditoreventlistener.cpp @ 833]
00007ffa`e9052706 : 0000000b`dc788551 00007ffa`e8450cde 0000000b`dc788550 0000000b`dc788551 : xul!nsEditorEventListener::HandleEvent+0xae [f:\develop\mozilla\central\editor\libeditor\nseditoreventlistener.cpp @ 376]
00007ffa`e905248e : 0000000b`d19fdbb0 0000000b`ec74ac50 0000000b`d19fdbb0 00007ffa`e90e9034 : xul!mozilla::EventListenerManager::HandleEventSubType+0x196 [f:\develop\mozilla\central\dom\events\eventlistenermanager.cpp @ 1012]
00007ffa`e9051b3c : 0000000b`dc006028 00007ffa`e8450cef 0000000b`e8f17800 0000000b`d19fdc10 : xul!mozilla::EventListenerManager::HandleEventInternal+0x22e [f:\develop\mozilla\central\dom\events\eventlistenermanager.cpp @ 1143]
00007ffa`e905294b : 0000000b`d19fd740 0000000b`dc006028 0000000b`d19fd7f8 0000000b`dc006328 : xul!mozilla::EventTargetChainItem::HandleEvent+0xfc [f:\develop\mozilla\central\dom\events\eventdispatcher.cpp @ 229]
00007ffa`e9052a13 : 0000000b`d19fd740 00000000`00000028 0000000b`d19fd910 0000000b`d19fd7f0 : xul!mozilla::EventTargetChainItem::HandleEventTargetChain+0x1fb [f:\develop\mozilla\central\dom\events\eventdispatcher.cpp @ 338]
00007ffa`e9048970 : 0000000b`d19fd740 00000000`000004d8 0000000b`d19fd910 0000000b`d19fd7f0 : xul!mozilla::EventTargetChainItem::HandleEventTargetChain+0x2c3 [f:\develop\mozilla\central\dom\events\eventdispatcher.cpp @ 368]
00007ffa`e9674885 : 0000000b`e7470000 0000000b`e7407800 00000000`00000000 00007ffb`0b9095d7 : xul!mozilla::EventDispatcher::Dispatch+0xa60 [f:\develop\mozilla\central\dom\events\eventdispatcher.cpp @ 657]
00007ffa`e969eb76 : 0000000b`ec74ac50 0000000b`e601b6a0 0000000b`e601b6a0 0000000b`d19fd900 : xul!PresShell::DispatchEventToDOM+0x175 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 8076]
00007ffa`e969f9d0 : 0000000b`e7470000 00000000`00000000 0000000b`d19fdb70 00000000`00000000 : xul!PresShell::HandleEventInternal+0x3c6 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7967]
00007ffa`e969d8e7 : 0000000b`ec74ac50 0000000b`e7470000 0000000b`d19fda99 00000000`00000000 : xul!PresShell::HandlePositionedEvent+0x120 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7801]
00007ffa`e943ece0 : 0000000b`dc7d7800 00000000`00000001 00000000`00000000 00007ffb`138c0300 : xul!PresShell::HandleEvent+0x11c7 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7585]
00007ffa`e943dd83 : 0000000b`dcd02200 0000000b`dc7c0d00 0000000b`d19fdce0 00000000`03b7a297 : xul!nsViewManager::DispatchEvent+0x170 [f:\develop\mozilla\central\view\nsviewmanager.cpp @ 797]
00007ffa`e948cd5a : 0000000b`d19fdce0 0000000b`dc73cc00 0000000b`00000000 0000000b`d19fdc90 : xul!nsView::HandleEvent+0xc3 [f:\develop\mozilla\central\view\nsview.cpp @ 1132]
00007ffa`e948cc77 : 0000000b`d19fdbb0 00000000`0000fffe 0000000b`dc74d0c0 0000000b`dc73cc00 : xul!nsWindow::DispatchEvent+0x3a [f:\develop\mozilla\central\widget\windows\nswindow.cpp @ 3883]
00007ffa`e94b55c8 : 0000000b`00000000 00007ffb`00000000 00000077`00000099 00000000`00000000 : xul!nsNativeDragTarget::DispatchDragDropEvent+0x297 [f:\develop\mozilla\central\widget\windows\nsnativedragtarget.cpp @ 183]
00007ffa`e948efd4 : 0000000b`dc74d0c0 0000000b`dc74d0c0 0000000b`dd11a5c0 000000d1`000001a4 : xul!nsNativeDragTarget::ProcessDrag+0x108 [f:\develop\mozilla\central\widget\windows\nsnativedragtarget.cpp @ 212]
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ole32.dll - 
00007ffb`156666f6 : 000000d1`00000000 0000000b`dc74d0c0 0000000b`db11a1b8 000000d1`000001a4 : xul!nsNativeDragTarget::DragEnter+0x144 [f:\develop\mozilla\central\widget\windows\nsnativedragtarget.cpp @ 298]
00007ffb`156663c0 : 00000000`00000000 00007ffb`156cd3f0 00000000`00000000 0000000b`d19fe360 : ole32!GetObjectFromRotByPath+0xbe6
00007ffb`15691217 : ffffffff`ffffffff 00000000`00350680 0000000b`d19fe050 00000000`00000000 : ole32!GetObjectFromRotByPath+0x8b0
00007ffb`15693832 : 0000000b`db118c50 ffffffff`ffffffff 0000000b`d19fdfa9 0000000b`d76b4d40 : ole32!OleGetPackageClipboardOwner+0x9347
00007ffb`15693b9b : 00000000`00000000 00000000`00000000 0000000b`dd11a5c0 00000000`00000000 : ole32!OleGetPackageClipboardOwner+0xb962
00007ffa`e94c1f11 : 0000000b`dd55dc00 0000000b`d19fe3b1 00000000`00000000 00000000`00000000 : ole32!DoDragDrop+0x10b
00007ffa`e94ab8e8 : 0000000b`dd11a5c8 00000000`00000000 0000000b`00000002 0000000b`d19fe3c0 : xul!nsDragService::StartInvokingDragSession+0xe1 [f:\develop\mozilla\central\widget\windows\nsdragservice.cpp @ 311]
00007ffa`e945cd5b : 0000000b`d76a6260 0000000b`ec74ad60 0000000b`d76a61c0 00000000`00000000 : xul!nsDragService::InvokeDragSession+0x248 [f:\develop\mozilla\central\widget\windows\nsdragservice.cpp @ 262]
00007ffa`e9030206 : 0000000b`d19fe590 0000000b`ec74ad60 00000000`00000000 00000000`00000000 : xul!nsBaseDragService::InvokeDragSessionWithSelection+0xfb [f:\develop\mozilla\central\widget\nsbasedragservice.cpp @ 289]
00007ffa`e903222b : 0000000b`dc73cc00 0000000b`d203ef60 0000000b`e601b6a0 0000000b`e1f2e9a0 : xul!mozilla::EventStateManager::DoDefaultDragStart+0x186 [f:\develop\mozilla\central\dom\events\eventstatemanager.cpp @ 1919]
00007ffa`e9036e09 : 0000005a`00000000 0000000b`e7407800 0000000b`d19fee10 0000000b`d19fe590 : xul!mozilla::EventStateManager::GenerateDragGesture+0x84b [f:\develop\mozilla\central\dom\events\eventstatemanager.cpp @ 1742]
00007ffa`e969eac8 : 00000000`00000000 00000000`00000000 0000000b`e601b6a0 0000000b`d19fe9d0 : xul!mozilla::EventStateManager::PreHandleEvent+0x309 [f:\develop\mozilla\central\dom\events\eventstatemanager.cpp @ 648]
00007ffa`e969f9d0 : 0000000b`e7470000 00000000`00000000 0000000b`d19fed60 00000000`00000000 : xul!PresShell::HandleEventInternal+0x318 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7948]
00007ffa`e969d90b : 0000000b`ec74ac50 0000000b`e7470000 0000000b`d19feb69 00000000`00000000 : xul!PresShell::HandlePositionedEvent+0x120 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7801]
00007ffa`e969ce5b : 0000000b`e7470000 0000000b`ec74ac50 0000000b`d19fee10 00000000`00000001 : xul!PresShell::HandleEvent+0x11eb [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7587]
00007ffa`e943ece0 : 0000000b`dc7d7800 00000000`00000000 00000000`00760099 0000000b`e8384d00 : xul!PresShell::HandleEvent+0x73b [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7197]
00007ffa`e943dd83 : 0000000b`dcd02200 0000000b`dc7c0d00 0000000b`d19fedb0 00000000`00760099 : xul!nsViewManager::DispatchEvent+0x170 [f:\develop\mozilla\central\view\nsviewmanager.cpp @ 797]
00007ffa`e948cd5a : 0000000b`d19fedb0 0000000b`dc73cc00 0000000b`00000000 0000000b`d19feeb0 : xul!nsView::HandleEvent+0xc3 [f:\develop\mozilla\central\view\nsview.cpp @ 1132]
00007ffa`e944215b : 0000000b`dc73cc00 00000000`00000024 00000000`00000001 0000013b`d1cd2e9f : xul!nsWindow::DispatchEvent+0x3a [f:\develop\mozilla\central\widget\windows\nswindow.cpp @ 3883]
00007ffa`e948e428 : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000011 : xul!nsBaseWidget::DispatchInputEvent+0x4b [f:\develop\mozilla\central\widget\nsbasewidget.cpp @ 1016]
00007ffa`e94b7293 : 000000d0`000001a4 00000000`00000201 00000000`00000001 00000000`00760099 : xul!nsWindow::DispatchMouseEvent+0x7a8 [f:\develop\mozilla\central\widget\windows\nswindow.cpp @ 4265]
00007ffa`e94c5f48 : 00000000`00000000 00000000`00000200 00000000`00350680 00000000`00000200 : xul!nsWindow::ProcessMessage+0x10c3 [f:\develop\mozilla\central\widget\windows\nswindow.cpp @ 5143]
00007ffa`e83ddbf2 : 00000000`03b7a290 00007ffa`00000200 00000000`00000001 00000000`00760099 : xul!nsWindow::WindowProcInternal+0x198 [f:\develop\mozilla\central\widget\windows\nswindow.cpp @ 4617]
00007ffa`e94c5d98 : 00000000`00000200 00000000`00000001 00000000`0000c195 00000000`00000000 : xul!CallWindowProcCrashProtected+0x22 [f:\develop\mozilla\central\xpcom\base\nscrashonexception.cpp @ 35]
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll - 
00007ffb`138c12fc : 00000000`00000000 0000000b`d19ff3f9 00000000`00000001 00007ffb`0b9091ae : xul!nsWindow::WindowProc+0x78 [f:\develop\mozilla\central\widget\windows\nswindow.cpp @ 4570]
00007ffb`138c0cd7 : 0000000b`d247b860 00007ffa`e94c5d20 00000000`00350680 0000000b`d1702800 : USER32!CallWindowProcW+0x47c
00007ffa`e94b90ff : 00000000`00000001 00000000`00000001 0000000b`d2025501 00007ffa`e9e6ec73 : USER32!DispatchMessageW+0x1b7
00007ffa`e945f35d : 00000000`00000001 0000000b`d6b22598 0000000b`d20255c0 00007ffa`f7cefbe0 : xul!nsAppShell::ProcessNextNativeEvent+0x1af [f:\develop\mozilla\central\widget\windows\nsappshell.cpp @ 303]
00007ffa`e8432186 : 0000000b`d20255c0 0000000b`d6b22598 0000000b`d2025501 00000000`00000001 : xul!nsBaseAppShell::OnProcessNextEvent+0x16d [f:\develop\mozilla\central\widget\nsbaseappshell.cpp @ 289]
00007ffa`e844c447 : 0000000b`d201e401 00000000`00000001 0000000b`d19ff5c0 0000000b`d6b22500 : xul!nsThread::ProcessNextEvent+0x1f6 [f:\develop\mozilla\central\xpcom\threads\nsthread.cpp @ 932]
00007ffa`e8608a3c : 0000000b`d2024700 00007ffa`f7cefbe0 00000000`00000000 0000000b`dc77f808 : xul!NS_ProcessNextEvent+0x37 [f:\develop\mozilla\central\xpcom\glue\nsthreadutils.cpp @ 277]
00007ffa`e85f0a8b : 0000000b`d19ff7f0 0000000b`d20255c0 0000000b`d19ffb11 0000000b`d6b22590 : xul!mozilla::ipc::MessagePump::Run+0xcc [f:\develop\mozilla\central\ipc\glue\messagepump.cpp @ 95]
00007ffa`e9463568 : 00000000`00000000 0000000b`d19ff7f0 0000000b`d6b22590 0000000b`d19ffb11 : xul!MessageLoop::Run+0x4b [f:\develop\mozilla\central\ipc\chromium\src\base\message_loop.cc @ 202]
00007ffa`e94bcad1 : 00000000`00000001 00000000`00000000 00000000`00000001 0000000b`d19ffb11 : xul!nsBaseAppShell::Run+0x38 [f:\develop\mozilla\central\widget\nsbaseappshell.cpp @ 158]
00007ffa`e9a21103 : 0000000b`d6ba6390 0000000b`d19ff7f0 0000000b`d19ffb11 0000013b`d1cd359f : xul!nsAppShell::Run+0x61 [f:\develop\mozilla\central\widget\windows\nsappshell.cpp @ 178]
00007ffa`e9a39597 : 0000000b`d203ef60 00000000`00000000 0000000b`d19ffb11 00000000`000020d0 : xul!nsAppStartup::Run+0x23 [f:\develop\mozilla\central\toolkit\components\startup\nsappstartup.cpp @ 284]
00007ffa`e9a38116 : 0000000b`d2072110 0000000b`d19ff9b0 00000000`00000000 00007ffa`e85e93bb : xul!XREMain::XRE_mainRun+0x767 [f:\develop\mozilla\central\toolkit\xre\nsapprunner.cpp @ 4307]
00007ffa`e9a39fe0 : 00000000`00000001 0000000b`d19ffb00 0000000b`d1ac4360 0000000b`d202f1d8 : xul!XREMain::XRE_main+0x136 [f:\develop\mozilla\central\toolkit\xre\nsapprunner.cpp @ 4399]

Comment 10

[Bobby Holley (:bholley)]

That's perfect, thanks. Patch coming up.

Comment 11

[Bobby Holley (:bholley)]

Attachment: Use the legacy opt-out in CanAccessNativeAnon for now to avoid crashes.

Let's do the easy thing to stop the crashes for now.

Comment 12

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/66182160cc28

Comment 13

[[e-mail]]

(In reply to Pulsebot from comment #12)
> https://hg.mozilla.org/integration/mozilla-inbound/rev/66182160cc28

00 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : xul!nsContentUtils::SubjectPrincipal+0x12 [f:\develop\mozilla\central\dom\base\nscontentutils.cpp @ 2719]
01 00007ffa`ee161b2f : 00000053`24e62820 00000053`175e4ac0 00000053`115fcc10 00000000`00000000 : xul!nsContentUtils::CanCallerAccess+0x24 [f:\develop\mozilla\central\dom\base\nscontentutils.cpp @ 2018]
02 00007ffa`ee161ba7 : 00000053`115fcc28 00000000`00000000 00000053`24e62820 00000053`24e628a0 : xul!mozilla::dom::DataTransfer::GetMozSourceNode+0x7f [f:\develop\mozilla\central\dom\events\datatransfer.cpp @ 522]
03 00007ffa`ee5e9d74 : 00000000`00000000 00000000`00000000 00000000`00000000 00007ffa`edc48547 : xul!mozilla::dom::DataTransfer::GetMozSourceNode+0x17 [f:\develop\mozilla\central\dom\events\datatransfer.cpp @ 532]
04 00007ffa`ee5fc388 : 00000053`00000000 00000000`00000000 00000053`26a75640 00007ffa`ee65af2d : xul!nsEditorEventListener::CanDrop+0x2e4 [f:\develop\mozilla\central\editor\libeditor\nseditoreventlistener.cpp @ 975]
05 00007ffa`ee5fc2b0 : 00000053`16db0d30 00000053`16db0d00 00000053`1ca35fb0 00000053`24e62820 : xul!nsEditorEventListener::DragOver+0xa8 [f:\develop\mozilla\central\editor\libeditor\nseditoreventlistener.cpp @ 852]
06 00007ffa`ee612fbe : 00000053`28e24bc0 00000053`26fd4000 00000000`00000000 00000053`115fce19 : xul!nsEditorEventListener::DragEnter+0x130 [f:\develop\mozilla\central\editor\libeditor\nseditoreventlistener.cpp @ 833]
07 00007ffa`ee164f36 : 00000053`289c78b1 00007ffa`ed56087e 00000053`289c78b0 00000053`289c78b1 : xul!nsEditorEventListener::HandleEvent+0xae [f:\develop\mozilla\central\editor\libeditor\nseditoreventlistener.cpp @ 376]
08 00007ffa`ee164cbe : 00000053`115fd790 00000053`24e62790 00000053`115fd790 00007ffa`ee1fb444 : xul!mozilla::EventListenerManager::HandleEventSubType+0x196 [f:\develop\mozilla\central\dom\events\eventlistenermanager.cpp @ 1012]
09 00007ffa`ee16436c : 00000053`177e4028 00007ffa`ed56088f 00000053`28914c00 00000053`115fd7f0 : xul!mozilla::EventListenerManager::HandleEventInternal+0x22e [f:\develop\mozilla\central\dom\events\eventlistenermanager.cpp @ 1143]
0a (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : xul!mozilla::EventListenerManager::HandleEvent+0x66 [f:\develop\mozilla\central\obj\obj-vc64\dist\include\mozilla\eventlistenermanager.h @ 349]
0b 00007ffa`ee16517b : 00000053`115fd320 00000053`177e4028 00000053`115fd3d8 00000053`177e4288 : xul!mozilla::EventTargetChainItem::HandleEvent+0xfc [f:\develop\mozilla\central\dom\events\eventdispatcher.cpp @ 229]
0c 00007ffa`ee165243 : 00000053`115fd320 00000000`00000028 00000053`115fd4f0 00000053`115fd3d0 : xul!mozilla::EventTargetChainItem::HandleEventTargetChain+0x1fb [f:\develop\mozilla\central\dom\events\eventdispatcher.cpp @ 338]
0d 00007ffa`ee15b200 : 00000053`115fd320 00000000`00000438 00000053`115fd4f0 00000053`115fd3d0 : xul!mozilla::EventTargetChainItem::HandleEventTargetChain+0x2c3 [f:\develop\mozilla\central\dom\events\eventdispatcher.cpp @ 368]
0e 00007ffa`ee786a25 : 00000053`26a75400 00000053`22084800 00000000`00000000 00007ffb`0ba495c7 : xul!mozilla::EventDispatcher::Dispatch+0xa60 [f:\develop\mozilla\central\dom\events\eventdispatcher.cpp @ 657]
0f 00007ffa`ee7b0dc6 : 00000053`24e62790 00000053`26a21300 00000053`26a21300 00000053`115fd4e0 : xul!PresShell::DispatchEventToDOM+0x175 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 8076]
10 00007ffa`ee7b1c20 : 00000053`26a75400 00000000`00000000 00000053`115fd750 00000000`00000000 : xul!PresShell::HandleEventInternal+0x3c6 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7967]
11 00007ffa`ee7afb37 : 00000053`24e62790 00000053`26a75400 00000053`115fd679 00000000`00000000 : xul!PresShell::HandlePositionedEvent+0x120 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7801]
12 00007ffa`ee551420 : 00000053`1c4ab800 00000000`00000001 00000000`00000000 00007ffb`138c0300 : xul!PresShell::HandleEvent+0x11c7 [f:\develop\mozilla\central\layout\base\nspresshell.cpp @ 7585]
13 00007ffa`ee5504c3 : 00000053`1c4ce7c0 00000053`1c477180 00000053`115fd8c0 00000000`05925480 : xul!nsViewManager::DispatchEvent+0x170 [f:\develop\mozilla\central\view\nsviewmanager.cpp @ 797]
14 00007ffa`ee59f4da : 00000053`115fd8c0 00000053`1c2bb400 00000053`00000000 00000053`115fd870 : xul!nsView::HandleEvent+0xc3 [f:\develop\mozilla\central\view\nsview.cpp @ 1132]
15 00007ffa`ee59f3f7 : 00000053`115fd790 00000000`0000fffe 00000053`1c408f40 00000053`1c2bb400 : xul!nsWindow::DispatchEvent+0x3a [f:\develop\mozilla\central\widget\windows\nswindow.cpp @ 3883]
16 00007ffa`ee5c7e08 : 00000053`00000000 00007ffb`00000000 00000083`0000007f 00000000`00000000 : xul!nsNativeDragTarget::DispatchDragDropEvent+0x297 [f:\develop\mozilla\central\widget\windows\nsnativedragtarget.cpp @ 183]
17 00007ffa`ee5a1754 : 00000053`1c408f40 00000053`1c408f40 00000053`1ca13200 00000087`00000089 : xul!nsNativeDragTarget::ProcessDrag+0x108 [f:\develop\mozilla\central\widget\windows\nsnativedragtarget.cpp @ 212]

Comment 14

[Peja Stija]

Don't know if related, but dragging a tab also instantly crashes the browser.

Comment 15

[[e-mail]]

(In reply to Peja Stija from comment #14)
> Don't know if related, but dragging a tab also instantly crashes the browser.

same issue.

Comment 16

[[e-mail]]

Attachment: Use the legacy opt-out in GetMozSourceNode to avoid crashes

Comment 17

[Bobby Holley (:bholley)]

(In reply to zhoubcfan from comment #16)
> Created attachment 8666415 [details] [diff] [review]
> Use the legacy opt-out in GetMozSourceNode to avoid crashes

Thanks for the patch! Can you please file a separate bug and attach it? The patch in this bug already landed in comment 12, and separate landings are best tracked in separate bugs.

Once you post the patch, please flag me for review and we can get it landed. :-)

Comment 21

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/66182160cc28