126675 - Print Prieview toolbar -> scale crash when typing - Trunk M099 [@ 0x00000000 - nsMenuPopupFrame::FindMenuWithShortcut | nsMenuPopupFrame::ShortcutNavigation]

Status: VERIFIED FIXED

(Core :: Print Preview, defect, P1)

Description

[Quinn Yost (mythdraug)]

Talkback ids:

TB3150405K
TB3150367Q

Comment 1

[sujay]

confirming...I see this also in 2/20 trunk build.

Comment 2

[R.K.Aa.]

*** Bug 126673 has been marked as a duplicate of this bug. ***

Comment 3

[rods (gone)]

Crash when typing what, where?

Comment 4

[sujay]

Rod,
 
all you do is insert your caret into the scale field. and then start
typing..

Poof...you crash.

Comment 5

[rods (gone)]

Doing that doesn't crash on my build - UI issue - reassigning

Comment 6

[Boris Zbarsky [:bzbarsky]]

stephend, would you get the stack?  TB3150405K and TB3150367Q

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

0x00000000 
nsMenuPopupFrame::FindMenuWithShortcut [d:\builds\seamonkey\mozilla\layout\xul\
base\src\nsMenuPopupFrame.cpp, line 1479] 
nsMenuPopupFrame::ShortcutNavigation [d:\builds\seamonkey\mozilla\layout\xul\
base\src\nsMenuPopupFrame.cpp, line 1532] 
nsMenuListener::KeyPress [d:\builds\seamonkey\mozilla\layout\xul\base\src\
nsMenuListener.cpp, line 228] 
nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\
src\nsEventListenerManager.cpp, line 1654] 
nsXULDocument::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\document\
src\nsXULDocument.cpp, line 2459] 
nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\
src\nsXULElement.cpp, line 3390] 
nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\
src\nsXULElement.cpp, line 3383] 
nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\
src\nsXULElement.cpp, line 3383] 
nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\
src\nsXULElement.cpp, line 3383] 
nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\
src\nsXULElement.cpp, line 3383] 
nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\
src\nsXULElement.cpp, line 3383] 
nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\
src\nsXULElement.cpp, line 3383] 
nsGenericElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\base\src\
nsGenericElement.cpp, line 1631] 
nsHTMLInputElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\html\
content\src\nsHTMLInputElement.cpp, line 1223] 
PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\
nsPresShell.cpp, line 6005] 
PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\
nsPresShell.cpp, line 5928] 
nsViewManager::HandleEvent [d:\builds\seamonkey\mozilla\view\src\
nsViewManager.cpp, line 2043] 
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306] 
nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\
nsViewManager.cpp, line 1863] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83] 
nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\
nsWindow.cpp, line 860] 
nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\
nsWindow.cpp, line 877] 
nsWindow::DispatchKeyEvent [d:\builds\seamonkey\mozilla\widget\src\windows\
nsWindow.cpp, line 2643] 
nsWindow::OnChar [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, 
line 2793] 
nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\
nsWindow.cpp, line 3373] 
nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\
nsWindow.cpp, line 1122] 
USER32.DLL + 0x1b60 (0x77e11b60) 
USER32.DLL + 0x1cca (0x77e11cca) 
USER32.DLL + 0x83f1 (0x77e183f1) 
nsAppShellService::Run [d:\builds\seamonkey\mozilla\xpfe\appshell\src\
nsAppShellService.cpp, line 308] 
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1301] 
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1628] 
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1646] 
WinMainCRTStartup() 
KERNEL32.DLL + 0xd326 (0x77e8d326) 

Comment 8

[Samir Gehani]

Can't reproduce.  Not sure if it'll make a difference but what page were you
previewing?

Comment 9

[Quinn Yost (mythdraug)]

It hasn't mattered.   Any page produces the same result.

Comment 10

[Martin Poirier]

I also see this on Win98SE, Mozilla trunk build 2002022003. It happens even on
print-previewing a blank page e.g. about:blank. I also tried this : 
1. In the scale value textbox, select a zero from the "100"
2. Type "0" without quotes of course

Result: crash, even if the scale shouldn't have been changed as I only replaced
a 0 with another 0

Talkback IDs

TB3166797Q
TB3171683E
TB3171694X
TB3171706Z

Comment 11

[Martin Poirier]

Just noticed it also happens when typing in the page 1 of x textbox. Try to
change the page and...crash

Comment 12

[ajbu]

For me it crashes when using the keyboard anywhere in de Print Preview. Just 
opening Preview and typing anything on the keyboard, including tab or alt 
gives a crash

Comment 13

[rcummins]

*** Bug 127256 has been marked as a duplicate of this bug. ***

Comment 14

[Carsten Menke]

CONFIRM on Build Feb 23th 2002, Build System Mandrake 8.0 gcc-2.95.3 glib-2.2.2
gtk-1.2.10, 

1. gone to google.com
2. hit print Preview
3. Scaling using the Arrows does nothing harmfull
4. Typing in directly a number to scale leads to crash

My GDB Output attached.

Comment 15

[Carsten Menke]

Attachment: GDB Output

Scale entered via Numblock on Keyboard

Comment 16

[Olivier Cahagne]

OS -> All.

Comment 17

[Jay Patel [:jay]]

Adding Trunk [@ 0x00000000 - nsMenuPopupFrame::FindMenuWithShortcut] to summary
and topcrash keyword.  This has been a topcrasher with recent MozillaTrunk
builds.  Adding testcase keyword, since we know this is reproducible in Print
Preview.

Comment 18

[Jay Patel [:jay]]

Here's the latest comments from Talkback data in case people need help
reproducing the crash:

(3387770)
URL: www.run2net.dk
     (3387770)	Comments: Manually enter scale factor in print preview
     (3295386)	URL: www.netbsd.org
     (3295384)	URL: www.netbsd.org
     (3295384)	Comments: I have tried to crash mozilla while viewing several sites and it
worked so this problem isn't related just to the netbsd site. Basically I just
chose to view the print preview and then tried to change the value of the
"Scale" field using the numbers on
     (3295384)	Comments:  the keypad and hit ENTER. Crashes every time. 
     (3287264)	URL: http://www.google.fr/
     (3287264)	Comments: Resizing to 50% with Print Preview
     (3238978)	Comments: Print preview - typed a value into the "scale" box
     (3194986)	Comments: I was using the scale feture of the print preview while in Full
Screen mode and it crashed when I entered 60%
     (3169105)	URL: europe.cnn.com
     (3169105)	Comments: Print Preview   Typing in scale box 
     (3150405)	URL: europe.cnn.com
     (3150405)	Comments: Print preview:  typing in zoom box
     (3150367)	URL: europe.cnn.com
     (3150367)	Comments: Print preview  Changed orientation  Zoomed out 3x by button Typed
50 Crash...

Comment 19

[Jay Patel [:jay]]

It looks like a similar crash is also happening on Linux:

Count   Offset    Real Signature
[ 8   0x00000000 cee22b71 - nsMenuPopupFrame::ShortcutNavigation() ]
 
     Crash date range: 2002-02-25 to 2002-02-28
     Min/Max Seconds since last crash: 17 - 3355
     Min/Max Runtime: 3355 - 117061
     Keyword List : print(6), preview(6),  
     Count   Platform List 
     8   Linux 2.4.8-26mdk   
 
     Count   Build Id List 
     8   2002022508
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 0x00000000  
	 nsMenuPopupFrame::ShortcutNavigation()  
	 nsMenuListener::KeyPress()  
	 nsEventListenerManager::HandleEvent()  
	 nsXULDocument::HandleDOMEvent()  
	 nsXULElement::HandleDOMEvent()  
	 nsXULElement::HandleDOMEvent()  
	 nsXULElement::HandleDOMEvent()  
	 nsXULElement::HandleDOMEvent()  
	 nsXULElement::HandleDOMEvent()  
	 nsXULElement::HandleDOMEvent()  
	 nsXULElement::HandleDOMEvent()  
	 nsXULElement::HandleDOMEvent()  
	 nsXULElement::HandleChromeEvent()  
	 GlobalWindowImpl::HandleDOMEvent()  
	 nsDocument::HandleDOMEvent()  
	 nsGenericElement::HandleDOMEvent()  
	 PresShell::HandleEventInternal()  
	 PresShell::HandleEvent()  
	 nsViewManager::HandleEvent()  
	 nsView::HandleEvent()  
	 nsViewManager::DispatchEvent()  
	 HandleEvent()  
	 nsWidget::DispatchEvent()  
	 nsWidget::DispatchWindowEvent()  
	 nsWidget::OnInput()  
	 handle_key_press_event()  
	 dispatch_superwin_event()  
	 handle_gdk_event()   
 
     (3470513)	URL: www.mozilla.org/start
     (3470513)	Comments: PP  click on the layout  CTRL-$
     (3470467)	URL: www.mozilla.org/start
     (3470467)	Comments: PP  click on the layout  CTRL-A
     (3470333)	URL: www.mozilla.org/start
     (3470333)	Comments: Print Preview  click on the layout  CTRL-R
     (3470284)	URL: www.mozilla.org/start
     (3470284)	Comments: Print Preview  Click on the layout  CTRL-U
     (3470232)	URL: www.mozilla.org/start
     (3470232)	Comments: Print Preview  Click on the layout  CTRL-T
     (3470170)	URL: www.mozilla.org/start
     (3470170)	Comments: Print preview  click on the layout  CTRL-N
     (3361329)	URL: http://www.mozilla.org/start.html
     (3361329)	Comments: Print preview  ctrl-N
     (3357619)	URL: http://www.mozilla.org/search.html
     (3357619)	Comments: print previewtry to type in the form some letters

Also, although there were quite a few of these crashes in the past week or
so...I don't see any incidents after 2/26.  If noone can reproduce this with a
newer MozillaTrunk build, we probably should mark this worksforme.

Comment 20

[Peter Trudelle]

Unable to repro using N6 build 030508 on Win2K

Comment 21

[Arthur]

Everytime I crash in print preview I get additional error messages in the console: 

sending job 'arthur@calvin+569' to missingprinter@localhost
 connecting to 'localhost', attempt 1
 connected to 'localhost'
 requesting printer missingprinter@localhost
 job 'arthur@calvin+569' transfer to missingprinter@localhost failed
  error 'NONZERO RFC1179 ERROR CODE FROM SERVER' with ack 'ACK_FAIL'
  sending str '^Bmissingprinter' to missingprinter@localhost
 error msg: 'spool queue for 'missingprinter' does not exist on server calvin.local'
 error msg: '   non-existent printer or you need to run 'checkpc -f''

Looks as if mozilla tries to print something (don't have a printer installed). I
don't know whether that's related to the crash.

Comment 22

[sujay]

I can still reproduce this using 3/5 trunk commercial build on Win 98 system

Comment 23

[Peter Trudelle]

nsbeta1+ per Nav triage team

Comment 24

[Boris Zbarsky [:bzbarsky]]

*** Bug 130416 has been marked as a duplicate of this bug. ***

Comment 25

[Jay Patel [:jay]]

Regarding Arthur's comment #11: I'm not sure if he's on Linux or Windows...but
on my WinNT box, I removed my printers and tried to do a print preview and I got
a dialog box telling me I didn't have any printers installed and therefore could
not even get to the print preview window.  

I wonder Arthur's crash has to do with being able to get as far as the actual
print preview window without haveing a printer configured on his machine? 
Arthur, are you running on Linux or Windows?

Sujay: Have we always checked to see if a printer is installed on the system
before allowing the user to view the print preview window?  Or was that recently
put into the code?

Comment 26

[Jay Patel [:jay]]

Adding M099 to summary since this is a topcrasher for Mozilla 0.9.9.

Comment 27

[Jay Patel [:jay]]

Making topcrash+.

Comment 28

[Arthur]

Regarding #21 (not #11): That's my printerless laptop with SuSE Linux 7.3 an the
lpr print system.

Comment 29

[Chris Nebergall ([e-mail])]

This still occurs on Win XP build Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:0.9.9+) Gecko/20020313.

Crashes ONLY occur when I get to print preview from the Printer icon on the
Navigation toolbar.  A crash will NOT occur if I get to print preview from
File->Print Preview.  All other steps to reproduce the problem are the same.

Comment 30

[Jay Patel [:jay]]

I just crashed on WinNT with build 2002031203...and like Chris mentioned, I only
crash when I go to Print Preview from the Printer icon in the toolbar (seems to
work ok when I go to Print Preview from File->Print Preview).

Here's my incident with a recent stack and line numbers:
 Incident ID 4046357   
Stack Signature  0x00000000 85c234fe
Trigger Time 2002-03-14 11:43:32
Email Address [e-mail]
URL visited print preview
Build ID 2002031210
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
User Comments trying to change print preview scale % . doesn't crash when i go
to print preview from file->print preview...only when i go to the screen from
the printer icon menu in the toolbar.
Stack Trace
0x00000000
nsMenuPopupFrame::FindMenuWithShortcut
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuPopupFrame.cpp, line 1487]
nsMenuPopupFrame::ShortcutNavigation
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuPopupFrame.cpp, line 1540]
nsMenuListener::KeyPress
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuListener.cpp, line 228]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1654]
nsXULDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 2451]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3445]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3438]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3438]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3438]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3438]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3438]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3438]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1629]
nsHTMLInputElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp,
line 1383]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6056]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5979]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2043]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1863]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886]
nsWindow::DispatchKeyEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2660]
nsWindow::OnChar [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp,
line 2810]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3459]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131]
USER32.dll + 0x1820 (0x77e71820)
0x00200001 

Comment 31

[Samir Gehani]

Aha!  Comment 29 has helped me immensely.  I can now reproduce this crash. 
Thanks for the insight Chris Nebergall!

Comment 32

[Samir Gehani]

Attachment: Ensure window morphing (and especially menu removal) occurs after the menu has been closed.

Comment 33

[Samir Gehani]

Thanks to Bill Law for the approach.

law, please r.
alecf, please sr.

Comment 34

[Alec Flett]

Comment on attachment 74171 [details] [diff] [review]
Ensure window morphing (and especially menu removal) occurs after the menu has been closed.

I guess this is ok but it just masks the real problem, which could be occuring
all over our codebase.
can we put an assertion in the menu code just before the crash, at the very
least?

Comment 35

[Samir Gehani]

*** Bug 130068 has been marked as a duplicate of this bug. ***

Comment 36

[Samir Gehani]

Alec,
I think what we are doing here by morphing the window is not usual and I'd be
surprised if anyone else were doing the same thing in our codebase.  It has
generally been agreed that morphing is not a good idea, but, we chose this route
due to contraints in the backend I believe.  Rod can speak to that in greater
detail.  Hence, I don't believe this warrants an assertion in the menu code. 
What do you think?

Comment 37

[Alec Flett]

but if the assertion was there, then we would have caught this earlier, no? 

I'm saying put an assertion (and bulletproof the crash, I meant to add) in the
C++ menu code so that if someone ever attempts to add another feature that
morphs the window from a menu without a timeout, that we catch it, don't crash,
but still assert.

Comment 38

[Samir Gehani]

Alec,
Yup, I got what you were saying.  I guess an assertion doesn't hurt.  New patch
coming up.

Comment 39

[Samir Gehani]

Attachment: Revised patch with comment in menu code as discussed with Alec.

alecf, please sr.  Thanks.

Comment 40

[Bill Law]

Comment on attachment 74452 [details] [diff] [review]
Revised patch with comment in menu code as discussed with Alec.

r=law

I'm assuming that you didn't put in an ASSERT because there's no reliable way
to test for one of the "bogus" |immediateParent|.

Comment 41

[Alec Flett]

Comment on attachment 74452 [details] [diff] [review]
Revised patch with comment in menu code as discussed with Alec.

excellent, thanks 
sr=alecf

Comment 42

[Samir Gehani]

Bill,
Regarding comment 40: Yes, there was no apparent way to test for the bogus
|immediateParent|.  

Comment 43

[Asa Dotzler [:asa]]

Comment on attachment 74452 [details] [diff] [review]
Revised patch with comment in menu code as discussed with Alec.

a=asa (on behalf of drivers) for checkin to the 1.0 trunk

Comment 44

[Samir Gehani]

Fix checked in.

Comment 45

[sujay]

verified in 3/19 build

however, now there is a new problem where entering a scale value
followed by enter, blanks out the whole window.

filing separate bug on this.

Comment 46

[sujay]

ignore my last comment. I was using a frame site. thats why scale was not
working...this is a separate bug.

scale seems to work fine now....

verified in 3/19 build

Comment 47

[R.K.Aa.]

*** Bug 133779 has been marked as a duplicate of this bug. ***