129980 - Crash right clicking while loading - Trunk M1RC1 [@ XULPopupListenerImpl::FireFocusOnTargetContent]

Reporter

Description

•

21 years ago

Build ID: 2002031008 on Win2k.

Steps to reproduce:
1. Load URL http://www2.victoriassecret.com/bodybyvictoria/ ,
2. Observe it never finishes loading, page remains blank,
3. Right click on 'body' of page,
4. Mozilla crashes.

Stephen, can you retreive Talkback data please: TB3874239G ?

Olivier Cahagne

Reporter

Updated

•

21 years ago

Keywords: crash

R.B.

Comment 1

•

21 years ago

WFM Linux 2002030721.

stephend@netscape.com (gone - use stephen.donner@gmail.com instead)

Comment 2

•

21 years ago

XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 328]
XULPopupListenerImpl::PreLaunchPopup
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 299]
XULPopupListenerImpl::ContextMenu
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 200]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1503]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3457]
nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4680]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 714]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3240]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1672]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6057]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5975]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2043]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1863]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4713]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4963]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3606]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x39a3 (0x77e139a3)
USER32.DLL + 0x395f (0x77e1395f)
ntdll.dll + 0x2032f (0x77fa032f)
USER32.DLL + 0x474c (0x77e1474c)
USER32.DLL + 0x4ef0 (0x77e14ef0)
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x6a72 (0x77e16a72)
USER32.DLL + 0x6aee (0x77e16aee)
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1142]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x30e0 (0x77e130e0)
USER32.DLL + 0x5824 (0x77e15824)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 309]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1366]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1701]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1719]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08)

Olivier Cahagne

Reporter

Comment 3

•

21 years ago

Looks like bug 114377 was not entirely fixed, this site is a way to reproduce
the crash.

Assignee: asa → hyatt

Component: Browser-General → XP Toolkit/Widgets: Menus

QA Contact: doronr → shrir

Olivier Cahagne

Reporter

Comment 4

•

21 years ago

Better summary.

Summary: Crashes when right clicking while loading → Crash right clicking while loading - Trunk [@ XULPopupListenerImpl::FireFocusOnTargetContent]

Adam Hauner

Comment 5

•

21 years ago

OS -> All, duped bug 129083 was on Win98.

OS: Windows 2000 → All

Adam Hauner

Comment 6

•

21 years ago

*** Bug 129083 has been marked as a duplicate of this bug. ***

Jay Patel [:jay]

Comment 7

•

21 years ago

*** Bug 137500 has been marked as a duplicate of this bug. ***

Jay Patel [:jay]

Comment 8

•

21 years ago

This is a topcrasher with Mozilla1.0 RC1:

XULPopupListenerImpl::FireFocusOnTargetContent   16
		 114377 	 VERI 	 FIXE 	 dbaron@fas.harvard.edu 	 mozilla0.9.8 	 2002-02-07 
BBID range: 5373200 - 5500654
Min/Max Seconds since last crash: 51 - 54139
Min/Max Runtime: 64 - 73002
Crash data range: 2002-04-19 to 2002-04-22
Build ID range: 2002041717 to 2002041717
Keyword List : 
Stack Trace: 

	 XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 328]
	 XULPopupListenerImpl::PreLaunchPopup
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 299]
	 XULPopupListenerImpl::ContextMenu
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 200]
	 nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp  line
1503]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3461]
	 nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 4690]
	 GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp  line 764]
	 nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp  line 3241]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1673]
	 PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6101]
	 PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6019]
	 nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 2076]
	 nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 306]
	 nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 1887]
	 HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 83]
	 nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 869]
	 nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 886]
	 nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4713]
	 ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4968]
	 nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3606]
	 nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 1131]
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x2f29 (0x77e12f29)
	 USER32.DLL + 0x2f4f (0x77e12f4f)
	 ntdll.dll + 0x2032f (0x77fa032f)
	 USER32.DLL + 0x2eaec (0x77e3eaec)
	 USER32.DLL + 0x4c17 (0x77e14c17)
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x42eb (0x77e142eb)
	 USER32.DLL + 0x4ce5 (0x77e14ce5)
	 nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 1142]
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x1cca (0x77e11cca)
	 USER32.DLL + 0x83f1 (0x77e183f1)
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 309]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1431]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1766]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1784]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0xd326 (0x77e8d326)
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xul/content/src/nsXULPopupListener.cpp
line : 328
     (5500654)	Comments: empty document... right click... bum...
     (5500608)	Comments: .
     (5500069)	URL: www.wehavethewayout.com
     (5440683)	Comments: I was editing a HTML-file (I was deleting columns from a table)
Mozilla crashed when I pressed a keyboard key  which should open the same menu
as right click on mouse does (the key between "Alt gr"- and "Ctrl" -keys. 
     (5407294)	URL: http://www.weisseseiten.ch
     (5407294)	Comments: Happened to click the right mouse button while the browser was
switching pages.  Browser was switching pages after my having pressed the "Back"
button  to return from search results to the initial page.
     (5399408)	URL: http://www.directline.co.uk/
     (5398737)	URL: http://www.directline.co.uk/
     (5398737)	Comments: Reproducing bug #137500  crash at 3a) as reported by reporter
     (5398622)	URL: http://www.directline.co.uk/
     (5398622)	Comments: Trying to look into Bug #137500  causes a crash as mentioned by
reporter section 3a)
     (5398505)	URL: http://www.directline.co.uk/
     (5398505)	Comments: Trying to reproduce problems as mentioned in bug #137500Cause a
crash in reporters reproduce notes 3a).
     (5379740)	URL: http://www.subastaspc.com/subastas.html
     (5379740)	Comments: Already sent 2 talkbacks.  This one is with RC1  also crashes.

Adding topcrash and qawanted keywords and nominating for nsbeta1. 
http://www.directline.co.uk/ is also crashing for people.  See duped bug 137500.

URL: http://www2.victoriassecret.com/bodyb... → http://www2.victoriassecret.com/bodyb...

Keywords: nsbeta1, qawanted, topcrash

Jay Patel [:jay]

Comment 9

•

21 years ago

Bug 114377 looks like a similar crash that was fixed a while back...maybe there
are some clues there.

Summary: Crash right clicking while loading - Trunk [@ XULPopupListenerImpl::FireFocusOnTargetContent] → Crash right clicking while loading - Trunk M1RC1 [@ XULPopupListenerImpl::FireFocusOnTargetContent]

Peter Lubczynski

Comment 10

•

21 years ago

*** Bug 139342 has been marked as a duplicate of this bug. ***

Peter Trudelle

Comment 11

•

21 years ago

Nav triage team: nsbeta1+, adt2.  Over to Joe.

Assignee: hyatt → hewitt

Keywords: nsbeta1 → nsbeta1+

Whiteboard: [adt2]

Peter Trudelle

Updated

•

21 years ago

Priority: -- → P2

Target Milestone: --- → mozilla1.0

Jay Patel [:jay]

Comment 12

•

21 years ago

Here's the code around the crash:

321                    nsCOMPtr<nsIContent> content =
do_QueryInterface(aTargetNode);
322                    nsIFrame* targetFrame;
323                    shell->GetPrimaryFrameFor(content, &targetFrame);
324                  
325                    PRBool suppressBlur = PR_FALSE;
326                    const nsStyleUserInterface* ui;
327                    targetFrame->GetStyleData(eStyleStruct_UserInterface,
((const nsStyleStruct*&)ui));
328                    suppressBlur = (ui->mUserFocus ==
NS_STYLE_USER_FOCUS_IGNORE);

The crash is on line 327...could targetFrame be null?

Joe Hewitt (gone)

Assignee

Comment 13

•

21 years ago

Trying to reproduce this on Mac OS X, can't.  All referenced URLs load correctly
to begin with, so right clicking won't crash anyway.

Olivier Cahagne

Reporter

Comment 14

•

21 years ago

I still crash on Win2k using build 2002050404 (trunk) on following URL:
http://216.239.39.100/search?q=cache:BgLYhv0Y7U4C:chess.about.com/library/weekly/aa053199.htm
(from bug 140730 which must be a dup of this one)
Talkback ID: TB5929988K.

Removing victoriassecret.com from URL field as it's on longer valid.

URL: http://www2.victoriassecret.com/bodyb... → http://www.directline.co.uk/

Shiva Thirumazhusai

Comment 15

•

21 years ago

Parameters and Local Variables when the crash experienced in 
XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 328]

In line 327 we are deferencing the 'targetFrame' without doing null check. It is
worth adding a null check(handle appropriate error) to avoid crash and then fix
the real problem. 


XULPopupListenerImpl::FireFocusOnTargetContent
  this = Register variable - data not available
  aTargetNode = 0x037370c4
     (*aTargetNode) = Data not available
  rv = 0 (0x00000000)
  domDoc = {nsCOMPtr<nsIDOMDocument>}
  focusableContent = {nsCOMPtr<nsIContent>}
  content = {nsCOMPtr<nsIContent>}
  element = {nsCOMPtr<nsIDOMElement>}
  context = {nsCOMPtr<nsIPresContext>}        
  tempdoc = {nsCOMPtr<nsIDocument>}        
  targetFrame = 0x00000000          <--This  may be the problem
    (*targetFrame) = Data not available        
  shell = {nsCOMPtr<nsIPresShell>}        
  newFocus = {nsCOMPtr<nsIContent>}        
  esm = {nsCOMPtr<nsIEventStateManager>}        
  suppressBlur = 1241524 (0x0012f1b4)        
  currFrame = 0x60e7a279           
  (*currFrame) = Data not available        
  domElement = {nsCOMPtr<nsIDOMElement>}

Keywords: topcrash → topcrash+

Shiva Thirumazhusai

Updated

•

21 years ago

Blocks: 136392

Joe Hewitt (gone)

Assignee

Comment 16

•

21 years ago

Attached patch patch — Details — Splinter Review

null check is all ya need

Shiva Thirumazhusai

Updated

•

21 years ago

Whiteboard: [adt2] → [adt2][needs r=/sr=]

Peter Lubczynski

Comment 17

•

21 years ago

Comment on attachment 82372 [details] [diff] [review]
patch

r=peterl

Attachment #82372 - Flags: review+

Shiva Thirumazhusai

Updated

•

21 years ago

Whiteboard: [adt2][needs r=/sr=] → [adt2][needs sr=]

Ben Goodger (use ben at mozilla dot org for email)

Comment 18

•

21 years ago

Comment on attachment 82372 [details] [diff] [review]
patch

sr=ben@netscape.com

Attachment #82372 - Flags: superreview+

Peter Trudelle

Comment 19

•

21 years ago

Adding adt1.0.0+, please checkin to branch once you have a=drivers.

Keywords: adt1.0.0+

Whiteboard: [adt2][needs sr=] → [adt2]

Jaime Rodriguez, Jr.

Updated

•

21 years ago

Keywords: approval

Whiteboard: [adt2] → [adt2] [Needs a=]

Asa Dotzler [:asa]

Comment 20

•

21 years ago

Comment on attachment 82372 [details] [diff] [review]
patch

a=asa (on behalf of drivers) for checkin to the 1.0 branch.

Attachment #82372 - Flags: approval+

Brendan Eich [:brendan]

Comment 21

•

21 years ago

This kind of fix shouldn't wait till rtm, and neither should the one adt denied
for beta, but seems to want for rtm, over in bug 126277.  To be consistent, we
should take both of these valid null-check fixes now.  They're not going to
break anything, and they're not wallpaper slapped on top of corrupt memory or a
deeper problem.

/be

Brendan Eich [:brendan]

Updated

•

21 years ago

Blocks: 138000

scottputterman

Comment 22

•

21 years ago

Please check this into the branch today and add the fixed1.0.0 keyword.

Joe Hewitt (gone)

Assignee

Comment 23

•

21 years ago

fixed on trunk and branch (thanks ben)

Status: NEW → RESOLVED

Closed: 21 years ago

Keywords: fixed1.0.0

Resolution: --- → FIXED

shrirang khanzode

Comment 24

•

21 years ago

verif fixd 1.0.0, trunk. guys(with reported urls), pls try out your scenarios as 
well just to be sure that this is completely fixed.

Status: RESOLVED → VERIFIED

Keywords: verified1.0.0

timeless

Updated

•

15 years ago

Component: XP Toolkit/Widgets: Menus → XUL

QA Contact: shrir → xptoolkit.widgets

Nobody; OK to take it and work on it

Updated

•

12 years ago

Crash Signature: [@ XULPopupListenerImpl::FireFocusOnTargetContent]

Peter Bylenga [:PBylenga]

Updated

•

9 years ago

Keywords: qawanted