Closed Bug 129980 Opened 22 years ago Closed 22 years ago

Crash right clicking while loading - Trunk M1RC1 [@ XULPopupListenerImpl::FireFocusOnTargetContent]

Categories

(Core :: XUL, defect, P2)

x86
All
defect

Tracking

()

VERIFIED FIXED
mozilla1.0

People

(Reporter: wolruf, Assigned: hewitt)

References

()

Details

(Keywords: crash, topcrash+, Whiteboard: [adt2] [Needs a=])

Crash Data

Attachments

(1 file)

Build ID: 2002031008 on Win2k.

Steps to reproduce:
1. Load URL http://www2.victoriassecret.com/bodybyvictoria/ ,
2. Observe it never finishes loading, page remains blank,
3. Right click on 'body' of page,
4. Mozilla crashes.

Stephen, can you retreive Talkback data please: TB3874239G ?
Keywords: crash
WFM Linux 2002030721.
XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 328]
XULPopupListenerImpl::PreLaunchPopup
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 299]
XULPopupListenerImpl::ContextMenu
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 200]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1503]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3457]
nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4680]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 714]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3240]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1672]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6057]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5975]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2043]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1863]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4713]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4963]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3606]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x39a3 (0x77e139a3)
USER32.DLL + 0x395f (0x77e1395f)
ntdll.dll + 0x2032f (0x77fa032f)
USER32.DLL + 0x474c (0x77e1474c)
USER32.DLL + 0x4ef0 (0x77e14ef0)
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x6a72 (0x77e16a72)
USER32.DLL + 0x6aee (0x77e16aee)
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1142]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x30e0 (0x77e130e0)
USER32.DLL + 0x5824 (0x77e15824)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 309]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1366]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1701]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1719]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 
Looks like bug 114377 was not entirely fixed, this site is a way to reproduce
the crash.
Assignee: asa → hyatt
Component: Browser-General → XP Toolkit/Widgets: Menus
QA Contact: doronr → shrir
Better summary.
Summary: Crashes when right clicking while loading → Crash right clicking while loading - Trunk [@ XULPopupListenerImpl::FireFocusOnTargetContent]
OS -> All, duped bug 129083 was on Win98.
OS: Windows 2000 → All
*** Bug 129083 has been marked as a duplicate of this bug. ***
*** Bug 137500 has been marked as a duplicate of this bug. ***
This is a topcrasher with Mozilla1.0 RC1:

XULPopupListenerImpl::FireFocusOnTargetContent   16
		 114377 	 VERI 	 FIXE 	 dbaron@fas.harvard.edu 	 mozilla0.9.8 	 2002-02-07 
BBID range: 5373200 - 5500654
Min/Max Seconds since last crash: 51 - 54139
Min/Max Runtime: 64 - 73002
Crash data range: 2002-04-19 to 2002-04-22
Build ID range: 2002041717 to 2002041717
Keyword List : 
Stack Trace: 

	 XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 328]
	 XULPopupListenerImpl::PreLaunchPopup
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 299]
	 XULPopupListenerImpl::ContextMenu
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 200]
	 nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp  line
1503]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3461]
	 nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 4690]
	 GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp  line 764]
	 nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp  line 3241]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1673]
	 PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6101]
	 PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6019]
	 nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 2076]
	 nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 306]
	 nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 1887]
	 HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 83]
	 nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 869]
	 nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 886]
	 nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4713]
	 ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4968]
	 nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3606]
	 nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 1131]
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x2f29 (0x77e12f29)
	 USER32.DLL + 0x2f4f (0x77e12f4f)
	 ntdll.dll + 0x2032f (0x77fa032f)
	 USER32.DLL + 0x2eaec (0x77e3eaec)
	 USER32.DLL + 0x4c17 (0x77e14c17)
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x42eb (0x77e142eb)
	 USER32.DLL + 0x4ce5 (0x77e14ce5)
	 nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 1142]
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x1cca (0x77e11cca)
	 USER32.DLL + 0x83f1 (0x77e183f1)
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 309]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1431]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1766]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1784]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0xd326 (0x77e8d326)
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xul/content/src/nsXULPopupListener.cpp
line : 328
     (5500654)	Comments: empty document... right click... bum...
     (5500608)	Comments: .
     (5500069)	URL: www.wehavethewayout.com
     (5440683)	Comments: I was editing a HTML-file (I was deleting columns from a table)
Mozilla crashed when I pressed a keyboard key  which should open the same menu
as right click on mouse does (the key between "Alt gr"- and "Ctrl" -keys. 
     (5407294)	URL: http://www.weisseseiten.ch
     (5407294)	Comments: Happened to click the right mouse button while the browser was
switching pages.  Browser was switching pages after my having pressed the "Back"
button  to return from search results to the initial page.
     (5399408)	URL: http://www.directline.co.uk/
     (5398737)	URL: http://www.directline.co.uk/
     (5398737)	Comments: Reproducing bug #137500  crash at 3a) as reported by reporter
     (5398622)	URL: http://www.directline.co.uk/
     (5398622)	Comments: Trying to look into Bug #137500  causes a crash as mentioned by
reporter section 3a)
     (5398505)	URL: http://www.directline.co.uk/
     (5398505)	Comments: Trying to reproduce problems as mentioned in bug #137500Cause a
crash in reporters reproduce notes 3a).
     (5379740)	URL: http://www.subastaspc.com/subastas.html
     (5379740)	Comments: Already sent 2 talkbacks.  This one is with RC1  also crashes.

Adding topcrash and qawanted keywords and nominating for nsbeta1. 
http://www.directline.co.uk/ is also crashing for people.  See duped bug 137500.
Bug 114377 looks like a similar crash that was fixed a while back...maybe there
are some clues there.
Summary: Crash right clicking while loading - Trunk [@ XULPopupListenerImpl::FireFocusOnTargetContent] → Crash right clicking while loading - Trunk M1RC1 [@ XULPopupListenerImpl::FireFocusOnTargetContent]
*** Bug 139342 has been marked as a duplicate of this bug. ***
Nav triage team: nsbeta1+, adt2.  Over to Joe.
Assignee: hyatt → hewitt
Keywords: nsbeta1nsbeta1+
Whiteboard: [adt2]
Priority: -- → P2
Target Milestone: --- → mozilla1.0
Here's the code around the crash:

321                    nsCOMPtr<nsIContent> content =
do_QueryInterface(aTargetNode);
322                    nsIFrame* targetFrame;
323                    shell->GetPrimaryFrameFor(content, &targetFrame);
324                  
325                    PRBool suppressBlur = PR_FALSE;
326                    const nsStyleUserInterface* ui;
327                    targetFrame->GetStyleData(eStyleStruct_UserInterface,
((const nsStyleStruct*&)ui));
328                    suppressBlur = (ui->mUserFocus ==
NS_STYLE_USER_FOCUS_IGNORE);

The crash is on line 327...could targetFrame be null?
Trying to reproduce this on Mac OS X, can't.  All referenced URLs load correctly
to begin with, so right clicking won't crash anyway.
I still crash on Win2k using build 2002050404 (trunk) on following URL:
http://216.239.39.100/search?q=cache:BgLYhv0Y7U4C:chess.about.com/library/weekly/aa053199.htm
(from bug 140730 which must be a dup of this one)
Talkback ID: TB5929988K.

Removing victoriassecret.com from URL field as it's on longer valid.
Parameters and Local Variables when the crash experienced in 
XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 328]

In line 327 we are deferencing the 'targetFrame' without doing null check. It is
worth adding a null check(handle appropriate error) to avoid crash and then fix
the real problem. 


XULPopupListenerImpl::FireFocusOnTargetContent
  this = Register variable - data not available
  aTargetNode = 0x037370c4
     (*aTargetNode) = Data not available
  rv = 0 (0x00000000)
  domDoc = {nsCOMPtr<nsIDOMDocument>}
  focusableContent = {nsCOMPtr<nsIContent>}
  content = {nsCOMPtr<nsIContent>}
  element = {nsCOMPtr<nsIDOMElement>}
  context = {nsCOMPtr<nsIPresContext>}        
  tempdoc = {nsCOMPtr<nsIDocument>}        
  targetFrame = 0x00000000          <--This  may be the problem
    (*targetFrame) = Data not available        
  shell = {nsCOMPtr<nsIPresShell>}        
  newFocus = {nsCOMPtr<nsIContent>}        
  esm = {nsCOMPtr<nsIEventStateManager>}        
  suppressBlur = 1241524 (0x0012f1b4)        
  currFrame = 0x60e7a279           
  (*currFrame) = Data not available        
  domElement = {nsCOMPtr<nsIDOMElement>}


Keywords: topcrashtopcrash+
Blocks: 136392
Attached patch patchSplinter Review
null check is all ya need
Whiteboard: [adt2] → [adt2][needs r=/sr=]
Comment on attachment 82372 [details] [diff] [review]
patch

r=peterl
Attachment #82372 - Flags: review+
Whiteboard: [adt2][needs r=/sr=] → [adt2][needs sr=]
Adding adt1.0.0+, please checkin to branch once you have a=drivers.
Keywords: adt1.0.0+
Whiteboard: [adt2][needs sr=] → [adt2]
Keywords: approval
Whiteboard: [adt2] → [adt2] [Needs a=]
Comment on attachment 82372 [details] [diff] [review]
patch

a=asa (on behalf of drivers) for checkin to the 1.0 branch.
Attachment #82372 - Flags: approval+
This kind of fix shouldn't wait till rtm, and neither should the one adt denied
for beta, but seems to want for rtm, over in bug 126277.  To be consistent, we
should take both of these valid null-check fixes now.  They're not going to
break anything, and they're not wallpaper slapped on top of corrupt memory or a
deeper problem.

/be
Blocks: 138000
Please check this into the branch today and add the fixed1.0.0 keyword.
fixed on trunk and branch (thanks ben)
Status: NEW → RESOLVED
Closed: 22 years ago
Keywords: fixed1.0.0
Resolution: --- → FIXED
verif fixd 1.0.0, trunk. guys(with reported urls), pls try out your scenarios as 
well just to be sure that this is completely fixed.
Status: RESOLVED → VERIFIED
Keywords: verified1.0.0
Component: XP Toolkit/Widgets: Menus → XUL
QA Contact: shrir → xptoolkit.widgets
Crash Signature: [@ XULPopupListenerImpl::FireFocusOnTargetContent]
Keywords: qawanted
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: