129980 - Crash right clicking while loading - Trunk M1RC1 [@ XULPopupListenerImpl::FireFocusOnTargetContent]

Status: VERIFIED FIXED

(Core :: XUL, defect, P2)

Description

[Olivier Cahagne]

Build ID: 2002031008 on Win2k.

Steps to reproduce:
1. Load URL http://www2.victoriassecret.com/bodybyvictoria/ ,
2. Observe it never finishes loading, page remains blank,
3. Right click on 'body' of page,
4. Mozilla crashes.

Stephen, can you retreive Talkback data please: TB3874239G ?

Comment 1

[R.B.]

WFM Linux 2002030721.

Comment 2

[[e-mail] (gone - use [e-mail] instead)]

XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 328]
XULPopupListenerImpl::PreLaunchPopup
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 299]
XULPopupListenerImpl::ContextMenu
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp,
line 200]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1503]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3457]
nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4680]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 714]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3240]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1672]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6057]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5975]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2043]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1863]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4713]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4963]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3606]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x39a3 (0x77e139a3)
USER32.DLL + 0x395f (0x77e1395f)
ntdll.dll + 0x2032f (0x77fa032f)
USER32.DLL + 0x474c (0x77e1474c)
USER32.DLL + 0x4ef0 (0x77e14ef0)
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x6a72 (0x77e16a72)
USER32.DLL + 0x6aee (0x77e16aee)
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1142]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x30e0 (0x77e130e0)
USER32.DLL + 0x5824 (0x77e15824)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 309]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1366]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1701]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1719]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 3

[Olivier Cahagne]

Looks like bug 114377 was not entirely fixed, this site is a way to reproduce
the crash.

Comment 4

[Olivier Cahagne]

Better summary.

Comment 5

[Adam Hauner]

OS -> All, duped bug 129083 was on Win98.

Comment 6

[Adam Hauner]

*** Bug 129083 has been marked as a duplicate of this bug. ***

Comment 7

[Jay Patel [:jay]]

*** Bug 137500 has been marked as a duplicate of this bug. ***

Comment 8

[Jay Patel [:jay]]

This is a topcrasher with Mozilla1.0 RC1:

XULPopupListenerImpl::FireFocusOnTargetContent   16
		 114377 	 VERI 	 FIXE 	 [e-mail] 	 mozilla0.9.8 	 2002-02-07 
BBID range: 5373200 - 5500654
Min/Max Seconds since last crash: 51 - 54139
Min/Max Runtime: 64 - 73002
Crash data range: 2002-04-19 to 2002-04-22
Build ID range: 2002041717 to 2002041717
Keyword List : 
Stack Trace: 

	 XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 328]
	 XULPopupListenerImpl::PreLaunchPopup
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 299]
	 XULPopupListenerImpl::ContextMenu
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 200]
	 nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp  line
1503]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3461]
	 nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 4690]
	 GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp  line 764]
	 nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp  line 3241]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1673]
	 PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6101]
	 PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6019]
	 nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 2076]
	 nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 306]
	 nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 1887]
	 HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 83]
	 nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 869]
	 nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 886]
	 nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4713]
	 ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4968]
	 nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3606]
	 nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 1131]
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x2f29 (0x77e12f29)
	 USER32.DLL + 0x2f4f (0x77e12f4f)
	 ntdll.dll + 0x2032f (0x77fa032f)
	 USER32.DLL + 0x2eaec (0x77e3eaec)
	 USER32.DLL + 0x4c17 (0x77e14c17)
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x42eb (0x77e142eb)
	 USER32.DLL + 0x4ce5 (0x77e14ce5)
	 nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 1142]
	 USER32.DLL + 0x1b60 (0x77e11b60)
	 USER32.DLL + 0x1cca (0x77e11cca)
	 USER32.DLL + 0x83f1 (0x77e183f1)
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 309]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1431]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1766]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1784]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0xd326 (0x77e8d326)
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xul/content/src/nsXULPopupListener.cpp
line : 328
     (5500654)	Comments: empty document... right click... bum...
     (5500608)	Comments: .
     (5500069)	URL: www.wehavethewayout.com
     (5440683)	Comments: I was editing a HTML-file (I was deleting columns from a table)
Mozilla crashed when I pressed a keyboard key  which should open the same menu
as right click on mouse does (the key between "Alt gr"- and "Ctrl" -keys. 
     (5407294)	URL: http://www.weisseseiten.ch
     (5407294)	Comments: Happened to click the right mouse button while the browser was
switching pages.  Browser was switching pages after my having pressed the "Back"
button  to return from search results to the initial page.
     (5399408)	URL: http://www.directline.co.uk/
     (5398737)	URL: http://www.directline.co.uk/
     (5398737)	Comments: Reproducing bug #137500  crash at 3a) as reported by reporter
     (5398622)	URL: http://www.directline.co.uk/
     (5398622)	Comments: Trying to look into Bug #137500  causes a crash as mentioned by
reporter section 3a)
     (5398505)	URL: http://www.directline.co.uk/
     (5398505)	Comments: Trying to reproduce problems as mentioned in bug #137500Cause a
crash in reporters reproduce notes 3a).
     (5379740)	URL: http://www.subastaspc.com/subastas.html
     (5379740)	Comments: Already sent 2 talkbacks.  This one is with RC1  also crashes.

Adding topcrash and qawanted keywords and nominating for nsbeta1. 
http://www.directline.co.uk/ is also crashing for people.  See duped bug 137500.

Comment 9

[Jay Patel [:jay]]

Bug 114377 looks like a similar crash that was fixed a while back...maybe there
are some clues there.

Comment 10

[Peter Lubczynski]

*** Bug 139342 has been marked as a duplicate of this bug. ***

Comment 11

[Peter Trudelle]

Nav triage team: nsbeta1+, adt2.  Over to Joe.

Comment 12

[Jay Patel [:jay]]

Here's the code around the crash:

321                    nsCOMPtr<nsIContent> content =
do_QueryInterface(aTargetNode);
322                    nsIFrame* targetFrame;
323                    shell->GetPrimaryFrameFor(content, &targetFrame);
324                  
325                    PRBool suppressBlur = PR_FALSE;
326                    const nsStyleUserInterface* ui;
327                    targetFrame->GetStyleData(eStyleStruct_UserInterface,
((const nsStyleStruct*&)ui));
328                    suppressBlur = (ui->mUserFocus ==
NS_STYLE_USER_FOCUS_IGNORE);

The crash is on line 327...could targetFrame be null?

Comment 13

[Joe Hewitt (gone)]

Trying to reproduce this on Mac OS X, can't.  All referenced URLs load correctly
to begin with, so right clicking won't crash anyway.

Comment 14

[Olivier Cahagne]

I still crash on Win2k using build 2002050404 (trunk) on following URL:
http://216.239.39.100/search?q=cache:BgLYhv0Y7U4C:chess.about.com/library/weekly/aa053199.htm
(from bug 140730 which must be a dup of this one)
Talkback ID: TB5929988K.

Removing victoriassecret.com from URL field as it's on longer valid.

Comment 15

[Shiva Thirumazhusai]

Parameters and Local Variables when the crash experienced in 
XULPopupListenerImpl::FireFocusOnTargetContent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULPopupListener.cpp 
line 328]

In line 327 we are deferencing the 'targetFrame' without doing null check. It is
worth adding a null check(handle appropriate error) to avoid crash and then fix
the real problem. 


XULPopupListenerImpl::FireFocusOnTargetContent
  this = Register variable - data not available
  aTargetNode = 0x037370c4
     (*aTargetNode) = Data not available
  rv = 0 (0x00000000)
  domDoc = {nsCOMPtr<nsIDOMDocument>}
  focusableContent = {nsCOMPtr<nsIContent>}
  content = {nsCOMPtr<nsIContent>}
  element = {nsCOMPtr<nsIDOMElement>}
  context = {nsCOMPtr<nsIPresContext>}        
  tempdoc = {nsCOMPtr<nsIDocument>}        
  targetFrame = 0x00000000          <--This  may be the problem
    (*targetFrame) = Data not available        
  shell = {nsCOMPtr<nsIPresShell>}        
  newFocus = {nsCOMPtr<nsIContent>}        
  esm = {nsCOMPtr<nsIEventStateManager>}        
  suppressBlur = 1241524 (0x0012f1b4)        
  currFrame = 0x60e7a279           
  (*currFrame) = Data not available        
  domElement = {nsCOMPtr<nsIDOMElement>}

Comment 16

[Joe Hewitt (gone)]

Attachment: patch

null check is all ya need

Comment 17

[Peter Lubczynski]

Comment on attachment 82372 [details] [diff] [review]
patch

r=peterl

Comment 18

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 82372 [details] [diff] [review]
patch

sr=[e-mail]

Comment 19

[Peter Trudelle]

Adding adt1.0.0+, please checkin to branch once you have a=drivers.

Comment 20

[Asa Dotzler [:asa]]

Comment on attachment 82372 [details] [diff] [review]
patch

a=asa (on behalf of drivers) for checkin to the 1.0 branch.

Comment 21

[Brendan Eich [:brendan]]

This kind of fix shouldn't wait till rtm, and neither should the one adt denied
for beta, but seems to want for rtm, over in bug 126277.  To be consistent, we
should take both of these valid null-check fixes now.  They're not going to
break anything, and they're not wallpaper slapped on top of corrupt memory or a
deeper problem.

/be

Comment 22

[scottputterman]

Please check this into the branch today and add the fixed1.0.0 keyword.

Comment 23

[Joe Hewitt (gone)]

fixed on trunk and branch (thanks ben)

Comment 24

[shrirang khanzode]

verif fixd 1.0.0, trunk. guys(with reported urls), pls try out your scenarios as 
well just to be sure that this is completely fixed.