132672 - [FIX]Old FocusEvent listener is not removed from document

Status: VERIFIED FIXED

(Core :: Print Preview, defect)

Description

[André Dahlqvist]

[Build-ID: 2002-03-21-08]

I have filed quiet a few talkback reports on this crash, namely:

TB4321302M
TB4321213K
TB4321077H
TB4320725X
TB4320671K

Steps to reproduce:

1) Go to http://www.google.com/
2) Click on File->Print Preview
3) Click on Page Setup
4) Click on Margin & Header/Footer
5) Click Cancel
6) Go to http://www.aftonbladet.se/

Result: Crash

This is 100% reproducable for me. A few times the crash happened right after I
closed Print Preview, but I couldn't find the exact steps to reproduce that
simplified case. The above steps should do it however.

Comment 1

[José Jeria]

Cannot reproduce this crash using build 20020330, Windows 2000. Maybe Linux only?

Comment 2

[André Dahlqvist]

I can't reproduce this with a recent CVS build, BUT I would like it if someone
would still check out the talkback reports since it could well be that
aftonbladet has changed their site, and that's why the crash doesn't happen anymore.

Comment 3

[rods (gone)]

I can't reproduce this either.

Comment 4

[André Dahlqvist]

Sorry, I have to reopen this since I just reproduced it again with
29002-04-02-11 on Linux. I used the steps above, and did them quickly. Talkback
ID of the crash is:

TB4770104E

Comment 5

[Frederic Bezies]

Strange bug ! Cannot reproduce it !

Build : 2002040203 - WinXP

Comment 6

[Asa Dotzler [:asa]]

Andre's crash looks like this in TalkBack:
nsEventListenerManager::HandleEvent()
nsDocument::HandleDOMEvent()
nsEventStateManager::PreHandleEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsViewManager::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchFocus()
nsWindow::DispatchSetFocusEvent()
nsWindow::SetFocus()
GlobalWindowImpl::Focus()
CheckForFocus()
PresShell::UnsuppressAndInvalidate()
PresShell::UnsuppressPainting()
PresShell::sPaintSuppressionCallback()
nsTimerImpl::Process()
handleMyEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0xee10 (0x40373e10)
libglib-1.2.so.0 + 0x104d8 (0x403754d8)
libglib-1.2.so.0 + 0x10ae3 (0x40375ae3)
libglib-1.2.so.0 + 0x10c7c (0x40375c7c)
libgtk-1.2.so.0 + 0x8d7e7 (0x402967e7)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1d6cf (0x404b96cf) 

Comment 7

[André Dahlqvist]

Bug 133593 has a similar stack as this bug, but I'm not sure they are related.

Comment 8

[André Dahlqvist]

Bug 134266 seems to be a duplicate of this bug.

Comment 9

[André Dahlqvist]

I think bug 135374 is also a dupe of this one.

Comment 10

[Tim]

Attachment: Mozilla output, core dump backtrace

I pulled mozilla from CVS about three hours ago and made this backtrace from
the core file I was able to reproduce (with mozillanews.org).  Output of
mozilla is included at the top.  Both are mostly snipped (the dump was only ~35
frames, so it's there in full).  I hope this helps.

Comment 11

[André Dahlqvist]

*** Bug 135374 has been marked as a duplicate of this bug. ***

Comment 12

[André Dahlqvist]

*** Bug 134266 has been marked as a duplicate of this bug. ***

Comment 13

[Carsten Menke]

I found a way of reproducing it, kryptolus on Irc could also reproduce it that way.

If your running cups you could do the following:
Go:
http://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&field0-0-0=product&type0-0-0=substring&value0-0-0=print&field0-0-1=component&type0-0-1=substring&value0-0-1=print&field0-0-2=short_desc&type0-0-2=substring&value0-0-2=print&field0-0-3=status_whiteboard&type0-0-3=substring&value0-0-3=print&field1-0-0=product&type1-0-0=substring&value1-0-0=preview&field1-0-1=component&type1-0-1=substring&value1-0-1=preview&field1-0-2=short_desc&type1-0-2=substring&value1-0-2=preview&field1-0-3=status_whiteboard&type1-0-3=substring&value1-0-3=preview

(It is the query you get from "Print Preview" on the Bugzilla Search)
Then hit Print Preview, close it. Print it. And then go to localhost:631 to use
cups to cancel that print job. See Mozilla crashing. 

Normally Cups runs on Port 631. So this only happens in this case, normally
Mozilla is not crashing when I'm configuring the printer with cups. Also I found
that this occurs when you hit Logout on a member page, after you had used print
preview, print.

Comment 14

[Vadim Berezniker]

100% way that does it for me:
1. Create an empty file (I called it cups.html)
2. File -> Print Preview
3. Close
4. File -> Print (and then I print to file)
5. Reload the page -> CRASH

Comment 15

[Vadim Berezniker]

better phrased
1. Create an empty local file (I called it cups.html)
2. Open that file in the browser
3. File -> Print Preview
4. Close
5. File -> Print (and then I print to file)
6. Reload the page -> CRASH (with same stack as mentioned in this bug)
linux trunk 2002042015

Comment 16

[Manoj]

If this is a Linux only bug then u can ignore my comment, but this works fine
for me on Windows XP.

Here is my configuration:

OS: Win XP
Build: 2002050608
I followed the steps as mentioned and re-did them just in case. No crash. I have
mozilla running since the this morning at 7am.

Comment 17

[José Jeria]

Another way to reproduce this is to:
1. Go to resource:///res/samples/test12.html (You wont see anything bug 135653)
2. Go to Print Preview and close it.
3. Repeat step 2 --> crash.

Also see bug 132672.

Comment 18

[José Jeria]

Sorry I meant bug 143036 

Comment 19

[Darin Fisher]

see talkback incident 6319400... related?

i used print preview on a document, printed it, and then pressed the back
button... was viewing a page in the SJSU course catalog.

Comment 20

[Darin Fisher]

sorry, i should add that the crash i observed was with RC2 under linux.

Comment 21

[Arthur]

That's my personal topcrash bug for weeks now (it's the only crasher actually).
With 2002051909 1.0.0 branch build I've got TB6461370W, TB6461327W and many
more. Easiest reproducable when previewing about:blank and going to mozilla.org
or adsl.ch via the URL bar.

I've got some difficulties debugging this with 'mozilla -g'. If anyone can give
me a helping hand, I'll try to find the cause of this bug (I'm back home next week).

Comment 22

[José Jeria]

Shouldnt keyword topcrash be added?

Comment 23

[rods (gone)]

Top crash should be added when it is crashing for lot of people, this is just a
top crash for the Andre.

Comment 24

[rods (gone)]

Attachment: patch

The first two parts of the diff basically remembers the old focuslistener and
then unregisters it after the new one is registered. The rest is just
additional debug statments that are ifdef'ed out except in my builds.

The patch is low risk.

Comment 25

[rods (gone)]

I forgot to mention that the listener is deconstructed and it is still
registered as a listener, so in some cases a blur event goes to the old listener
that is why it crashes.

Comment 26

[Kevin McCluskey (gone)]

nsbeta1+

Comment 27

[Johnny Stenback (:jst)]

Comment on attachment 84435 [details] [diff] [review]
patch

Change the text in the new NS_ASSERT() to reflect what the real error was if we
ever hit that assert.

r/sr=jst

Comment 28

[dcone (gone)]

Comment on attachment 84435 [details] [diff] [review]
patch

r=dcone

Comment 29

[rods (gone)]

fixed

Comment 30

[rods (gone)]

really fixed

Comment 31

[scottputterman]

adding adt1.0.0+.  Please get drivers approval and then check into the 1.0 branch.

Comment 32

[sujay]

verified in 5/22 trunk build.

Comment 33

[José Jeria]

Using trunk build 20020522 and the comment 17 I made still makes Mozilla to
crash. Maybe I should open a new bug for this.

Comment 34

[André Dahlqvist]

Yes José, file a new bug on that. I can not reproduce this bug with the steps
that I originally used when I now try it with 2002-05-23-01.

Comment 35

[José Jeria]

FYI:
Bug 146439 posted for comment 17.

Comment 36

[scottputterman]

changing to adt1.0.1+ for checkin to the 1.0 branch.  Please get drivers
approval before checking in.

Comment 37

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 38

[rods (gone)]

fixed on branch