133183 - Mozilla crashes on right-click [@ nsMenuPopupFrame::SetCurrentMenuItem][@ nsMenuBarFrame::SetCurrentMenuItem]

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Krishnakumar B]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9+) Gecko/20020324
BuildID:    Build from CVS checked out at 18:00 03/24/02

Checked out the latest Mozilla from CVS and built with the following options.

# Options for 'configure' (same as command-line options).
ac_add_options --with-pthreads
ac_add_options --with-system-jpeg
ac_add_options --with-system-zlib
ac_add_options --with-system-png
ac_add_options --with-system-mng
ac_add_options --enable-toolkit-gtk
ac_add_options --disable-mailnews
ac_add_options --enable-crypto
ac_add_options --disable-jsd
ac_add_options --disable-chatzilla
ac_add_options --disable-ldap
ac_add_options --enable-xinerama
ac_add_options --disable-bidi
ac_add_options --disable-tests
ac_add_options --enable-xpcom-lea
ac_add_options --disable-debug
ac_add_options --enable-optimize="-O3 -march=i686"
ac_add_options --disable-dtd-debug
ac_add_options --disable-logging
ac_add_options --enable-elf-dynstr-gc

Visit any page. Right-click to open the context menu. Move pointer to choose any
menu item. Mozilla crashes.

Reproducible: Always
Steps to Reproduce:
1.Visit any page.
2.Right-click to open context-menu.
3.Move pointer. Mozilla crashes.

Actual Results:  Mozilla crashes.

Expected Results:  Mozilla should not crash.

Stack trace of crash.
#0  0x4115aff3 in nsMenuPopupFrame::SetCurrentMenuItem () from
/usr/local/mozilla/components/libgklayout.so
kitty> bt
#0  0x4115aff3 in nsMenuPopupFrame::SetCurrentMenuItem () from
/usr/local/mozilla/components/libgklayout.so
#1  0x4115e462 in nsMenuFrame::HandleEvent () from
/usr/local/mozilla/components/libgklayout.so
#2  0x410783e1 in PresShell::HandleEventInternal () from
/usr/local/mozilla/components/libgklayout.so
#3  0x41078200 in PresShell::HandleEvent () from
/usr/local/mozilla/components/libgklayout.so
#4  0x4121917e in nsViewManager::HandleEvent () from
/usr/local/mozilla/components/libgkview.so
#5  0x4120f007 in nsView::HandleEvent () from
/usr/local/mozilla/components/libgkview.so
#6  0x412187aa in nsViewManager::DispatchEvent () from
/usr/local/mozilla/components/libgkview.so
#7  0x4120ecde in HandleEvent () from /usr/local/mozilla/components/libgkview.so
#8  0x40c12301 in nsWidget::DispatchEvent () from
/usr/local/mozilla/components/libwidget_gtk.so
#9  0x40c108ba in nsWidget::DispatchMouseEvent () from
/usr/local/mozilla/components/libwidget_gtk.so
#10 0x40c10b30 in nsWidget::OnMotionNotifySignal () from
/usr/local/mozilla/components/libwidget_gtk.so
#11 0x40c15651 in nsWindow::HandleGDKEvent () from
/usr/local/mozilla/components/libwidget_gtk.so
#12 0x40c0b07a in dispatch_superwin_event () from
/usr/local/mozilla/components/libwidget_gtk.so
#13 0x40c0ac3e in handle_gdk_event () from
/usr/local/mozilla/components/libwidget_gtk.so
#14 0x4039fd7f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#15 0x403d3773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#16 0x403d3d39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#17 0x403d3eec in g_main_run () from /usr/lib/libglib-1.2.so.0
#18 0x402ee333 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#19 0x40c02d89 in nsAppShell::Run () from
/usr/local/mozilla/components/libwidget_gtk.so
#20 0x40be3ad2 in nsAppShellService::Run () from
/usr/local/mozilla/components/libnsappshell.so
#21 0x08052155 in main1 ()
#22 0x08052a5b in main ()
#23 0x405116f7 in __libc_start_main () from /lib/libc.so.6

Comment 1

[Vadim Berezniker]

I had a similiar experience couple of days ago where moving mouse over a menu
would crash mozilla.

Exiting Mozilla, deleting component.reg from dist/bin, and then restarting
mozilla seemed to have made it go away.

Comment 2

[Brian Ryner (not reading)]

This is mine, I think.

Comment 3

[Brian Ryner (not reading)]

Attachment: fix the crash

This fixes the crash in question.  I also added an assertion and bulletproofing
to catch any other cases (I need to go back and ensure that we construct a
XULMenuElement in any case that a MenuPopupFrame is to be constructed).

Comment 4

[Stuart Parmenter]

Comment on attachment 75905 [details] [diff] [review]
fix the crash

r=pavlov

Comment 5

[Scott Collins]

Comment on attachment 75905 [details] [diff] [review]
fix the crash

sr=scc

Comment 6

[Asa Dotzler [:asa]]

Comment on attachment 75905 [details] [diff] [review]
fix the crash

a=asa (on behalf of drivers) for checkin to the 1.0 trunk

Comment 7

[Brian Ryner (not reading)]

checked in.

Comment 8

[John Morrison]

*** Bug 130701 has been marked as a duplicate of this bug. ***

Comment 9

[Jay Patel [:jay]]

Adding topcrash keyword for future reference.

Comment 10

[Jay Patel [:jay]]

Updating summary with [@ nsMenuPopupFrame::SetCurrentMenuItem]...since the crash
reported in this bug shows that as the stack signature.  Leaving  [@
nsMenuBarFrame::SetCurrentMenuItem] in the summary for duped bug 130701.

I don't see any crashes from Talkback since the checkin went in...marking verified.