Closed Bug 137191 Opened 23 years ago Closed 22 years ago

Infinite recursion near nsEventStateManager::TabIntoDocument, (Inspector, Account Central) [@ nsScriptSecurityManager::doGetObjectPrincipal]

Categories

(Core :: DOM: Events, defect, P1)

x86
Windows NT
defect

Tracking

()

RESOLVED FIXED

People

(Reporter: ron, Assigned: bryner)

References

(Blocks 1 open bug, )

Details

(Keywords: crash, topcrash+)

Crash Data

Attachments

(1 file)

Reliable crash. Preconditions: load page in DOM Inspector, select a DOM element, choose to Inspect in New Window, choose XBL from drop down options list. Result: Full crash, CPU 100% for ~3 seconds, Dr Watson. TB5136403H TB5135837H
Reporter: Please always use severity level "critical" for crashes, and add the keyword "crash". Thank you for using Bugzilla!
Stephend, could you possibly get a stack?
Severity: major → critical
Keywords: crash, stackwanted
recursion city ;-) js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 1840] EmitElemOp [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 1714] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 3610] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 3345] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 3192] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 3159] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 1988] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 3159] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 2609] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 3159] js_EmitTree [d:\builds\seamonkey\mozilla\js\src\jsemit.c, line 1988] Statements [d:\builds\seamonkey\mozilla\js\src\jsparse.c, line 919] FunctionBody [d:\builds\seamonkey\mozilla\js\src\jsparse.c, line 558] js_CompileFunctionBody [d:\builds\seamonkey\mozilla\js\src\jsparse.c, line 603] JS_CompileUCFunctionForPrincipals [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3176] nsJSContext::CompileEventHandler [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 911] nsXBLPrototypeHandler::ExecuteHandler [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp, line 430] nsXBLFocusHandler::Focus [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLFocusHandler.cpp, line 104] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 1714] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3461] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442] nsXULElement::HandleChromeEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4690] GlobalWindowImpl::HandleDOMEvent [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 693] nsXULDocument::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 2449] nsEventStateManager::SendFocusBlur [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 3834] nsEventStateManager::SetContentState [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 3525] nsEventStateManager::TabIntoDocument [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 4708] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2854] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2976] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2947] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::TabIntoDocument [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 4710] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2854] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2976] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2947] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::TabIntoDocument [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 4710] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2854] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2976] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2947] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::TabIntoDocument [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 4710] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2854] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2976] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2947] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::TabIntoDocument [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 4710] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2854] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2976] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2947] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::TabIntoDocument [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 4710] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2854] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2976] nsEventStateManager::ShiftFocus [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2729] nsEventStateManager::ShiftFocusInternal [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2947]
Status: UNCONFIRMED → NEW
Ever confirmed: true
events
Assignee: hewitt → joki
Component: DOM Inspector → DOM Events
QA Contact: timeless → vladimire
*** Bug 159396 has been marked as a duplicate of this bug. ***
for those of you who like simple ways to crash: 1. prepare to crash (save work, don't have any mail state you don't want to lose) *2. load mail *3. if you don't see Account Central, then select a server (i.e. not a folder) 4. collapse the sidebar/folders bar 5. see 1 *6. press tab a few times (i think once is sufficient), then wait, it takes a long time to crash, you can tell it's busy because cpu usage maxes out and moving your mouse over the menubar, the links, and the component bar doesn't trigger mouse events. There are a bunch of signatures for this, and I sent in a bunch of stacks this past hour. I think i've sent this stack sporadically. Basically whenever I crash the first thing I do is run mail, and say aha, this is a web page, why don't i <tab> to get to the read messages <a href> link, heh it froze!, oh whoops. I don't have a good enough memory not to do this each time I run mozilla, this is partly because usually mozilla stays alive for a while, so I forget about this bug. And then when I do hit it, it amuses me :-(, so I do it a few more times. I'm going to mark this as topcrash. If someone objects, I'll spend the hour or two it takes to make it a topcrash. My view is that Account Central is one of our big selling points for the current mail interface, it's what you see when you start mail (it's what I see when I start mail after something else crashes), and it's supposed to look like a web page. While most people won't think to press tab, if we wanted them to click on a button, we wouldn't have needed account central, so it's a pretty reasonable first instinct, and so fatal... If account central is disabled, then I'll remove my topcrash nomination, but I can't imagine we'd do that :-) [Note: My folder list is on the right side, so it's a bit more natural for me to tab to read messages than it is for me to do something like click on the inbox. See <google:customizing unix> for the css] here's my mailnews version: MSVCRT.DLL + 0x13de (0x780013de) nsQueryInterface::operator() [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 52] nsCOMPtr_base::assign_from_helper [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 81] XPCWrappedNative::GetNewOrUsed [c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 213] XPCWrappedNative::GetNewOrUsed [c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 296] XPCConvert::NativeInterface2JSObject [c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcconvert.cpp, line 1061] XPCConvert::NativeData2JS [c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcconvert.cpp, line 462] XPCWrappedNative::CallMethod [c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2090] XPC_WN_GetterSetter [c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1299] js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 841] js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 932] js_GetProperty [c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2549] js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2640] js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 857] js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 932] JS_CallFunctionValue [c:/builds/seamonkey/mozilla/js/src/jsapi.c, line 3433] nsJSContext::CallEventHandler [c:/builds/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1044] nsJSEventListener::HandleEvent [c:/builds/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp, line 184] nsEventListenerManager::HandleEventSubType [c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line 1183] nsEventListenerManager::HandleEvent [c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line 2171] nsXULElement::HandleDOMEvent [c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3470] nsXULCommandDispatcher::UpdateCommands [c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULCommandDispatcher.cpp, line 391] GlobalWindowImpl::UpdateCommands [c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 3189] nsFocusController::UpdateCommands [c:/builds/seamonkey/mozilla/dom/src/base/nsFocusController.cpp, line 165] nsFocusController::Focus [c:/builds/seamonkey/mozilla/dom/src/base/nsFocusController.cpp, line 320] nsEventListenerManager::HandleEvent [c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line 1675] nsWindowRoot::HandleChromeEvent [c:/builds/seamonkey/mozilla/dom/src/base/nsWindowRoot.cpp, line 182] GlobalWindowImpl::HandleDOMEvent [c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 762] nsXULDocument::HandleDOMEvent [c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2599] nsXULElement::HandleDOMEvent [c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3458] nsXULElement::HandleDOMEvent [c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3451] nsXULElement::HandleDOMEvent [c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3451] nsXULElement::HandleDOMEvent [c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3451] nsXULElement::HandleDOMEvent [c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3451] nsXULElement::HandleChromeEvent [c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 4688] GlobalWindowImpl::HandleDOMEvent [c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 762] nsXULDocument::HandleDOMEvent [c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2599] nsEventStateManager::PreHandleEvent [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 508] PresShell::HandleEventInternal [c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6215] PresShell::HandleEvent [c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6143] nsViewManager::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2075] nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 301] nsViewManager::DispatchEvent [c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1932] HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 83] nsWindow::DispatchEvent [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1042] nsWindow::DispatchWindowEvent [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1059] nsWindow::DispatchFocus [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5415] nsWindow::ProcessMessage [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 4089] nsWindow::WindowProc [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1308] USER32.DLL + 0x3eb0 (0x77e13eb0) USER32.DLL + 0x591b (0x77e1591b) USER32.DLL + 0x595d (0x77e1595d) ntdll.dll + 0x1fb83 (0x77f9fb83) GlobalWindowImpl::Focus [c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 2406] nsEventStateManager::TabIntoDocument [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 5066] nsEventStateManager::ShiftFocusInternal [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 3101] nsEventStateManager::ShiftFocusInternal [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 3238] nsEventStateManager::ShiftFocus [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 2963] nsEventStateManager::ShiftFocusInternal [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 3209] nsEventStateManager::ShiftFocus [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 2963] nsEventStateManager::TabIntoDocument [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 5095] nsEventStateManager::ShiftFocusInternal [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 3101] nsEventStateManager::ShiftFocusInternal [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 3238] nsEventStateManager::ShiftFocus [c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 2963] Note that this stack will appear under various signatures.
Assignee: joki → bryner
Keywords: topcrash
Summary: Crash on selection of XBL Inspector from Inspect in New Window interface → Infinite recursion near nsEventStateManager::TabIntoDocument, (Inspector, Account Central)
Priority: -- → P1
Making topcrash- and marking worksforme. I can't reproduce with the steps to reproduce timeless mentioned and haven't seen any crashes like this in the latest Talkback data.
Status: NEW → RESOLVED
Closed: 23 years ago
Keywords: topcrashtopcrash-
Resolution: --- → WORKSFORME
I've just reproduced twice as per comment #1. Using Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.3b) Gecko/20030116. Can't reach talkback5.netscape.com currently. Will post TB-ID as soon as I can.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
From this morning's crashes: TB16615942W TB16615799E
aaron, do you know of any recent regressions involving infinite tabbing recursion?
What is the accessibility.tabfocus pref set to? That pref corresponds to this: enum nsTabFocusModel { //eTabFocus_textControlsMask = (1<<0), // unused - textboxes always tabbable eTabFocus_formElementsMask = (1<<1), // non-text form elements eTabFocus_linksMask = (1<<2), // links eTabFocus_any = 1 + (1<<1) + (1<<2), // everything that can be focused }; At minimum, textfields are always focusable. However, if that pref is set to 0 or 1, I could imagine an infinite recursion scenario if there are no textfields.
Blocks: focusnav
*** Bug 192601 has been marked as a duplicate of this bug. ***
still 100% reproducible for me using a new profile and Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.3b) Gecko/20030210 latest talkback: TB17070118Z
Marking topcrash+ since this crash is reproducible, has a testcase, and is showing up as other stack sig's which are in topcrash reports. Adding nsScriptSecurityManager::doGetObjectPrincipal to the subject line (since Bug 192601 was marked as a duplicate of this one) so this will show up on talkback reports as a bug for that stack sig.
Keywords: topcrash-topcrash+
Summary: Infinite recursion near nsEventStateManager::TabIntoDocument, (Inspector, Account Central) → Infinite recursion near nsEventStateManager::TabIntoDocument, (Inspector, Account Central) [@ nsScriptSecurityManager::doGetObjectPrincipal]
if this is like bug #195011, you might need to be using the classic skin to reproduce the problem. I think they are the same bug, so making this bug block bug #195011
Blocks: 195011
*** Bug 195011 has been marked as a duplicate of this bug. ***
yeah i usually use newclassic or classic, i never really spend enough time in modern. however i've just crashed mozilla using modern following the steps i listed in comment 6.
I'm keeping 195011 as a seperate bug, as it might be comment #11. in macprefs.js, we set that pref to 1 (but on windows, it is 7)
I'm able to reproduce this on win2k, using timeless's steps (with the folder pane and account central) aaronl suggests that we should treat the html content frame as always focusable, ignoring the accessibility.tabfocus pref, the same way that was done for textfields (in nsEventStateManager::GetNextTabbableContent())
the patch in #195011 fixes timeless's problem as well, but I'm not sure if it is the right patch or not yet.
the fix in bug #195011 will fix this.
Depends on: 195011
a couple of notes: -this bug occurs for me using the Pinball theme -the preconditions described by me in comment #1 are quite different from timeless' description in comment #6. must consider that this may be two distinct issues. please continue to followup and test against the original preconditions to ensure that the original bug is fixed.
that stack trace in #3 (from stephend) from your incident reports makes it look like the same issue as in #195011. I used timeless's steps to reproduce this on win32. marking fixed.
Status: REOPENED → RESOLVED
Closed: 23 years ago22 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsScriptSecurityManager::doGetObjectPrincipal]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: