146610 - Dragging image to desktop can result in a crash

Status: VERIFIED DUPLICATE of bug 152580

(Camino Graveyard :: Drag & Drop, defect)

Description

[Chris Petersen]

Build: 0.2.7
Platform: OS X 10.1.4
Expected results: Link should be created on desktop
What I got: Attempting to dragging image onto the desktop, the application crashes

Steps to reproduce:

1) Open attached file
2) Click on image and drag outside of browser window to the desktop; then mouseup.
3) Application should crash*.
4) *Screen corruption can occur after dragging the image outside of the window.
Basically, border shape of the image will remain on screen.

Comment 1

[Chris Petersen]

Attachment: Sample image

Click and drag image outside of window and onto the desktop.

Comment 2

[Chris Petersen]

Stack trace from crash reporter:


Command:    Navigator
PID:        728

Exception:  EXC_BAD_INSTRUCTION (0x0002)
Code[0]:    0x00000002
Code[1]:    0x00040008

Thread 0 Crashed:
 #0   0x00040008 in __EXCEPTION_TABLE__
 #1   0x73d7f43c in SampleMouseAndKeyboard
 #2   0x73d7d1e0 in DragInApplication
 #3   0x73d71584 in DragLoop
 #4   0x73d7a278 in CoreDragStartDragging
 #5   0x732d3a08 in TrackDrag
 #6   0x025b2960 in nsDragService::InvokeDragSession(nsIDOMNode *,
nsISupportsArray *, nsIScriptableRegion *, unsigned int)
 #7   0x02ff0010 in nsContentAreaDragDrop::DragGesture(nsIDOMEvent *)
 #8   0x02df58b0 in nsEventListenerManager::HandleEvent(nsIPresContext *,
nsEvent *, nsIDOMEvent **, nsIDOMEventTarget *, unsigned int, nsEventStatus *)
 #9   0x0294d828 in nsWindowRoot::HandleChromeEvent(nsIPresContext *, nsEvent *,
nsIDOMEvent **, unsigned int, nsEventStatus *)
 #10  0x029322a0 in GlobalWindowImpl::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #11  0x02f7aebc in nsDocument::HandleDOMEvent(nsIPresContext *, nsEvent *,
nsIDOMEvent **, unsigned int, nsEventStatus *)
 #12  0x02fa5184 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #13  0x02fa5184 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #14  0x02fa5184 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #15  0x02fa5184 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #16  0x02e35cdc in nsHTMLImageElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #17  0x02dfa380 in nsEventStateManager::GenerateDragGesture(nsIPresContext *,
nsGUIEvent *)
 #18  0x02df7dbc in nsEventStateManager::PreHandleEvent(nsIPresContext *,
nsEvent *, nsIFrame *, nsEventStatus *, nsIView *)
 #19  0x03668068 in PresShell::HandleEventInternal(nsEvent *, nsIView *,
unsigned int, nsEventStatus *)
 #20  0x03667ec8 in PresShell::HandleEvent(nsIView *, nsGUIEvent *,
nsEventStatus *, int, int &)
 #21  0x0391156c in nsViewManager::HandleEvent(nsView *, nsGUIEvent *, int)
 #22  0x03910ac0 in nsViewManager::DispatchEvent(nsGUIEvent *, nsEventStatus *)
 #23  0x03903fb0 in HandleEvent(nsGUIEvent *)
 #24  0x025c79a0 in nsChildView::DispatchEvent(nsGUIEvent *, nsEventStatus &)
 #25  0x025c7a34 in nsChildView::DispatchWindowEvent(nsGUIEvent &)
 #26  0x025c7af4 in nsChildView::DispatchMouseEvent(nsMouseEvent &)
 #27  0x025c8ebc in -[ChildView mouseDragged:]
 #28  0x70c1bf60 in -[NSWindow sendEvent:]
 #29  0x70b9479c in -[NSApplication sendEvent:]
 #30  0x70c23488 in -[NSApplication run]
 #31  0x70c91ed0 in NSApplicationMain
 #32  0x0000214c in _start
 #33  0x00001f7c in start

Thread 1:
 #0   0x700252fc in select
 #1   0x0015b758 in poll
 #2   0x00157e70 in _pr_poll_with_poll
 #3   0x0204330c in nsSocketTransportService::Run(void)
 #4   0x0022f7e4 in nsThread::Main(void *)
 #5   0x0015932c in _pt_root
 #6   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00154418 in PR_WaitCondVar
 #3   0x0204d4a0 in nsDNSService::DequeuePendingQ(void)
 #4   0x0204cea8 in nsDNSService::Run(void)
 #5   0x0022f7e4 in nsThread::Main(void *)
 #6   0x0015932c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x001541b4 in pt_TimedWait
 #4   0x0015442c in PR_WaitCondVar
 #5   0x0023326c in TimerThread::Run(void)
 #6   0x0022f7e4 in nsThread::Main(void *)
 #7   0x0015932c in _pt_root
 #8   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00154418 in PR_WaitCondVar
 #3   0x00230904 in nsThreadPool::GetRequest(nsIThread *)
 #4   0x00231258 in nsThreadPoolRunnable::Run(void)
 #5   0x0022f7e4 in nsThread::Main(void *)
 #6   0x0015932c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7086c34c in -[NSConditionLock lockWhenCondition:]
 #3   0x70ba1358 in -[NSUIHeartBeat _heartBeatThread:]
 #4   0x70842358 in forkThreadForFunction
 #5   0x7002054c in _pthread_body

Thread 6:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body

PPC Thread State:
  srr0: 0x00040008 srr1: 0x0008f030                vrsave: 0x00000000
   xer: 0x00000018   lr: 0x73d7f43c  ctr: 0x00040000   mq: 0x00000000
    r0: 0x00040000   r1: 0xbfffe0c0   r2: 0x013af6c4   r3: 0xbfffe0f8
    r4: 0xbfffe100   r5: 0x00010002   r6: 0x746e6d62   r7: 0x00002703
    r8: 0xbfffe0a8   r9: 0xa4013de0  r10: 0x431d0000  r11: 0x83d70358
   r12: 0x00040000  r13: 0x00000000  r14: 0xbfffe3ec  r15: 0xbfffe3e8
   r16: 0xbfffe3f8  r17: 0xbfffe488  r18: 0xbfffe518  r19: 0x0305f034
   r20: 0xbfffe3f0  r21: 0xbfffe3f4  r22: 0xbfffe5ac  r23: 0xbfffe1c8
   r24: 0x00000000  r25: 0x03c2b558  r26: 0x00000001  r27: 0x0000a68f
   r28: 0x00000000  r29: 0x013af620  r30: 0x013af620  r31: 0x73d7f398

**********

Comment 3

[Chris Petersen]

Attachment: Sample of screen corruption after dragging image multiple times

Comment 4

[Nick Kocharhook]

*** Bug 146601 has been marked as a duplicate of this bug. ***

Comment 5

[Nick Kocharhook]

Just FYI, I see this too in Mozilla, but only when the image had been scrolled
mostly offscreen.

Details can be found in bug 146601.

052305 (rc3)

Comment 6

[saari (gone)]

->pinkerton

Comment 7

[Mike Pinkerton (not reading bugmail)]

odd that this happens only with images, given that the crash in in the OS
tracking the drag. i'll take a look.

Comment 8

[Chris Petersen]

Mike,

You're right. Dragging a selection (in general) can reproduce this problem. I
attached a simple test case with a heading, paragraph and link. Screen shot also
attached. 

Comment 9

[Chris Petersen]

Attachment: Simple test case

Comment 10

[Chris Petersen]

Attachment: Screen shot of text selection

Comment 11

[saari (gone)]

might want to test this again under 10.1.5 if we're dying in OS code

Comment 12

[Chris Petersen]

Problem is still reproducable under OS X 10.1.5 and NB 2002-06-10-05.

Comment 13

[Mike Pinkerton (not reading bugmail)]

*** This bug has been marked as a duplicate of 152580 ***

Comment 14

[Sören 'Chucker' Kuklau (gone)]

v dup

Comment 15

[sairuh (rarely reading bugmail)]

really verifying. :)