150761 - [viewpoint] Mouse scrollbutton crashes windowless plugins

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P2)

Description

[bmartin]

Testing w/N7PR1 20020512

System:
Win98SE/Win2k
PS/2 or USB mouse with scrollbutton

Steps:
1. Download latest Viewpoint plugin
2. Launch N7PR1
3. Load the Sony Vaio demo at http://cole.viewpoint.com/~compuserve
4. Move the scrollbutton while demo loads or after demo loads


Results:
Netscp.exe crashes

See talkback data:
http://climate.netscape.com/reports/SingleIncidentInfo.cfm?dynamicBBID=7208838

Comment 1

[Peter Lubczynski]

Stack points at |HandleEvent|:

ns4xPluginInstance::HandleEvent
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\ns4xPluginInstance.cpp,
line 1094]
nsPluginInstanceOwner::ProcessEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 3288]
nsPluginInstanceOwner::DispatchMouseToPlugin
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 3226]
nsPluginInstanceOwner::MouseUp
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 3186]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1333]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1665]
nsEventStateManager::DoWheelScroll
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1489]
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1806]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6126]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6028]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2076]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1887]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4137]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4113]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131]

Comment 2

[rubydoo123]

assigning to av

Comment 3

[av (gone)]

I could not find anything refferring to Sony Vaio on
http://cole.viewpoint.com/~compuserve page but was able to reproduce the crash
on CD ROM 3D demo (updating the URL field).

Although it does crash with the older versions, I could not reproduce it with
the current Mozilla trunk and branch, so looks like it got fixed along the way.
Marking WFM.

Comment 4

[Peter Lubczynski]

Reopening, I can reproduce 100% on today's build:
Gecko/20020618 Netscape/7.0 WinXP

I can not reproduce in debug builds (trunk or branch). Here are the steps:

1. Install Viewpoint
2. Visit http://cole.viewpoint.com/~compuserve
3. Size your window so you get scrollbars
4. Near the bottom, click on the Sony Vaio laptop demo
5. When the popup opens, scrolling causes the crash

Comment 5

[av (gone)]

Steps still do not work for me. Scrolls perfectly.

Comment 6

[bmartin]

updated summary

Comment 7

[Peter Lubczynski]

this bug is the same as: http://bugscape.netscape.com/show_bug.cgi?id=16870

nominating

Comment 8

[rubydoo123]

this one should have been nsbeta1+ already, adding ADT2

Comment 9

[av (gone)]

I found the problem. Mouse wheel event simply is not defined in nsGUIEvent.h
Patch is coming.

Comment 10

[av (gone)]

This is a generic problem. When mouse wheel event comes, content event manager
artificially generates mouse_out event before firing the wheel event. This is
performed with the purpose of removing possible tooltip when you start
scrolling. In creating the event structure, |nsGUIEvent::nativeMsg| remains
uninitialized which causes crash in the plugin code in release builds. The
simple fix would be just to add the initialization to that code.

Comment 11

[av (gone)]

Attachment: patch v.1

This one-liner is pretty straightforward. Please review.

Comment 12

[av (gone)]

Attachment: patch v.1.1

The same patch with more context for easier reading. Please review.

Comment 13

[Peter Lubczynski]

Comment on attachment 89019 [details] [diff] [review]
patch v.1.1

r=peterl

Comment 14

[Simon Fraser [no longer active]]

Comment on attachment 89019 [details] [diff] [review]
patch v.1.1

sr=sfraser

Comment 15

[av (gone)]

Fix is on the trunk. Nominating for the branch.

Comment 16

[Michael Dunn]

Shrirang, Please verify the fix as soon as you can to clear the way for ADT
approval.

Comment 17

[Syd Logan]

adt1.0.1+ added pending verification on the trunk. Please get mozilla approval,
and verify on the trunk, before landing. If neither of these happens before
7/2/2002, please come to adt and discuss.

Comment 18

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 19

[Peter Lubczynski]

*** Bug 154936 has been marked as a duplicate of this bug. ***

Comment 20

[shrirang khanzode]

verified on trunk 070108 , this works great now. other mouse events work fine 
too...nothing has regressed.

Comment 21

[av (gone)]

Thanks for fast verification, Shrir. In the branch now.

Comment 22

[shrirang khanzode]

verified on 0723 branch , no crash.