151568 - Crashes loading page/clicking link Trunk [@ nsGenericHTMLElement::HandleDOMEventForAnchors]

Status: VERIFIED FIXED

(Core :: DOM: Events, defect)

Description

[Shiva Thirumazhusai]

There is atleast 55 crashes in the nightly build in last one day's build. This
crash was not visible before today.

BBID range: 7267006 - 7294778
Min/Max Seconds since last crash: 14 - 50672
Min/Max Runtime: 106 - 50672
Crash data range: 2002-06-12 to 2002-06-12
Build ID range: 2002061204 to 2002061208

Stack Trace:
nsGenericHTMLElement::HandleDOMEventForAnchors [nsGenericHTMLElement.cpp line 1448]
nsHTMLLinkElement::HandleDOMEvent [nsHTMLLinkElement.cpp line 364]
nsGenericDOMDataNode::HandleDOMEvent [nsGenericDOMDataNode.cpp line 903]
PresShell::HandleEventInternal [nsPresShell.cpp line 6170]
PresShell::HandleEvent [nsPresShell.cpp line 6088]
nsViewManager::HandleEvent [nsViewManager.cpp line 2085]
nsView::HandleEvent [nsView.cpp line 306]
nsViewManager::DispatchEvent [nsViewManager.cpp line 1896]
HandleEvent [nsView.cpp line 83]
nsWindow::DispatchEvent [nsWindow.cpp line 1031]
nsWindow::DispatchWindowEvent [nsWindow.cpp line 1048]
nsWindow::DispatchMouseEvent [nsWindow.cpp line 4912]
ChildWindow::DispatchMouseEvent [nsWindow.cpp line 5167]
nsWindow::ProcessMessage [nsWindow.cpp line 3756]
nsWindow::WindowProc [nsWindow.cpp line 1293]
USER32.dll + 0x124c (0x77e7124c)
0x01940095

Source File : nsGenericHTMLElement.cpp line : 1448

7294778 OS: Windows NT 4.0 build 1381    Comments: mozillazine.org forum build
barreload current pageand click on a tread
7290843 OS: Windows 98 4.90 build 73010104
7290122 OS: Windows 98 4.10 build 67766446    Comments: Switching tabs between
concretefield.com message board and nwn.bioware.com board    URL:
http://www.concretefield.com
7288956 OS: Windows 98 4.10 build 67766446    URL: my.monster.com    
7283990 OS: Windows NT 5.0 build 2195    Comments: clicked a link then changed
my mind and tried clicking another one...    
7283981 OS: Windows NT 5.0 build 2195    Comments: I clicked on a bug link
clicked on a different link that was still visible before the previous link had
time to load.    URL: bugzilla.mozilla.org    
7281342 OS: Linux 2.4.19-pre8    Comments: a click on a link reffering to a
standart html-page    
7280660 OS: Windows 98 4.10 build 67766222
7280375 OS: Windows NT 5.1 build 2600    URL: www.wallashops.co.il
7277539 OS: Linux 2.4.19-pre10

Comment 1

[Shiva Thirumazhusai]

Attachment: Parameter and Local Variables in the crash area

It is possible that globalObj came out null. Can you add null pointer check
there ?

1444		 // nothing else.
1445		 nsCOMPtr<nsIFocusController> focusController;
1446		 nsCOMPtr<nsIScriptGlobalObject> globalObj;
>>>1447 	   
mDocument->GetScriptGlobalObject(getter_AddRefs(globalObj));
>>>1448 	    nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(globalObj));
1449		 win->GetRootFocusController(getter_AddRefs(focusController));
1450		 PRBool isActive = PR_FALSE;
1451		 focusController->GetActive(&isActive);

Comment 2

[Matthias Versen [:Matti]]

*** Bug 151580 has been marked as a duplicate of this bug. ***

Comment 3

[hhwong]

*** Bug 151922 has been marked as a duplicate of this bug. ***

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

->bryner, who presumably caused this with his patch:

----------------------------
revision 1.363
date: 2002/06/12 05:00:31;  author: bryner%netscape.com;  state: Exp;  lines: +18 -0
Fix the situation where clicking a link that has a mousedown handler which opens
a window would erroneously send a blur to the newly-opened window (bug 131651).
 r=saari, sr=hewitt.
----------------------------

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The disassembly and registers in the talkback report (and the knowledge that
Windows talkback shows line-after) show that the crash is because mDocument is
null.  This is true after we do a |SetScriptGlobalObject(nsnull)| to turn off
scripts from DocumentViewerImpl::Close, which marks the beginning of the paint
suppression period.

Comment 6

[Brian Ryner (not reading)]

Attachment: null-check patch

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 87812 [details] [diff] [review]
null-check patch

r=dbaron

Comment 8

[Blake Ross]

Comment on attachment 87812 [details] [diff] [review]
null-check patch

sr=blake

Comment 9

[Brian Ryner (not reading)]

Checked in.

Comment 10

[Matthias Versen [:Matti]]

*** Bug 152098 has been marked as a duplicate of this bug. ***

Comment 11

[Boris Zbarsky [:bzbarsky]]

*** Bug 151466 has been marked as a duplicate of this bug. ***

Comment 12

[Jay Patel [:jay]]

v.fixed per Talkback data.  No crashes since 6/15.