151950 - Crash when click and dragging an image [@ GetPixBounds]

Status: VERIFIED DUPLICATE of bug 152580

Description

[Neil Lee [:neilio]]

Here's another "suddenly quit" for you - I clicked and dragged on an image and
it died...

Date/Time:  2002-06-14 20:21:01 -0500
OS Version: 10.1.5 (Build 5S60)
Host:       thenew.ca

Command:    Navigator
PID:        830

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x357b0000

Thread 0 Crashed:
 #0   0x73552b90 in GetPixBounds
 #1   0x732c3f24 in SynchPattern
 #2   0x73276708 in HideDragHilite
 #3   0x00407f3c in nsDragHelperService::Leave(OpaqueDragRef *, nsIEventSink *)
 #4   0x000116f8 in -[CHBrowserView draggingExited:]
 #5   0x70db5478 in NSCoreDragReceiveProc
 #6   0x73d73f64 in DoDropMessage
 #7   0x73d7e890 in MessageHandler
 #8   0x701a4880 in __CFMessagePortPerform
 #9   0x7018f39c in __CFRunLoopDoSource1
 #10  0x7017c1cc in __CFRunLoopRun
 #11  0x701b70ec in CFRunLoopRunSpecific
 #12  0x7017b8cc in CFRunLoopRunInMode
 #13  0x701a4534 in CFMessagePortSendRequest
 #14  0x73d7f7b4 in SendDragIPCMessage
 #15  0x73d7f934 in SendDropMessage
 #16  0x73d7d31c in DragInApplication
 #17  0x73d715f4 in DragLoop
 #18  0x73d7a278 in CoreDragStartDragging
 #19  0x732d3a08 in TrackDrag
 #20  0x00402650 in nsDragService::InvokeDragSession(nsIDOMNode *,
nsISupportsArray *, nsIScriptableRegion *, unsigned int)
 #21  0x002d48d0 in nsContentAreaDragDrop::DragGesture(nsIDOMEvent *)
 #22  0x002079dc in nsEventListenerManager::HandleEvent(nsIPresContext *,
nsEvent *, nsIDOMEvent **, nsIDOMEventTarget *, unsigned int, nsEventStatus *)
 #23  0x0046597c in nsWindowRoot::HandleChromeEvent(nsIPresContext *, nsEvent *,
nsIDOMEvent **, unsigned int, nsEventStatus *)
 #24  0x00077088 in GlobalWindowImpl::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #25  0x001de9c0 in nsDocument::HandleDOMEvent(nsIPresContext *, nsEvent *,
nsIDOMEvent **, unsigned int, nsEventStatus *)
 #26  0x0029f410 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #27  0x0029f410 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #28  0x0029f410 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #29  0x0029f410 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #30  0x0029f410 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #31  0x0029f410 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #32  0x0029f410 in nsGenericElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #33  0x0023e04c in nsHTMLImageElement::HandleDOMEvent(nsIPresContext *, nsEvent
*, nsIDOMEvent **, unsigned int, nsEventStatus *)
 #34  0x0020c4c0 in nsEventStateManager::GenerateDragGesture(nsIPresContext *,
nsGUIEvent *)
 #35  0x00209ee8 in nsEventStateManager::PreHandleEvent(nsIPresContext *,
nsEvent *, nsIFrame *, nsEventStatus *, nsIView *)
 #36  0x003328a0 in PresShell::HandleEventInternal(nsEvent *, nsIView *,
unsigned int, nsEventStatus *)
 #37  0x00332764 in PresShell::HandleEvent(nsIView *, nsGUIEvent *,
nsEventStatus *, int, int &)
 #38  0x003e7848 in nsViewManager::HandleEvent(nsView *, nsGUIEvent *, int)
 #39  0x003e6d9c in nsViewManager::DispatchEvent(nsGUIEvent *, nsEventStatus *)
 #40  0x003f11d0 in HandleEvent(nsGUIEvent *)
 #41  0x003f5cd4 in nsChildView::DispatchEvent(nsGUIEvent *, nsEventStatus &)
 #42  0x003f5d68 in nsChildView::DispatchWindowEvent(nsGUIEvent &)
 #43  0x003f5e28 in nsChildView::DispatchMouseEvent(nsMouseEvent &)
 #44  0x003f71f0 in -[ChildView mouseDragged:]
 #45  0x70c1bf60 in -[NSWindow sendEvent:]
 #46  0x70b9479c in -[NSApplication sendEvent:]
 #47  0x70c23488 in -[NSApplication run]
 #48  0x70c91ed0 in NSApplicationMain
 #49  0x00002730 in _start
 #50  0x00002560 in start

Thread 1:
 #0   0x700252fc in select
 #1   0x00dbe758 in poll
 #2   0x00dbae70 in _pr_poll_with_poll
 #3   0x00151b3c in nsSocketTransportService::Run(void)
 #4   0x00e92874 in nsThread::Main(void *)
 #5   0x00dbc32c in _pt_root
 #6   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00db7418 in PR_WaitCondVar
 #3   0x00132ccc in nsDNSService::DequeuePendingQ(void)
 #4   0x001326d4 in nsDNSService::Run(void)
 #5   0x00e92874 in nsThread::Main(void *)
 #6   0x00dbc32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x00db71b4 in pt_TimedWait
 #4   0x00db742c in PR_WaitCondVar
 #5   0x00e962d4 in TimerThread::Run(void)
 #6   0x00e92874 in nsThread::Main(void *)
 #7   0x00dbc32c in _pt_root
 #8   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00db7418 in PR_WaitCondVar
 #3   0x00e93994 in nsThreadPool::GetRequest(nsIThread *)
 #4   0x00e942e8 in nsThreadPoolRunnable::Run(void)
 #5   0x00e92874 in nsThread::Main(void *)
 #6   0x00dbc32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7086c34c in -[NSConditionLock lockWhenCondition:]
 #3   0x70ba1358 in -[NSUIHeartBeat _heartBeatThread:]
 #4   0x70842358 in forkThreadForFunction
 #5   0x7002054c in _pthread_body

Thread 6:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x7017bf84 in __CFRunLoopRun
 #3   0x701b70ec in CFRunLoopRunSpecific
 #4   0x7017b8cc in CFRunLoopRunInMode
 #5   0x7061be08 in
XIOAudioDeviceManager::NotificationThread(XIOAudioDeviceManager *)
 #6   0x706141c0 in CAPThread::Entry(CAPThread *)
 #7   0x7002054c in _pthread_body

Thread 7:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body

PPC Thread State:
  srr0: 0x73552b90 srr1: 0x0200f030                vrsave: 0x00000000
   xer: 0x0000000c   lr: 0x732c3f24  ctr: 0x73552b90   mq: 0x00000000
    r0: 0x732c3f24   r1: 0xbfffd0c0   r2: 0xbfffcfa0   r3: 0x357b0000
    r4: 0xbfffd0f8   r5: 0xbfffd0a8   r6: 0x00000001   r7: 0x00000000
    r8: 0x00000000   r9: 0x80240e10  r10: 0xa10e7ae8  r11: 0x83101c50
   r12: 0x73552b90  r13: 0x00000000  r14: 0x00000000  r15: 0x00000000
   r16: 0x00000001  r17: 0x00000001  r18: 0x00000000  r19: 0x00008a13
   r20: 0xbfffd618  r21: 0xa10e7ae8  r22: 0x00000000  r23: 0x00000000
   r24: 0xa10e7ae8  r25: 0x03557718  r26: 0xbfffd1a8  r27: 0x04355cb0
   r28: 0x00000000  r29: 0x03e6b5b0  r30: 0x03c0b9f0  r31: 0x00407e40

**********

Comment 1

[Greg K.]

Neil, was this a one-time crash, or can you reproduce it?

Comment 2

[Neil Lee [:neilio]]

I've had it happen a few times; it was worse with earlier nightlies but the last
few have been much, much stabler. It doesn't crash all the time - it's very
sporadic. I know this is really vague... should I only be posting reports for
reproducible crashes or bugs?

Comment 3

[saari (gone)]

hmm, not quite the same stack as the other drag and drop crashes, but maybe a
similar issue with pix bounds?

->pinkerton

Comment 4

[Winnie Lam]

Reporter, could you please provide the steps that you took before this crash
happened?  

Reports of both reproducible and non-reproducible crashes are great, but we need
to know what pages/steps you went to before the crash happened so we can try to
reproduce it or narrow down the problem.

Comment 5

[Mike Pinkerton (not reading bugmail)]

*** This bug has been marked as a duplicate of 152580 ***

Comment 6

[sairuh (rarely reading bugmail)]

v