159434 - Trunk crash [@ nsGenericElement::TriggerLink]

Status: VERIFIED FIXED

(Core :: DOM: Events, defect)

Description

[Jay Patel [:jay]]

The following crash popped up in topcrash reports starting with MozillaTrunk
builds from 7/23.  Here's the latest from Talkback:

nsGenericElement::TriggerLink   37 
BBID range: 8624410 - 8652335
Min/Max Seconds since last crash: 24 - 29410
Min/Max Runtime: 28 - 37839
Crash data range: 2002-07-24 to 2002-07-24
Build ID range: 2002072321 to 2002072408
Keyword List : click(8), link(8), 
Stack Trace: 

	 nsGenericElement::TriggerLink
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericElement.cpp  line 2812]
	 nsGenericHTMLElement::HandleDOMEventForAnchors
[c:/builds/seamonkey/mozilla/content/html/content/src/nsGenericHTMLElement.cpp 
line 1483]
	 nsHTMLAreaElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/html/content/src/nsHTMLAreaElement.cpp 
line 233]
	 nsGenericDOMDataNode::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericDOMDataNode.cpp  line 903]
	 PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6192]
	 PresShell::HandleEventWithTarget
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6160]
	 nsEventStateManager::CheckForAndDispatchClick
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp  line 2757]
	 nsEventStateManager::PostHandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp  line 1761]
	 PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6213]
	 PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6115]
	 nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp  line 2105]
	 nsView::HandleEvent	[c:/builds/seamonkey/mozilla/view/src/nsView.cpp  line 306]
	 nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp  line 1916]
	 HandleEvent	[c:/builds/seamonkey/mozilla/view/src/nsView.cpp  line 83]
	 nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1038]
	 nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1055]
	 nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 5097]
	 ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 5352]
	 nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 3814]
	 nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1304]
	 USER32.dll + 0x3a5f (0x77d43a5f)
	 USER32.dll + 0x3b2e (0x77d43b2e)
	 USER32.dll + 0x3d6a (0x77d43d6a)
	 USER32.dll + 0x41fd (0x77d441fd)
	 nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp  line 452]
	 main1	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1534]
	 main	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1881]
	 WinMain	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1899]
	 WinMainCRTStartup()
	 kernel32.dll + 0x1eb69 (0x77e7eb69)
 
 	Source File :
c:/builds/seamonkey/mozilla/content/base/src/nsGenericElement.cpp line : 2812
     (8652052)	URL: www.google.com
     (8650070)	Comments: something crashed when I was watching a flash movie and
clicked a hyperlink
     (8647558)	Comments: clicked on a link to bugzilla from exchange based http
email
     (8643636)	URL: http://www.techimo.com
     (8643636)	Comments: 4 tabs open on same site  also custom sidebar open
     (8643196)	Comments: Frantically clicking on a link (local Webserver Apache
2/SSI/W2K) because I was bored.
     (8642682)	URL: http://www.davidpogue.com/
     (8642667)	URL: http://www.davidpogue.com/
     (8642464)	URL: http://www.raiderpower.com
     (8642464)	Comments: Clicking a link while the browser was trying to load
another link.
     (8641931)	URL: livejournal page with messy HTML and lots of tables...
     (8641931)	Comments: clicked "change log" link in a mozilla bonsai page
     (8641080)	URL: www.cellularsouth.com
     (8635804)	Comments: Clicked a link  changed my mind  clicked another (while
first was loading).  Immediate Crash.
     (8635660)	URL: http://www.therubberboy.com/ulthm1~2.htm
     (8635621)	URL: http://www.therubberboy.com/ulthm1~2.htm
     (8631614)	URL: mozdev.org
     (8631614)	Comments: After clicking 3 links fast the browser crashes.
     (8631525)	URL:
http://www.batworld.de/cgi-bin/batboard/ikonboard.cgi?s=3cfbf2e81ea5ffff;act=Post;CODE=02;f=9;t=597
     (8624410)	URL: battlegrounds.xiven.com
     (8624410)	Comments: clicking on links... And poof! It just went away...

I'll do some digging and see if a checkin on 7/23 might have introduced this. 
Please reassing if I chose the wrong component.  Thanks.

Comment 1

[Jay Patel [:jay]]

Adding crash, topcrash keywords and qawanted to see if anyone can reproduce
this.  From Talkback data, it looks like this is happening on both Windows and
Linux (mostly Win2k and WinXP).

Comment 2

[WD]

*** Bug 159436 has been marked as a duplicate of this bug. ***

Comment 3

[Jay Patel [:jay]]

cc'ing nhotta.  the source and line no. of this crash points to a checkin he
made on 7/23 to nsGenericElement.cpp  line 2812.  Here is the code around the crash:

2809 nhotta     3.232     if (NS_SUCCEEDED(rv)) {
2810                        nsAutoString docCharset;
2811                        if
(NS_SUCCEEDED(mDocument->GetDocumentCharacterSet(docCharset)))
2812                          rv = NS_NewURI(getter_AddRefs(absURI), absURLSpec,
NS_LossyConvertUCS2toASCII(docCharset).get(), aBaseURL);
2813                        else
2814                          rv = NS_NewURI(getter_AddRefs(absURI), absURLSpec,
nsnull, aBaseURL);
2815                      }

Although Talkback reports the line number as 2812, it is most likely crashing at
line 2811.  Naoki, any ideas on why we're crashing?  Adding zt4newcrash keyword.

Comment 4

[Jay Patel [:jay]]

Adding zt4newcrash keyword.  And for future reference, nhotta's checkin in
question was for a fix to bug 137182.

Comment 5

[Jay Patel [:jay]]

I have not been able to reproduce this one myself, but here are some steps from
duped bug 159436:

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1b) Gecko/20020724
BuildID:    2002072408

When I click on a link on this page and then immediately click on another one, I
get a crash.

Reproducible: Sometimes
Steps to Reproduce:
1.Go to http://www.vindicator.com/
2.Click on the "Classifieds" tab near the top
3.Watch the URLbar and as soon as it changes to http://classifieds.vindy.com/ ,
click the "Contact Us" tab

Actual Results:  Crash

Expected Results:  No Crash

You have to get the timing right, but once you get it, it can be reproduced.

TB8673178K
TB8673124X

Comment 6

[nhottanscp]

I can reproduce this. 'mDocument' can be null.
I will post a patch.

Comment 7

[nhottanscp]

Attachment: Adding null check for mDocument.

Comment 8

[nhottanscp]

caillon/jst, could you r/sr the patch?

Comment 9

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 92807 [details] [diff] [review]
Adding null check for mDocument.

r=caillon

Comment 10

[Johnny Stenback (:jst)]

Comment on attachment 92807 [details] [diff] [review]
Adding null check for mDocument.

sr=jst

Comment 11

[Jesse Ruderman]

With this patch, does a click on another link succeed or fail silently due to
the null check?  Did it succeed in a build from last week?

Comment 12

[Asa Dotzler [:asa]]

Comment on attachment 92807 [details] [diff] [review]
Adding null check for mDocument.

a=asa (on behalf of drivers) for checkin to 1.1

Comment 13

[Johnny Stenback (:jst)]

This patch only changes how we deal with charsets in links, it does not change
whether clicking on a link works or not.

Comment 14

[nhottanscp]

checked in to the trunk

Comment 15

[Andrew Schultz]

*** Bug 159851 has been marked as a duplicate of this bug. ***

Comment 16

[Frank Tang]

add m1.0.1 and topembed
hansoo request the one which cause this one to go into m1.0.1, if we take it for
m1.0.1, we need this fix too.

Comment 17

[Vladimir Ermakov]

 Verifying that it crashed on 07/24 build and doesnt crash anymore on build
2002-08-01-trunk on linux.