170249 - tree autoscroll triggers incorrectly and crashes [@ nsTreeBodyFrame::CanAutoScroll] Trunk, M1.2a

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

1. Open the History sidebar.
2. Drag the proxy icon straight down over the history tree, past the bottom of 
the history tree, and then drag it into the content area.
3. Cancel the drag or just drop [?].

Result: The history window starts scrolling down and doesn't stop.

4. Switch to the bookmarks sidebar.

Two things can happen at this point.

Result 1: All Mozilla networking activity hangs, but Mozilla remains responsive 
to my input.  mozilla.exe does not terminate after I close the browser window.  
My profile becomes locked until I kill mozilla.exe (or restart Windows XP, I 
guess).

Result 2 (more common): Mozilla crashes in nsTreeBodyFrame::CanAutoScroll while 
or after the bookmarks sidebar panel is displayed.

>	gklayout.dll!nsTreeBodyFrame::CanAutoScroll(int aRowIndex=-572662307)  
Line 3597 + 0x19	C++
 	gklayout.dll!nsTreeBodyFrame::ScrollCallback(nsITimer * 
aTimer=0x04f3bb40, void * aClosure=0x04b87c90)  Line 3717 + 0x12	C++
 	xpcom.dll!nsTimerImpl::Fire()  Line 367 + 0x11	C++
 	xpcom.dll!nsTimerManager::FireNextIdleTimer()  Line 591	C++
 	gkwidget.dll!nsAppShell::Run()  Line 156	C++
 	appshell.dll!nsAppShellService::Run()  Line 472	C++
 	mozilla.exe!main1(int argc=1, char * * argv=0x002a7250, nsISupports * 
nativeApp=0x00000000)  Line 1508 + 0x20	C++
 	mozilla.exe!main(int argc=1, char * * argv=0x002a7250)  Line 1868 + 0x25
	C++
 	mozilla.exe!mainCRTStartup()  Line 400 + 0x11	C
 	kernel32.dll!77e814c7()

Comment 1

[Kyle Yuan]

*** Bug 170549 has been marked as a duplicate of this bug. ***

Comment 2

[Kyle Yuan]

CCing me and jan

Comment 3

[greer]

Updating the summary with the info from 170549 and cc'ng talkback.
With steps to reproduce -> topcrash+

Comment 4

[Kyle Yuan]

This would be a windows only bug, I can't reproduce it on *nix platforms. I 
found there is no drag_exit event fired when I moved mouse out of the tree.

Comment 5

[Jay Patel [:jay]]

I was able to reproduce this with today's build.  Here are my steps:
1. open bookmarks in sidebar
2. drag any bookmark down and past the bookmark tree to start the autoscroll and
then into the content window.
3. switch to a different tab in the sidebar...boom!

Here is my incident:
Incident ID 12886355
Stack Signature nsTreeBodyFrame::CanAutoScroll 569c84a3
Email Address jpatel
Product ID MozillaTrunk
Build ID 2002102108
Trigger Time 2002-10-21 15:31:23
Platform Win32
Operating System Windows NT 5.0 build 2195
Module gklayout.dll
URL visited
User Comments
Trigger Reason Access violation
Source File Name
d:/builds/seamonkey/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
Trigger Line No. 3609
Stack Trace
nsTreeBodyFrame::CanAutoScroll
[d:/builds/seamonkey/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp,
line 3609]
nsTreeBodyFrame::ScrollCallback
[d:/builds/seamonkey/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp,
line 3728]
nsTimerImpl::Fire [d:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 376]
handleTimerEvent [d:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 425]
PL_GetEventOwner [d:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line 632]
PL_ProcessPendingEvents [d:/builds/seamonkey/mozilla/xpcom/threads/plevent.c,
line 570]
_md_EventReceiverProc [d:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line
1334]
nsAppShellService::Run
[d:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 472]
main1 [d:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1538]
main [d:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1886]
WinMain [d:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1906]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 6

[Frank Wein [:mcsmurf]]

From the duped bug (that was mine) another way to reproduce:
Steps to Reproduce:
1. Open the bookmark manager (either with a long list of bookmarks or resize the
manager to a small vertical size, so that you need some vertical scrollbar)
2. Drag some bookmark entry and get it to the buttom of the bookmark manager
(not over the statusbar, somewhat above so the content scrolls down)
3. Drop the bookmark entry while its scrolling down (the icon of the mouse
pointer should be now a stop-sign)

Comment 7

[Frank Wein [:mcsmurf]]

*** Bug 177751 has been marked as a duplicate of this bug. ***

Comment 8

[Asa Dotzler [:asa]]

Joe, this is a trunk topcrash+, the top of the topcrash list. Can you take a
look at this and give us a status. We should fix this befor 1.2 ships (real soon
now).

Comment 9

[Jan Varga [:janv]]

Attachment: possible fix

Comment 10

[Jan Varga [:janv]]

that patch should fix it

Comment 11

[Jan Varga [:janv]]

taking

Comment 12

[Frank Wein [:mcsmurf]]

r=mcsmurf, looks ok

Comment 13

[Frank Wein [:mcsmurf]]

.

Comment 14

[Pierre Chanial]

*** Bug 177376 has been marked as a duplicate of this bug. ***

Comment 15

[Peter Van der Beken [:peterv]]

Comment on attachment 104935 [details] [diff] [review]
possible fix

sr=peterv

Comment 16

[Christopher Blizzard (:blizzard)]

Comment on attachment 104935 [details] [diff] [review]
possible fix

a=blizzard on behalf of drivers for 1.2 final.

Please try to get this in before the tree closure on the morning of Nov 5th,
2002 or else you're going to have to wait until we are finished making the
branch.

Comment 17

[Jan Varga [:janv]]

checked in

Comment 18

[Jan Varga [:janv]]

The patch I checked in fixes the crasher, but
other issues are much more related to a problem where drag exit event is not
called on windows bug 150348 and bug 125301

Comment 19

[Greg K.]

Appears to work with Win FF 1.5. Marking VERIFIED.