17575 - [DOGFOOD] crash trying to drag bookmark

Status: VERIFIED WORKSFORME

(Core :: XUL, defect, P2)

Description

[Warren Harris]

I tried to drag a bookmark while in the sidebar and crashed with the following
stack. Unfortunately I can't get any more detail because crashing here seems to
hork my ability to select things in the debugger (like stack frames).

nsEventStateManager::GenerateDragGesture(nsIPresContext & {...}, nsGUIEvent *
0x0012fbe8) line 337 + 39 bytes
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x027b5540,
nsIPresContext & {...}, nsGUIEvent * 0x0012fbe8, nsIFrame * 0x027e4b20,
nsEventStatus & nsEventStatus_eIgnore, nsIView * 0x026b3980) line 164
PresShell::HandleEvent(PresShell * const 0x026b35a4, nsIView * 0x026b3980,
nsGUIEvent * 0x0012fbe8, nsEventStatus & nsEventStatus_eIgnore) line 2188 + 43
bytes
nsView::HandleEvent(nsView * const 0x026b3980, nsGUIEvent * 0x0012fbe8, unsigned
int 0x0000001c, nsEventStatus & nsEventStatus_eIgnore, int & 0x00000000) line
834
nsViewManager::DispatchEvent(nsViewManager * const 0x026b3e80, nsGUIEvent *
0x0012fbe8, nsEventStatus & nsEventStatus_eIgnore) line 1739
HandleEvent(nsGUIEvent * 0x0012fbe8) line 63
nsWindow::DispatchEvent(nsWindow * const 0x026b3844, nsGUIEvent * 0x0012fbe8,
nsEventStatus & nsEventStatus_eIgnore) line 401 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbe8) line 422
nsWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000
{x=??? y=???}) line 3394 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000
{x=??? y=???}) line 3612
nsWindow::ProcessMessage(unsigned int 0x00000200, unsigned int 0x00000001, long
0x01a20015, long * 0x0012fdf0) line 2617 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x006d0b76, unsigned int 0x00000200, unsigned int
0x00000001, long 0x01a20015) line 579 + 27 bytes
USER32! 77e71820()
01a20015()

335:        // dispatch to the DOM
336:        nsCOMPtr<nsIContent> lastContent;
0178CE95   lea         ecx,[lastContent]
0178CE98   call        nsCOMPtr<nsIContent>::nsCOMPtr<nsIContent> (01655800)
337:        mGestureDownFrame->GetContent(getter_AddRefs(lastContent));
0178CE9D   lea         edx,[lastContent]
0178CEA0   push        edx
0178CEA1   lea         eax,[ebp-5Ch]
0178CEA4   push        eax
0178CEA5   call        getter_AddRefs (01655c80)
0178CEAA   add         esp,8
0178CEAD   mov         ecx,eax
0178CEAF   call        nsGetterAddRefs<nsIContent>::operator nsIContent * *
(0165b4b0)
0178CEB4   push        eax
0178CEB5   mov         ecx,dword ptr [this]
0178CEB8   mov         edx,dword ptr [ecx+24h]
0178CEBB   mov         eax,dword ptr [this]
0178CEBE   mov         ecx,dword ptr [eax+24h]
0178CEC1   mov         eax,dword ptr [ecx]
0178CEC3   push        edx
==>  0178CEC4   call        dword ptr [eax+28h]
338:        if ( lastContent )
0178CEC7   lea         ecx,[lastContent]
0178CECA   call        nsCOMPtr<nsIContent>::operator nsDerivedSafe<nsIContent>
* (01655930)
0178CECF   test        eax,eax
0178CED1   je          nsEventStateManager::GenerateDragGesture+17Dh (0178cefd)
339:          lastContent->HandleDOMEvent(aPresContext, &event, nsnull,
NS_EVENT_FLAG_INIT, status);
0178CED3   lea         ecx,[status]
0178CED6   push        ecx
0178CED7   push        1
0178CED9   push        0

This assembly is from the top-most stack frame (where it crashed). Looking at
it, it looks like the virtual dispatch is failing for some reason. EAX has the
value 0x82 which isn't a valid vtable pointer.

Comment 1

[leger]

D&D is not part of dogfood or M11.  Putting on PDT- radar.

Comment 2

[Peter Trudelle]

assigning to pinkerton as p2 for m12

Comment 3

[Mike Pinkerton (not reading bugmail)]

i couldn't duplicate this with a build from the evening of 11/1 on winNT. please
reopen if it's still happening for you.

Comment 4

[Claudius Gayle]

I can't repro either. Warren, if you can repro this bug please list some steps and reopen.
Marking VERIFIED WFM.