187759 - opening menu with full-page (quicktime, flash) plugin crashes in [@ nsMenuBarFrame::SetActive ]

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Load http://mywebpages.comcast.net/lizandarnie/jp18.com_bath1.mpg (porn).
2. Click the file menu while or after the mpeg loads.
Result: crash.

Tested in Phoenix 01/03, Mozilla 01/03, and a debug build from a few hours ago
(evening of 01/04), all on Windows XP.  Probably a regression introduced by bug
132489, "caret should stop blinking when user enters menus".

Before the crash, I get two assertions:

###!!! ASSERTION: No selection controller for presShell: 'selCon', file c:/build
moz/mozilla/layout/xul/base/src/nsMenuBarFrame.cpp, line 238
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRa
wPtr != 0', file c:\buildmoz\mozilla\dist\include\xpcom\nsCOMPtr.h, line 650

The crash is at line 242 in nsmenubarframe.cpp:

      selCon->GetCaretEnabled(&isCaretVisible);

Stack trace:

>	gklayout.dll!nsMenuBarFrame::SetActive(int aActiveFlag=1)  Line 242 + 0x1f	C++
 	gklayout.dll!nsMenuFrame::OpenMenuInternal(int aActivateFlag=1)  Line 779	C++
 	gklayout.dll!nsMenuFrame::AttributeChanged(nsIPresContext *
aPresContext=0x01248e08, nsIContent * aChild=0x0318fd50, int aNameSpaceID=0,
nsIAtom * aAttribute=0x00ba9e98, int aModType=2, int aHint=94)  Line 690	C++
 	gklayout.dll!nsCSSFrameConstructor::AttributeChanged(nsIPresContext *
aPresContext=0x01248e08, nsIContent * aContent=0x0318fd50, int aNameSpaceID=0,
nsIAtom * aAttribute=0x00ba9e98, int aModType=2, nsChangeHint aHint=14)  Line
10736 + 0x24	C++
 	gkcontent.dll!StyleSetImpl::AttributeChanged(nsIPresContext *
aPresContext=0x01248e08, nsIContent * aContent=0x0318fd50, int aNameSpaceID=0,
nsIAtom * aAttribute=0x00ba9e98, int aModType=2, nsChangeHint
aHint=nsChangeHint_Unknown)  Line 1646	C++
 	gklayout.dll!PresShell::AttributeChanged(nsIDocument * aDocument=0x01154298,
nsIContent * aContent=0x0318fd50, int aNameSpaceID=0, nsIAtom *
aAttribute=0x00ba9e98, int aModType=2, nsChangeHint aHint=nsChangeHint_Unknown)
 Line 5226 + 0x3d	C++
 	gkcontent.dll!nsXULDocument::AttributeChanged(nsIContent *
aElement=0x0318fd50, int aNameSpaceID=0, nsIAtom * aAttribute=0x00ba9e98, int
aModType=2, nsChangeHint aHint=nsChangeHint_Unknown)  Line 2154	C++
 	gkcontent.dll!nsXULElement::SetAttr(nsINodeInfo * aNodeInfo=0x038db528, const
nsAString & aValue={...}, int aNotify=1)  Line 2640	C++
 	gkcontent.dll!nsXULElement::SetAttribute(const nsAString & aName={...}, const
nsAString & aValue={...})  Line 1307 + 0x1f	C++
 	gklayout.dll!nsMenuFrame::OpenMenu(int aActivateFlag=1)  Line 723 + 0x39	C++
 	gklayout.dll!nsMenuFrame::ToggleMenuState()  Line 542	C++
 	gklayout.dll!nsMenuFrame::HandleEvent(nsIPresContext *
aPresContext=0x01248e08, nsGUIEvent * aEvent=0x0012f768, nsEventStatus *
aEventStatus=0x0012f568)  Line 421	C++
 	gklayout.dll!PresShell::HandleEventInternal(nsEvent * aEvent=0x0012f768,
nsIView * aView=0x0124a858, unsigned int aFlags=1, nsEventStatus *
aStatus=0x0012f568)  Line 6186 + 0x26	C++
 	gklayout.dll!PresShell::HandleEvent(nsIView * aView=0x0124a858, nsGUIEvent *
aEvent=0x0012f768, nsEventStatus * aEventStatus=0x0012f568, int aForceHandle=1,
int & aHandled=1)  Line 6078 + 0x19	C++
 	gkview.dll!nsViewManager::HandleEvent(nsView * aView=0x0124a858, nsGUIEvent *
aEvent=0x0012f768, int aCaptured=0)  Line 2209	C++
 	gkview.dll!nsView::HandleEvent(nsViewManager * aVM=0x0124a640, nsGUIEvent *
aEvent=0x0012f768, int aCaptured=0)  Line 304	C++
 	gkview.dll!nsViewManager::DispatchEvent(nsGUIEvent * aEvent=0x0012f768,
nsEventStatus * aStatus=0x0012f668)  Line 1943 + 0x17	C++
 	gkview.dll!HandleEvent(nsGUIEvent * aEvent=0x0012f768)  Line 83	C++
 	gkwidget.dll!nsWindow::DispatchEvent(nsGUIEvent * event=0x0012f768,
nsEventStatus & aStatus=nsEventStatus_eIgnore)  Line 1116 + 0xa	C++
 	gkwidget.dll!nsWindow::DispatchWindowEvent(nsGUIEvent * event=0x0012f768) 
Line 1137	C++
 	gkwidget.dll!nsWindow::DispatchMouseEvent(unsigned int aEventType=302,
unsigned int wParam=1, nsPoint * aPoint=0x00000000)  Line 5376 + 0x15	C++
 	gkwidget.dll!ChildWindow::DispatchMouseEvent(unsigned int aEventType=302,
unsigned int wParam=1, nsPoint * aPoint=0x00000000)  Line 5633	C++
 	gkwidget.dll!nsWindow::ProcessMessage(unsigned int msg=513, unsigned int
wParam=1, long lParam=458770, long * aRetValue=0x0012fbf8)  Line 4082 + 0x1c	C++
 	gkwidget.dll!nsWindow::WindowProc(HWND__ * hWnd=0x001b0296, unsigned int
msg=513, unsigned int wParam=1, long lParam=458770)  Line 1403 + 0x1b	C++
 	user32.dll!77d67ad7() 	
 	user32.dll!77d6ccd4() 	
 	user32.dll!77d44455() 	
 	user32.dll!77d495d5() 	
 	appshell.dll!nsAppShellService::Run()  Line 472	C++
 	mozilla.exe!main1(int argc=1, char * * argv=0x002b72a0, nsISupports *
nativeApp=0x002b72e8)  Line 1543 + 0x20	C++
 	mozilla.exe!main(int argc=1, char * * argv=0x002b72a0)  Line 1904 + 0x25	C++
 	mozilla.exe!mainCRTStartup()  Line 400 + 0x11	C
 	kernel32.dll!77e814c7()

Comment 1

[Olivier Cahagne]

seems to be a new topcrasher according to:
http://ftp.mozilla.org/pub/data/crash-data/rankoutput.html

Comment 2

[Roy R. Campbell, Jr.]

Must be a regression, because I cannot reproduce the failure using Windows build
2003010108 running Windows XP Pro.

Comment 3

[Frederic Bezies]

WFM - 4 hours old CVS based build - WinXP-Sp1.

No crash while downloading, or after downloading file !

Comment 4

[kurros (Wade Majors)]

Reproducable with 2003010408 under WinXP/SP1 and Quicktime 6.0.2

Comment 5

[Olivier Cahagne]

same stack on Linux 20020105 (CVS), Flash 6.0r69.
OS -> All.

###!!! ASSERTION: No selection controller for presShell: 'selCon', file
nsMenuBarFrame.cpp, line 238
Break: at file nsMenuBarFrame.cpp, line 238
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().:
'mRawPtr != 0', file ../../../../dist/include/xpcom/nsCOMPtr.h, line 650
Break: at file ../../../../dist/include/xpcom/nsCOMPtr.h, line 650

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 25681)]
0x41bd9f05 in nsMenuBarFrame::SetActive (this=0x84824fc, aActiveFlag=1)
    at nsMenuBarFrame.cpp:242
242	      selCon->GetCaretEnabled(&isCaretVisible);

Easier testcase:
1. Load URL http://www.talonse.com/supergreg.swf ,
2. Click on Menu -> File,
3. Mozilla crashes.

Comment 6

[timeless]

Attachment: fullpage plugins don't have selection controllers...

Comment 7

[Aaron Leventhal]

Comment on attachment 110744 [details] [diff] [review]
fullpage plugins don't have selection controllers...

r=aaronl

Comment 8

[timeless]

checked in

Comment 9

[Olivier Cahagne]

tried 2003010808 on Linux, I don't crash anymore on URL from comment 5.

Comment 10

[timeless]

ok

Comment 11

[Michael Lefevre]

using 2003010808 on win2k, I also don't see this crash any more.

topcrash data also shows no crashes after 01-06.

Comment 12

[shrirang khanzode]

fixed 0109 trunk.