193613 - Crashes when closing subwindow [@ nsEventStateManager::DispatchMouseEvent ]

Status: RESOLVED DUPLICATE of bug 186132

(Core :: DOM: Events, defect)

Description

[Rob]

User-Agent:       Mozilla/5.0 (OS/2; U; Warp 4; en-US; rv:1.3b) Gecko/20030211
Build Identifier: Mozilla/5.0 (OS/2; U; Warp 4; en-US; rv:1.3b) Gecko/20030211

In the URL listed above, you click on a thumbnail and a larger version of the
image is displayed. Closing the window that the larger image is displayed in
causes Mozilla to crash every time. This didn't happen with 1.3a.

02-16-2003  18:16:04  SYS3175  PID 002d  TID 0001  Slot 0054
E:\MOZILLA.13B\MOZILLA.EXE
c0000005
1dc86fcc
P1=00000001  P2=00000000  P3=XXXXXXXX  P4=XXXXXXXX  
EAX=00000000  EBX=00000000  ECX=0014117c  EDX=0138d920
ESI=0138d920  EDI=00141178  
DS=0053  DSACC=f0f3  DSLIM=ffffffff  
ES=0053  ESACC=f0f3  ESLIM=ffffffff  
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:1dc86fcc  CSACC=f0df  CSLIM=ffffffff
SS:ESP=0053:00141168  SSACC=f0f3  SSLIM=ffffffff
EBP=00eb3010  FLG=00012246

GKLAYOUT.DLL 0001:00186fcc


Reproducible: Always

Steps to Reproduce:
1. Go to above mentioned URL
2. Click on a thumbnail to view larger image.
3. Close window that has larger image displayed.
4. System crash.

Actual Results:  

02-16-2003  18:16:04  SYS3175  PID 002d  TID 0001  Slot 0054
E:\MOZILLA.13B\MOZILLA.EXE
c0000005
1dc86fcc
P1=00000001  P2=00000000  P3=XXXXXXXX  P4=XXXXXXXX  
EAX=00000000  EBX=00000000  ECX=0014117c  EDX=0138d920
ESI=0138d920  EDI=00141178  
DS=0053  DSACC=f0f3  DSLIM=ffffffff  
ES=0053  ESACC=f0f3  ESLIM=ffffffff  
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:1dc86fcc  CSACC=f0df  CSLIM=ffffffff
SS:ESP=0053:00141168  SSACC=f0f3  SSLIM=ffffffff
EBP=00eb3010  FLG=00012246

GKLAYOUT.DLL 0001:00186fcc


Expected Results:  
Window with larger image should have closed.

gklayout.dll

This problem did not exist in Moz 1.3a (and earlier versions).

Comment 1

[Oliver Klee]

Over to Layout.

Comment 2

[Olivier Cahagne]

confirming using build 2003021508 on Win2k. Generated a Talkback ID but couldn't
connect to the Talkback servers for now.

Comment 3

[Rob]

Sorry. I forgot mention the URL in my description.

http://www.norlink.net/~rchand/photo/iceraces.htm

Thanks
Rob

Comment 4

[Olivier Cahagne]

also crashing on Linux with a debug build (CVS from feb. 4th):

###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().:
'mRawPtr != 0', file ../../../../dist/include/xpcom/nsCOMPtr.h, line 650
Break: at file ../../../../dist/include/xpcom/nsCOMPtr.h, line 650

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 1352)]
0x40ecccbd in nsEventStateManager::DispatchMouseEvent (this=0x8953198,
    aPresContext=0x89504b0, aEvent=0xbfffece0, aMessage=332,
    aTargetContent=0x898cc50, aTargetFrame=0x898bd44,
    aRelatedContent=0x893eae0) at nsEventStateManager.cpp:2438
2438          shell->GetPrimaryFrameFor(aTargetContent, &targetFrame);

should be fixed with bug 186132. However, this is an easy URL to reproduce
crash.

*** This bug has been marked as a duplicate of 186132 ***

*** This bug has been marked as a duplicate of 186132 ***

Comment 5

[Zibi Braniecki [:zbraniecki][:gandalf]]

*** Bug 201406 has been marked as a duplicate of this bug. ***