204781 - crash dragging bookmark groups to and from personal toolbar - Trunk M140B [@ nsEventStateManager::GenerateMouseEnterExit]

Status: VERIFIED FIXED

(Core :: DOM: Events, defect)

Description

[Sander]

MightyMu discovered this. Present in at least 2003050608 and 2003050712 - win98
Steps to reproduce with a clean profile: 
open a number of tabs, file a bookmarks group, try to drag it from the bookmarks
folder onto the personal toolbar -> crash in gklayout.dll

MightyMu's talkback ID for this is TB19878717Y

Comment 1

[Sander]

This regressed between 2003050211 and 2003050608; wish I could narrow it down
further, but there are hardly any win32 builds after that first date, and those
I tried (svg builds) are exhibiting all sorts of problems with installing right
now, and I really need sleep. :)
Bryner: caillon suspects this was you.

Comment 2

[Chris Petersen]

Confirming this problem on the win32 (2003-05-06-10) nightly build.

Comment 3

[sairuh (rarely reading bugmail)]

does this occur on other platforms?

here's the talkback report.

Incident ID 19878717
Stack Signature 	nsEventStateManager::GenerateMouseEnterExit d3c2f34e
Product ID 	MozillaTrunk
Build ID 	2003050712
Trigger Time 	2003-05-07 14:08:22
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	gklayout.dll
URL visited 	
User Comments 	dragging a tab group from the Bookmarks menu to my personal
toolbar. Clean profile.
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp
Trigger Line No. 	2644
Stack Trace 	
nsEventStateManager::GenerateMouseEnterExit
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 2644]
nsEventStateManager::PreHandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 398]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6377]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6326]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2292]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 308]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2028]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 82]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1058]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1075]
nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5198]
ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5453]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3976]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1349]
USER32.dll + 0x1d0a (0x77e11d0a)
USER32.dll + 0x1bc8 (0x77e11bc8)
USER32.dll + 0x1cef (0x77e11cef)
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 479]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1284]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1650]
WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1672]
WinMainCRTStartup()
KERNEL32.DLL + 0x1ca90 (0x77e9ca90)

Comment 4

[Chris Petersen]

It's not just  dragging groupmarks to the personal toolbar that reproduce the
crash. I can crash the browser if I drag any bookmark in the Bookmarks folder to
a new location in the menu or on the personal toolbar.

Tested with a new profile:

1) Click on Bookmarks folder (personal toolbar) to display bookmark popup menu
2) Select a bookmark and drag item to another folder in this menu or drag onto
personal toolbar
3) After mousing up, the application crashes

Comment 5

[sairuh (rarely reading bugmail)]

strangely, i cannot repro this on win2k, linux rh8.0 or mac os x.

however, chris sees this reliably on winXP.

Comment 6

[Chris Petersen]

*** Bug 204805 has been marked as a duplicate of this bug. ***

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

You can reproduce this with Composer, too, if you:

1. Select a table cell
2. Type some content into it
3. Select the content
4. Drag that selection into another cell

Comment 8

[jim watson]

This same problem on sparc debian testing. 

If i run it like this the problem does not happen:

$strace mozilla

Comment 9

[Matthias Versen [:Matti]]

dupe of bug 191627 ?

Comment 10

[Vedran Miletic]

Happens in Windows 2003 Server too.
I will check with XP themes.

Comment 11

[Vedran Miletic]

It happens even with XP themes enabled, someone please recheck it on XP.
It happens with modern theme too.

#9 - I don't think it's a duplicate.

Comment 12

[Chris Petersen]

Comment 7 is also occurring for me (when drag/dropping cell content into another
table cell)in Composer using the OS X Macho build (2003-05-07-03). The stack
trace that is generated is the same.

Comment 13

[Chris Petersen]

*** Bug 204904 has been marked as a duplicate of this bug. ***

Comment 14

[Greg K.]

*** Bug 204932 has been marked as a duplicate of this bug. ***

Comment 15

[Jay Patel [:jay]]

Adding topcrash+ and zt4newcrash based on the following email from jrgm:

Maybe you already have a bug for this, but I saw a bug
report for http://bugzilla.mozilla.org/show_bug.cgi?id=204932
where you can crash if you run the XBL demo #2 (rollover madness)

When I checked climate for top crashes, the same stack from the XBL case
is at #1 starting with builds of 05/06. Looks like it isn't happy about 
your changes for http://bugzilla.mozilla.org/show_bug.cgi?id=196012.
|targetFrame| is null right here

        nsIFrame* targetFrame = nsnull;
        GetEventTarget(&targetFrame);
        DispatchMouseEvent(aPresContext, aEvent, NS_MOUSE_ENTER_SYNTH,
                           targetElement, targetFrame, mLastMouseOverElement);

        mLastMouseOverFrame = targetFrame;
        // This may be a different frame than the one we started with, so we
        // need to ensure it has its external reference bit set.
->      SetFrameExternalReference(mLastMouseOverFrame);
        mLastMouseOverElement = targetElement;

        // Turn recursion protection back off
        mFirstMouseOverEventElement = nsnull;

Comment 16

[Hermann Schwab]

Had a crash today (2003050804 on Win98) when trying to drag a single bookmark
from a folder in the personal toolbar into a folder in this folder.
Only DocWatson came up, not Talkback.

Comment 17

[Jay Patel [:jay]]

Choosing new component and reassigning to jkeiser for now so he can take a
look...since the fix for bug 196012 might have introduced this crash.  Please
correct me if I'm way off here.

Comment 18

[Greg K.]

Setting All/All per bug 204932, comment 1.

Comment 19

[Daniel Veditz [:dveditz]]

This should block 1.4

Comment 20

[Matthias Versen [:Matti]]

*** Bug 205000 has been marked as a duplicate of this bug. ***

Comment 21

[Asa Dotzler [:asa]]

This is recent and we certainly can't ship it in final. aaronl, bryner and
jkeiser, can you all take a look at this and see if it belongs to you? Thanks.

Comment 22

[Brian Ryner (not reading)]

I think this just needs a null check on mLastMouseOverFrame.

Comment 23

[Brian Ryner (not reading)]

Attachment: patch

this should fix it

Comment 24

[Asa Dotzler [:asa]]

Comment on attachment 122882 [details] [diff] [review]
patch

a=asa (on behalf of drivers) for checkin to 1.4, assuming no complaints from
reviewers.

Comment 25

[Matthias Versen [:Matti]]

*** Bug 205094 has been marked as a duplicate of this bug. ***

Comment 26

[John Keiser (jkeiser)]

Comment on attachment 122882 [details] [diff] [review]
patch

yep.  That was a silly mistake.

Comment 27

[Boris Zbarsky [:bzbarsky]]

*** Bug 205160 has been marked as a duplicate of this bug. ***

Comment 28

[Lorenzo Colitti]

Does this fix the horrible crash in bug 205160 (easy testcase is attachment 122924 [details])?

Comment 29

[Andrew Schultz]

*** Bug 205245 has been marked as a duplicate of this bug. ***

Comment 30

[Simon Montagu :smontagu]

*** Bug 205273 has been marked as a duplicate of this bug. ***

Comment 31

[Ed Hume]

I believe marking Bug 205273 as a duplicate of this bug may be premature. I am
working with the 2003-05-12 build of MozillaFirebird compiled by Pryan. I can't
seem to replicate whatever bug 204781 is supposed to do, but bug 205273
continues to plague Firebird.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030512 Mozilla
Firebird/0.6

Comment 32

[Johnny Stenback (:jst)]

Comment on attachment 122882 [details] [diff] [review]
patch

sr=jst

Comment 33

[Erik]

*** Bug 205359 has been marked as a duplicate of this bug. ***

Comment 34

[Matthias Versen [:Matti]]

*** Bug 205497 has been marked as a duplicate of this bug. ***

Comment 35

[Matthias Versen [:Matti]]

*** Bug 205489 has been marked as a duplicate of this bug. ***

Comment 36

[Andrew Hagen]

Is this ready for check-in?

Comment 37

[John Keiser (jkeiser)]

Checked in.

Comment 38

[Simon Paquet [:sipaq]]

*** Bug 205273 has been marked as a duplicate of this bug. ***

Comment 39

[Chris Petersen]

*** Bug 205687 has been marked as a duplicate of this bug. ***

Comment 40

[Chris Petersen]

Verified on the win32 2003-05-14-08 , macho 2003-05-14-03, and linux
2003-05-14-05 trunk builds.

Comment 41

[John Morrison]

*** Bug 205755 has been marked as a duplicate of this bug. ***

Comment 42

[Chris Petersen]

*** Bug 205745 has been marked as a duplicate of this bug. ***

Comment 43

[Andrew Schultz]

*** Bug 205934 has been marked as a duplicate of this bug. ***

Comment 44

[Andrew Schultz]

*** Bug 206194 has been marked as a duplicate of this bug. ***

Comment 45

[Phil Schwartau]

*** Bug 205982 has been marked as a duplicate of this bug. ***

Comment 46

[Matthias Versen [:Matti]]

*** Bug 206650 has been marked as a duplicate of this bug. ***

Comment 47

[Olivier Cahagne]

*** Bug 206715 has been marked as a duplicate of this bug. ***

Comment 48

[Jo Hermans]

*** Bug 206976 has been marked as a duplicate of this bug. ***

Comment 49

[Olivier Cahagne]

*** Bug 206992 has been marked as a duplicate of this bug. ***

Comment 50

[Andrew Schultz]

*** Bug 207172 has been marked as a duplicate of this bug. ***

Comment 51

[Erik]

*** Bug 206830 has been marked as a duplicate of this bug. ***

Comment 52

[Matthias Versen [:Matti]]

*** Bug 207251 has been marked as a duplicate of this bug. ***

Comment 53

[Matthias Versen [:Matti]]

*** Bug 207246 has been marked as a duplicate of this bug. ***

Comment 54

[Jan Carpenter]

This stack sig is the #1 topcrash on todays M140B report

     Count   Offset    Real Signature
[ 459   nsEventStateManager::GenerateMouseEnterExit 536e9b4d -
nsEventStateManager::GenerateMouseEnterExit ]
[ 314   nsEventStateManager::GenerateMouseEnterExit bb4e03f7 -
nsEventStateManager::GenerateMouseEnterExit ]
[ 136   nsEventStateManager::GenerateMouseEnterExit de3d5b78 -
nsEventStateManager::GenerateMouseEnterExit ]
[ 73   nsEventStateManager::GenerateMouseEnterExit efd5ab9d -
nsEventStateManager::GenerateMouseEnterExit ]
[ 58   nsEventStateManager::GenerateMouseEnterExit cdaf6ebd -
nsEventStateManager::GenerateMouseEnterExit ]
[ 50   nsEventStateManager::GenerateMouseEnterExit 7f4bc49b -
nsEventStateManager::GenerateMouseEnterExit ]
[ 50   nsEventStateManager::GenerateMouseEnterExit 480eabdd -
nsEventStateManager::GenerateMouseEnterExit ]
[ 48   nsEventStateManager::GenerateMouseEnterExit 8164548a -
nsEventStateManager::GenerateMouseEnterExit ]
[ 48   nsEventStateManager::GenerateMouseEnterExit 7896672a -
nsEventStateManager::GenerateMouseEnterExit ]
[ 40   nsEventStateManager::GenerateMouseEnterExit d3c2f34e -
nsEventStateManager::GenerateMouseEnterExit ]
[ 32   nsEventStateManager::GenerateMouseEnterExit 1b6856a9 -
nsEventStateManager::GenerateMouseEnterExit ]
[ 31   nsEventStateManager::GenerateMouseEnterExit 4f340ee5 -
nsEventStateManager::GenerateMouseEnterExit ]
[ 19   nsEventStateManager::GenerateMouseEnterExit b85c71dc -
nsEventStateManager::GenerateMouseEnterExit ]
[ 18   nsEventStateManager::GenerateMouseEnterExit d748192d -
nsEventStateManager::GenerateMouseEnterExit ]
 
     Crash date range: 2003-05-16 to 2003-05-27
     Min/Max Seconds since last crash: 5 - 1228276
     Min/Max Runtime: 10 - 1603157
 
     Count   Platform List 
     708   Windows NT 5.1 build 2600
     453   Windows NT 5.0 build 2195
     136   Windows 98 4.10 build 67766446
     48   Windows 98 4.10 build 67766222
     31   Windows 98 4.90 build 73010104
 
     Count   Build Id List 
     1376   2003050714
 
     No of Unique Users       985
 
Reopening for M140B
Will attach stack trace and half a bazillion comments.

Comment 55

[John Morrison]

Are any of the crashes for builds after 05/13 on the trunk or branch? I think
this was fixed with a checkin on 5/13, no?

Comment 56

[Jeff Walden [:Waldo]]

It *appears* to be fixed in the version of Mozilla I just downloaded/installed
five minutes ago:

Mozilla {Build ID: 2003052216}

I'm using Mozilla on WinXP, by the way.

Comment 57

[Chris Petersen]

Jeff,

If you can reproduce it in todays trunk build (2003-05-27-08), could you please
provide the steps to reproduce and provide talkback information ?

Thanks

Chris

Comment 58

[Jeff Walden [:Waldo]]

Tried to find the latest build (2003-05-27-08), and the links to latest build on
the mozilla.org homepage point to files that show as modified on 5-27.  However,
when I install, the browser says it's a 5-22 build in the title bar and on the
About page.

If you can point me where to go if I'm missing something obvious, feel free.

Please note, however, that I said that the problem did *NOT* show up in the
Mozilla build 2003052216.  It does *NOT* reproduce the error.

Comment 59

[Erik]

Jeff, the archive

mozilla-win32.zip 10383 KB 27.5.2003 16:51:00

which is currently available under
ftp://ftp.mozilla.org/pub/mozilla/nightly/latest-trunk contains - for whatever
reasons - files modified on 2003-05-22 and it identifies itself as Mozilla/5.0
(Windows; U; WinNT4.0; en-US; rv:1.4b) Gecko/20030522.
So there obviously went something wrong with this archive in the 'latest-trunk'
directory. Also the talkback-enabled version is (currently) missing there!


Nevertheless the archive

mozilla-win32.zip 10387 KB 27.5.2003 23:11:00

which can be found under 
ftp://ftp.mozilla.org/pub/mozilla/nightly/2003-05-27-16-1.4 seems to contain the
correct files - the build identifies itself correctly as Mozilla/5.0 (Windows;
U; WinNT4.0; en-US; rv:1.4) Gecko/20030527. But if you want to re-test you
should use the talkback-enabled version mozilla-win32-talkback.zip, which also
seems to be ok.

Comment 60

[Matthias Versen [:Matti]]

*** Bug 207251 has been marked as a duplicate of this bug. ***

Comment 61

[Vedran Miletic]

*** Bug 207526 has been marked as a duplicate of this bug. ***

Comment 62

[Daniel Veditz [:dveditz]]

Changing back to fixed. Sounds like the re-open was based on a bad upload.

Comment 63

[Vedran Miletic]

v

Comment 64

[Matthias Versen [:Matti]]

*** Bug 208285 has been marked as a duplicate of this bug. ***