Closed Bug 204781 Opened 17 years ago Closed 17 years ago

crash dragging bookmark groups to and from personal toolbar - Trunk M140B [@ nsEventStateManager::GenerateMouseEnterExit]

Categories

(Core :: DOM: Events, defect, critical)

defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: svl-bmo, Assigned: john)

References

Details

(Keywords: crash, regression, topcrash+)

Crash Data

Attachments

(1 file)

MightyMu discovered this. Present in at least 2003050608 and 2003050712 - win98
Steps to reproduce with a clean profile: 
open a number of tabs, file a bookmarks group, try to drag it from the bookmarks
folder onto the personal toolbar -> crash in gklayout.dll

MightyMu's talkback ID for this is TB19878717Y
This regressed between 2003050211 and 2003050608; wish I could narrow it down
further, but there are hardly any win32 builds after that first date, and those
I tried (svg builds) are exhibiting all sorts of problems with installing right
now, and I really need sleep. :)
Bryner: caillon suspects this was you.
Confirming this problem on the win32 (2003-05-06-10) nightly build.
does this occur on other platforms?

here's the talkback report.

Incident ID 19878717
Stack Signature 	nsEventStateManager::GenerateMouseEnterExit d3c2f34e
Product ID 	MozillaTrunk
Build ID 	2003050712
Trigger Time 	2003-05-07 14:08:22
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	gklayout.dll
URL visited 	
User Comments 	dragging a tab group from the Bookmarks menu to my personal
toolbar. Clean profile.
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp
Trigger Line No. 	2644
Stack Trace 	
nsEventStateManager::GenerateMouseEnterExit
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 2644]
nsEventStateManager::PreHandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 398]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6377]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6326]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2292]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 308]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2028]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 82]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1058]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1075]
nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5198]
ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5453]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3976]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1349]
USER32.dll + 0x1d0a (0x77e11d0a)
USER32.dll + 0x1bc8 (0x77e11bc8)
USER32.dll + 0x1cef (0x77e11cef)
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 479]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1284]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1650]
WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1672]
WinMainCRTStartup()
KERNEL32.DLL + 0x1ca90 (0x77e9ca90)
Keywords: stackwantednsbeta1
Summary: crash dragging bookmark groups to and from personal toolbar → crash dragging bookmark groups to and from personal toolbar []nsEventStateManager::GenerateMouseEnterExit
It's not just  dragging groupmarks to the personal toolbar that reproduce the
crash. I can crash the browser if I drag any bookmark in the Bookmarks folder to
a new location in the menu or on the personal toolbar.

Tested with a new profile:

1) Click on Bookmarks folder (personal toolbar) to display bookmark popup menu
2) Select a bookmark and drag item to another folder in this menu or drag onto
personal toolbar
3) After mousing up, the application crashes
strangely, i cannot repro this on win2k, linux rh8.0 or mac os x.

however, chris sees this reliably on winXP.
*** Bug 204805 has been marked as a duplicate of this bug. ***
You can reproduce this with Composer, too, if you:

1. Select a table cell
2. Type some content into it
3. Select the content
4. Drag that selection into another cell
Keywords: regression
Summary: crash dragging bookmark groups to and from personal toolbar []nsEventStateManager::GenerateMouseEnterExit → crash dragging bookmark groups to and from personal toolbar [@ nsEventStateManager::GenerateMouseEnterExit]
This same problem on sparc debian testing. 

If i run it like this the problem does not happen:

$strace mozilla

dupe of bug 191627 ?
Happens in Windows 2003 Server too.
I will check with XP themes.
It happens even with XP themes enabled, someone please recheck it on XP.
It happens with modern theme too.

#9 - I don't think it's a duplicate.
Comment 7 is also occurring for me (when drag/dropping cell content into another
table cell)in Composer using the OS X Macho build (2003-05-07-03). The stack
trace that is generated is the same.
*** Bug 204904 has been marked as a duplicate of this bug. ***
*** Bug 204932 has been marked as a duplicate of this bug. ***
Adding topcrash+ and zt4newcrash based on the following email from jrgm:

Maybe you already have a bug for this, but I saw a bug
report for http://bugzilla.mozilla.org/show_bug.cgi?id=204932
where you can crash if you run the XBL demo #2 (rollover madness)

When I checked climate for top crashes, the same stack from the XBL case
is at #1 starting with builds of 05/06. Looks like it isn't happy about 
your changes for http://bugzilla.mozilla.org/show_bug.cgi?id=196012.
|targetFrame| is null right here

        nsIFrame* targetFrame = nsnull;
        GetEventTarget(&targetFrame);
        DispatchMouseEvent(aPresContext, aEvent, NS_MOUSE_ENTER_SYNTH,
                           targetElement, targetFrame, mLastMouseOverElement);

        mLastMouseOverFrame = targetFrame;
        // This may be a different frame than the one we started with, so we
        // need to ensure it has its external reference bit set.
->      SetFrameExternalReference(mLastMouseOverFrame);
        mLastMouseOverElement = targetElement;

        // Turn recursion protection back off
        mFirstMouseOverEventElement = nsnull;
Summary: crash dragging bookmark groups to and from personal toolbar [@ nsEventStateManager::GenerateMouseEnterExit] → crash dragging bookmark groups to and from personal toolbar - Trunk [@ nsEventStateManager::GenerateMouseEnterExit]
Had a crash today (2003050804 on Win98) when trying to drag a single bookmark
from a folder in the personal toolbar into a folder in this folder.
Only DocWatson came up, not Talkback.
Choosing new component and reassigning to jkeiser for now so he can take a
look...since the fix for bug 196012 might have introduced this crash.  Please
correct me if I'm way off here.
Assignee: chanial → jkeiser
Component: Bookmarks → DOM Events
Setting All/All per bug 204932, comment 1.
OS: Windows 98 → All
Hardware: PC → All
This should block 1.4
Flags: blocking1.4?
*** Bug 205000 has been marked as a duplicate of this bug. ***
This is recent and we certainly can't ship it in final. aaronl, bryner and
jkeiser, can you all take a look at this and see if it belongs to you? Thanks.
Flags: blocking1.4? → blocking1.4+
I think this just needs a null check on mLastMouseOverFrame.
Attached patch patchSplinter Review
this should fix it
Attachment #122882 - Flags: superreview?(jst)
Attachment #122882 - Flags: review?(jkeiser)
Attachment #122882 - Flags: approval1.4?
Comment on attachment 122882 [details] [diff] [review]
patch

a=asa (on behalf of drivers) for checkin to 1.4, assuming no complaints from
reviewers.
Attachment #122882 - Flags: approval1.4? → approval1.4+
*** Bug 205094 has been marked as a duplicate of this bug. ***
Comment on attachment 122882 [details] [diff] [review]
patch

yep.  That was a silly mistake.
Attachment #122882 - Flags: review?(jkeiser) → review+
*** Bug 205160 has been marked as a duplicate of this bug. ***
Does this fix the horrible crash in bug 205160 (easy testcase is attachment 122924 [details])?
*** Bug 205245 has been marked as a duplicate of this bug. ***
*** Bug 205273 has been marked as a duplicate of this bug. ***
I believe marking Bug 205273 as a duplicate of this bug may be premature. I am
working with the 2003-05-12 build of MozillaFirebird compiled by Pryan. I can't
seem to replicate whatever bug 204781 is supposed to do, but bug 205273
continues to plague Firebird.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030512 Mozilla
Firebird/0.6
Comment on attachment 122882 [details] [diff] [review]
patch

sr=jst
Attachment #122882 - Flags: superreview?(jst) → superreview+
*** Bug 205359 has been marked as a duplicate of this bug. ***
*** Bug 205497 has been marked as a duplicate of this bug. ***
*** Bug 205489 has been marked as a duplicate of this bug. ***
Blocks: 205273
Is this ready for check-in?
Checked in.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
*** Bug 205273 has been marked as a duplicate of this bug. ***
*** Bug 205687 has been marked as a duplicate of this bug. ***
Verified on the win32 2003-05-14-08 , macho 2003-05-14-03, and linux
2003-05-14-05 trunk builds.
Status: RESOLVED → VERIFIED
*** Bug 205755 has been marked as a duplicate of this bug. ***
*** Bug 205745 has been marked as a duplicate of this bug. ***
*** Bug 205934 has been marked as a duplicate of this bug. ***
*** Bug 206194 has been marked as a duplicate of this bug. ***
*** Bug 205982 has been marked as a duplicate of this bug. ***
*** Bug 206650 has been marked as a duplicate of this bug. ***
*** Bug 206715 has been marked as a duplicate of this bug. ***
*** Bug 206976 has been marked as a duplicate of this bug. ***
*** Bug 206992 has been marked as a duplicate of this bug. ***
*** Bug 207172 has been marked as a duplicate of this bug. ***
*** Bug 206830 has been marked as a duplicate of this bug. ***
*** Bug 207251 has been marked as a duplicate of this bug. ***
*** Bug 207246 has been marked as a duplicate of this bug. ***
This stack sig is the #1 topcrash on todays M140B report

     Count   Offset    Real Signature
[ 459   nsEventStateManager::GenerateMouseEnterExit 536e9b4d -
nsEventStateManager::GenerateMouseEnterExit ]
[ 314   nsEventStateManager::GenerateMouseEnterExit bb4e03f7 -
nsEventStateManager::GenerateMouseEnterExit ]
[ 136   nsEventStateManager::GenerateMouseEnterExit de3d5b78 -
nsEventStateManager::GenerateMouseEnterExit ]
[ 73   nsEventStateManager::GenerateMouseEnterExit efd5ab9d -
nsEventStateManager::GenerateMouseEnterExit ]
[ 58   nsEventStateManager::GenerateMouseEnterExit cdaf6ebd -
nsEventStateManager::GenerateMouseEnterExit ]
[ 50   nsEventStateManager::GenerateMouseEnterExit 7f4bc49b -
nsEventStateManager::GenerateMouseEnterExit ]
[ 50   nsEventStateManager::GenerateMouseEnterExit 480eabdd -
nsEventStateManager::GenerateMouseEnterExit ]
[ 48   nsEventStateManager::GenerateMouseEnterExit 8164548a -
nsEventStateManager::GenerateMouseEnterExit ]
[ 48   nsEventStateManager::GenerateMouseEnterExit 7896672a -
nsEventStateManager::GenerateMouseEnterExit ]
[ 40   nsEventStateManager::GenerateMouseEnterExit d3c2f34e -
nsEventStateManager::GenerateMouseEnterExit ]
[ 32   nsEventStateManager::GenerateMouseEnterExit 1b6856a9 -
nsEventStateManager::GenerateMouseEnterExit ]
[ 31   nsEventStateManager::GenerateMouseEnterExit 4f340ee5 -
nsEventStateManager::GenerateMouseEnterExit ]
[ 19   nsEventStateManager::GenerateMouseEnterExit b85c71dc -
nsEventStateManager::GenerateMouseEnterExit ]
[ 18   nsEventStateManager::GenerateMouseEnterExit d748192d -
nsEventStateManager::GenerateMouseEnterExit ]
 
     Crash date range: 2003-05-16 to 2003-05-27
     Min/Max Seconds since last crash: 5 - 1228276
     Min/Max Runtime: 10 - 1603157
 
     Count   Platform List 
     708   Windows NT 5.1 build 2600
     453   Windows NT 5.0 build 2195
     136   Windows 98 4.10 build 67766446
     48   Windows 98 4.10 build 67766222
     31   Windows 98 4.90 build 73010104
 
     Count   Build Id List 
     1376   2003050714
 
     No of Unique Users       985
 
Reopening for M140B
Will attach stack trace and half a bazillion comments.
Status: VERIFIED → REOPENED
Resolution: FIXED → ---
Summary: crash dragging bookmark groups to and from personal toolbar - Trunk [@ nsEventStateManager::GenerateMouseEnterExit] → crash dragging bookmark groups to and from personal toolbar - Trunk M140B [@ nsEventStateManager::GenerateMouseEnterExit]
Are any of the crashes for builds after 05/13 on the trunk or branch? I think
this was fixed with a checkin on 5/13, no?
It *appears* to be fixed in the version of Mozilla I just downloaded/installed
five minutes ago:

Mozilla {Build ID: 2003052216}

I'm using Mozilla on WinXP, by the way.
Jeff,

If you can reproduce it in todays trunk build (2003-05-27-08), could you please
provide the steps to reproduce and provide talkback information ?

Thanks

Chris
Tried to find the latest build (2003-05-27-08), and the links to latest build on
the mozilla.org homepage point to files that show as modified on 5-27.  However,
when I install, the browser says it's a 5-22 build in the title bar and on the
About page.

If you can point me where to go if I'm missing something obvious, feel free.

Please note, however, that I said that the problem did *NOT* show up in the
Mozilla build 2003052216.  It does *NOT* reproduce the error.
Jeff, the archive

mozilla-win32.zip 10383 KB 27.5.2003 16:51:00

which is currently available under
ftp://ftp.mozilla.org/pub/mozilla/nightly/latest-trunk contains - for whatever
reasons - files modified on 2003-05-22 and it identifies itself as Mozilla/5.0
(Windows; U; WinNT4.0; en-US; rv:1.4b) Gecko/20030522.
So there obviously went something wrong with this archive in the 'latest-trunk'
directory. Also the talkback-enabled version is (currently) missing there!


Nevertheless the archive

mozilla-win32.zip 10387 KB 27.5.2003 23:11:00

which can be found under 
ftp://ftp.mozilla.org/pub/mozilla/nightly/2003-05-27-16-1.4 seems to contain the
correct files - the build identifies itself correctly as Mozilla/5.0 (Windows;
U; WinNT4.0; en-US; rv:1.4) Gecko/20030527. But if you want to re-test you
should use the talkback-enabled version mozilla-win32-talkback.zip, which also
seems to be ok.
*** Bug 207251 has been marked as a duplicate of this bug. ***
*** Bug 207526 has been marked as a duplicate of this bug. ***
Changing back to fixed. Sounds like the re-open was based on a bad upload.
Status: REOPENED → RESOLVED
Closed: 17 years ago17 years ago
Resolution: --- → FIXED
v
Status: RESOLVED → VERIFIED
*** Bug 208285 has been marked as a duplicate of this bug. ***
Crash Signature: [@ nsEventStateManager::GenerateMouseEnterExit]
You need to log in before you can comment on or make changes to this bug.