24201 - crash scrolling second window

Status: VERIFIED FIXED

(Core :: XUL, defect, P1)

Description

[buster]

open www.hoover.com (don't ask me why anyone would want to)
as the main page loads, a second window is popped up.
click on the vertical scroll bar of the second window
crash.

stack:
nsMenuBarListener::MouseDown(nsIDOMEvent * 0x037ba904) line 218 + 15 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x037268e0, nsEvent *
0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus *
0x0012fa78) line 700 + 17 bytes
nsXULDocument::HandleDOMEvent(nsXULDocument * const 0x03a20028, nsIPresContext *
0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4,
nsEventStatus * 0x0012fa78) line 1876
nsXULElement::HandleDOMEvent(nsXULElement * const 0x03650640, nsIPresContext *
0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4,
nsEventStatus * 0x0012fa78) line 2783 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x02fcd360, nsIPresContext *
0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4,
nsEventStatus * 0x0012fa78) line 2781
nsXULElement::HandleDOMEvent(nsXULElement * const 0x030349d0, nsIPresContext *
0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4,
nsEventStatus * 0x0012fa78) line 2781
nsXULElement::HandleDOMEvent(nsXULElement * const 0x02f74c90, nsIPresContext *
0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4,
nsEventStatus * 0x0012fa78) line 2781
nsXULElement::HandleDOMEvent(nsXULElement * const 0x036a5380, nsIPresContext *
0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4,
nsEventStatus * 0x0012fa78) line 2781
nsXULElement::HandleChromeEvent(nsXULElement * const 0x036a53ac, nsIPresContext
* 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4,
nsEventStatus * 0x0012fa78) line 3764
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x03746d04,
nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528,
unsigned int 4, nsEventStatus * 0x0012fa78) line 3245
nsDocument::HandleDOMEvent(nsDocument * const 0x035e5990, nsIPresContext *
0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4,
nsEventStatus * 0x0012fa78) line 2404
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x037268e0, nsEvent *
0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 4, nsEventStatus *
0x0012fa78) line 802
AnonymousElement::HandleDOMEvent(AnonymousElement * const 0x0309b75c,
nsIPresContext * 0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x0012f528,
unsigned int 4, nsEventStatus * 0x0012fa78) line 134 + 31 bytes
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x037268e0, nsEvent *
0x0012fb6c, nsIDOMEvent * * 0x0012f528, unsigned int 1, nsEventStatus *
0x0012fa78) line 792
nsXMLElement::HandleDOMEvent(nsXMLElement * const 0x03781a6c, nsIPresContext *
0x037268e0, nsEvent * 0x0012fb6c, nsIDOMEvent * * 0x00000000, unsigned int 1,
nsEventStatus * 0x0012fa78) line 132 + 31 bytes
PresShell::HandleEvent(PresShell * const 0x02e1a1a4, nsIView * 0x037815f0,
nsGUIEvent * 0x0012fb6c, nsEventStatus * 0x0012fa78) line 2750 + 39 bytes
nsView::HandleEvent(nsView * const 0x037815f0, nsGUIEvent * 0x0012fb6c, unsigned
int 8, nsEventStatus * 0x0012fa78, int & 0) line 841
nsView::HandleEvent(nsView * const 0x0311fb00, nsGUIEvent * 0x0012fb6c, unsigned
int 28, nsEventStatus * 0x0012fa78, int & 0) line 826
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x0311c170, nsGUIEvent *
0x0012fb6c, nsEventStatus * 0x0012fa78) line 1002
HandleEvent(nsGUIEvent * 0x0012fb6c) line 69
nsWindow::DispatchEvent(nsWindow * const 0x02d2bd24, nsGUIEvent * 0x0012fb6c,
nsEventStatus & nsEventStatus_eIgnore) line 502 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fb6c) line 523
nsWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 3465 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line
3683
nsWindow::ProcessMessage(unsigned int 513, unsigned int 1, long 7536877, long *
0x0012fdcc) line 2750 + 24 bytes
nsWindow::WindowProc(void * 0x00a60516, unsigned int 513, unsigned int 1, long
7536877) line 689 + 27 bytes

Comment 1

[buster]

no big surprise, this happens on www.netscape.com as well.  suggest a P1
priority since it's a very easy to reproduce crash, and suggest an M13
milestone.

Comment 2

[Peter Trudelle]

Suggesting is fine, and in this case i agree, but in general please leave the
target milestone field blank to ensure prompt triage. reassigning to evaughan

Comment 3

[Peter Trudelle]

stupid required comment: really assigning to evaughan

Comment 4

[Eric Vaughan]

Looks like it crashes in menubar. Your working on menus right? Seems to work ok
in viewer.

Comment 5

[saari (gone)]

Dave, why in the world do we have a menubar listener for popup windows that
don't have any menus?

Comment 6

[David Hyatt]

*** Bug 23938 has been marked as a duplicate of this bug. ***

Comment 7

[David Hyatt]

There was a bad cast added in to nsMenuBarFrame.cpp.  Fixing it averts the
crash.

Comment 8

[Paul MacQuiddy]

old bug, verified 2/11