265046 - crash in [@ nsTreeBodyFrame::AdjustEventCoordsToBoxCoordSpace]

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Bernd]

steps to reproduce:
open seamonkey
open sidebar
open history
have the full history shown
load https://bugzilla.mozilla.org/attachment.cgi?id=162567&action=view
hit print preview
close print preview
hit print preview
close print preview
hit print preview

crash

stacktrace

nsTreeBodyFrame::AdjustEventCoordsToBoxCoordSpace(int 0x000006c0, int
0x00000168, int * 0x0012e950, int * 0x0012e94c) line 840 + 8 bytes
nsTreeBodyFrame::GetCellAt(nsTreeBodyFrame * const 0x0421762c, int 0x00000090,
int 0x0000001e, int * 0x0012ea44, nsITreeColumn * * 0x0012ea48, nsACString &
{...}) line 898
nsTreeBoxObject::GetCellAt(nsTreeBoxObject * const 0x04189178, int 0x00000090,
int 0x0000001e, int * 0x0012ea44, nsITreeColumn * * 0x0012ea48, nsACString &
{...}) line 358 + 26 bytes
nsXULTooltipListener::CheckTreeBodyMove(nsIDOMMouseEvent * 0x04168668) line 331
+ 115 bytes
nsXULTooltipListener::MouseMove(nsXULTooltipListener * const 0x041c9434,
nsIDOMEvent * 0x04168678) line 190
DispatchToInterface(nsIDOMEvent * 0x04168678, nsIDOMEventListener * 0x041c9430,
unsigned int (nsIDOMEvent *)* 0x0180c056 `vcall'(unsigned int, nsIURI *, nsIURI
*, nsISupports *, const nsACString &, nsISupports *, short *), const nsID &
{...}, int * 0x0012eb34) line 128 + 9 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x041c8560,
nsPresContext * 0x036e86f8, nsEvent * 0x0012f5d0, nsIDOMEvent * * 0x0012efc4,
nsIDOMEventTarget * 0x041e9560, unsigned int 0x00000007, nsEventStatus *
0x0012f2b8) line 1597 + 31 bytes
nsXULElement::HandleDOMEvent(nsPresContext * 0x036e86f8, nsEvent * 0x0012f5d0,
nsIDOMEvent * * 0x0012efc4, unsigned int 0x00000007, nsEventStatus * 0x0012f2b8)
line 2820
PresShell::HandleEventInternal(nsEvent * 0x0012f5d0, nsIView * 0x041c8d88,
unsigned int 0x00000001, nsEventStatus * 0x0012f2b8) line 5948 + 111 bytes
PresShell::HandleEvent(PresShell * const 0x02e71a08, nsIView * 0x041c8d88,
nsGUIEvent * 0x0012f5d0, nsEventStatus * 0x0012f2b8, int 0x00000000, int &
0x00000001) line 5803 + 22 bytes
nsViewManager::HandleEvent(nsView * 0x041c8d88, nsGUIEvent * 0x0012f5d0, int
0x00000000) line 2300
nsViewManager::DispatchEvent(nsViewManager * const 0x041f86f0, nsGUIEvent *
0x0012f5d0, nsEventStatus * 0x0012f498) line 2026 + 17 bytes
HandleEvent(nsGUIEvent * 0x0012f5d0) line 168
nsWindow::DispatchEvent(nsWindow * const 0x041c8e5c, nsGUIEvent * 0x0012f5d0,
nsEventStatus & nsEventStatus_eIgnore) line 1074 + 9 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f5d0) line 1095
nsWindow::DispatchMouseEvent(unsigned int 0x0000012c, unsigned int 0x00000000,
nsPoint * 0x00000000) line 5346 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 0x0000012c, unsigned int
0x00000000, nsPoint * 0x00000000) line 5600
nsWindow::ProcessMessage(unsigned int 0x00000200, unsigned int 0x00000000, long
0x000a0090, long * 0x0012fbb8) line 4037 + 27 bytes
nsWindow::WindowProc(HWND__ * 0x002801b6, unsigned int 0x00000200, unsigned int
0x00000000, long 0x000a0090) line 1355 + 24 bytes
USER32! 77d18709()
USER32! 77d187eb()
USER32! 77d189a5()
USER32! 77d189e8()
nsAppShell::Run(nsAppShell * const 0x00ea5a80) line 135
nsAppShellService::Run(nsAppShellService * const 0x00ea57f0) line 489
main1(int 0x00000001, char * * 0x002a4250, nsISupports * 0x00dea788) line 1321 +
31 bytes
main(int 0x00000001, char * * 0x002a4250) line 1799 + 34 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 7c816d4f

There are several talkbacks for this crash
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsTreeBodyFrame%3A%3AAdjustEventCoordsToBoxCoordSpace&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

but i could not find a bug for it yet.
the crash reports are for trunk and FF branch I hit the crash with todays nightly.

Comment 1

[Bernd]

Attachment: history screenshot

Comment 2

[Moiz Dohadwala]

Reproduced it.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a5) Gecko/20041014
Talkback id: TB1407989G

Comment 3

[Ben Fowler]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a5) Gecko/20041107
Firefox/0.9.1+

Doesn't occur on Macintosh (as might be expected) I can Save as PDF and open
in 'Preview' without problems.

Comment 4

[Bernard Alleysson]

I've just hit this one: TB3916062X, Firefox windows trunk 20050224
I was dragging some URL from the URL bar to one of my bookmark toolbar folder

Comment 5

[Bernard Alleysson]

(In reply to comment #0)
100% reproductible for me with steps above on Firefox windows 20050224 : TB3925697Z

Comment 6

[[e-mail]]

So why is the pres shell dispatching an event to a hidden tree?
GetPrimaryFrameFor() called while nsFrameManager is being destroyed!

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

What's going on is that the original presentation was destroyed, but
nsXULTooltipListener adds *content* event listeners and doesn't remove them on
frame tree destruction.  There's a different presentation of the document now. 
Print preview replaces the presentation of the document, but
nsXULTooltipListener happily assumes that the frames are still around.

Comment 8

[Asa Dotzler [:asa]]

Is varga even around any more? Who can work on this?

Comment 9

[Asa Dotzler [:asa]]

I don't see this anywhere in the topcrash reports for Firefox or Thunderbird. Is
there any reason to keep this on the blocking list?

Comment 10

[Asa Dotzler [:asa]]

If a fix comes along, we'll consider taking it but this seems obscure enough
that it's not a mustfix for 1.8/1.1

Comment 11

[Bernard Alleysson]

WFM Firefox Windows trunk 20050312

nsTreeBodyFrame::AdjustEventCoordsToBoxCoordSpace doesn't exist anymore, it was renamed nsTreeBodyFrame::AdjustClientCoordsToBoxCoordSpace, no crash for this signature showing up on talkback

=> WFM