265100 - FF10RC1 "Sort by Name" in bookmarks-toolbar context menu, then typing in text field, causes crash [@ nsMenuPopupFrame::FindMenuWithShortcut]

Status: VERIFIED FIXED

(Firefox :: Bookmarks & History, defect)

Description

[Anthony R.]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041019 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041019 Firefox/1.0

Sort by Name RSS feeds, crash Firefox after typing in a text area.

Reproducible: Always
Steps to Reproduce:
1.Create a RSS folder in Bookmarks Toolbar Folder.
2.Put one or + RSS feeds.
3.From Bookmarks Toolbar, open RSS folder and Sort by Name RSS feeds.
4.Go to URL bar (or text area) and type anything. Firefox crash.
Actual Results:  
Firefox crash

Comment 1

[Pavel Penaz]

FF crashes after sorting ordinary bookmark folder and subsequent typing in the
location bar, so this is probably a bug in the sorting mechanism.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041026 Firefox/1.0

Comment 2

[Pavel Penaz]

Talkback info - TB1569217G

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Hmm.. I can't reproduce the crash; is it reproducible with a clean profile (no
extensions, etc.) ? 

Comment 4

[Pavel Penaz]

(In reply to comment #3)
> Hmm.. I can't reproduce the crash; is it reproducible with a clean profile (no
> extensions, etc.) ? 

I'm not the reporter, but I can reproduce this bug with clean install of FF and
with a new profile. 

1. You have to first expand a bookmarks folder in the bookmarks toolbar
2. Rightclick on one of the bookmarks in this folder and select "Sort by Name".
3. Then go to location bar and start typing anything.

After following the above steps FF consistently crashes..

Comment 5

[Anthony R.]

Yes, not only RSS feeds. Crash when sorting by name, bookmarks in a folder from
Bookmarks Toolbar. (clean profile)

Comment 6

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I'm getting on a plane in an hour, but I will look at this asap.

Comment 7

[Mike Shaver (:shaver emeritus)]

Confirmed with RC1.

Updating summary to reflect the bug a little better.

RC1 stacks:
TB1573348Y
TB1573147M

Comment 8

[Worcester12345]

I can't reproduce either. Using an older profile and this version:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041026
Firefox/1.0RC1

Comment 9

[timeless]

nsMenuPopupFrame::FindMenuWithShortcut  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/
mozilla/layout/xul/base/src/nsMenuPopupFrame.cpp, line 1590]
nsMenuPopupFrame::ShortcutNavigation  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/
mozilla/layout/xul/base/src/nsMenuPopupFrame.cpp, line 1751]
nsMenuListener::KeyPress  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/
base/src/nsMenuListener.cpp, line 229]
DispatchToInterface  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/
src/nsEventListenerManager.cpp, line 127]
nsEventListenerManager::HandleEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/events/src/nsEventListenerManager.cpp, line 1524]
nsXULDocument::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/document/src/nsXULDocument.cpp, line 1261]
nsXULElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 2823]
nsXULElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 2821]
nsXULElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 2821]
nsXULElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 2821]
nsXULElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 2821]
nsXULElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 2821]
nsXULElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 2821]
nsXULElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 2821]
nsXULElement::HandleChromeEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/xul/content/src/nsXULElement.cpp, line 3988]
GlobalWindowImpl::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
dom/src/base/nsGlobalWindow.cpp, line 916]
nsDocument::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/
base/src/nsDocument.cpp, line 3742]
nsGenericElement::HandleDOMEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/
content/base/src/nsGenericElement.cpp, line 1918]
PresShell::HandleEventInternal  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/
html/base/src/nsPresShell.cpp, line 6059]
PresShell::HandleEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/
base/src/nsPresShell.cpp, line 5921]
nsViewManager::HandleEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/
nsViewManager.cpp, line 2280]
nsViewManager::DispatchEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/
src/nsViewManager.cpp, line 2066]
HandleEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 
77]
nsWindow::DispatchEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/
windows/nsWindow.cpp, line 1067]
nsWindow::DispatchKeyEvent  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/
src/windows/nsWindow.cpp, line 2978]
nsWindow::OnChar  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/
windows/nsWindow.cpp, line 3162]
nsWindow::ProcessMessage  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/
windows/nsWindow.cpp, line 3878]
nsWindow::WindowProc  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/
windows/nsWindow.cpp, line 1349]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0x89a5 (0x77d489a5)
USER32.dll + 0x89e8 (0x77d489e8)
nsAppShell::Run  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/
nsAppShell.cpp, line 159]
nsAppShellService::Run  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpfe/appshell/
src/nsAppShellService.cpp, line 495]
main  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp, 
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

bug 204041 or bug 154242?

Comment 10

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: 265100-sortbyname-context-menu-crash-0.patch

The template builder and the menu code really don't like it when we move things
around while they think they have pointers to them and whatnot.  This "fixes"
the issue.

Comment 11

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 163750 [details] [diff] [review]
265100-sortbyname-context-menu-crash-0.patch

r=shaver, looking over my shoulder

Comment 12

[Asa Dotzler [:asa]]

Comment on attachment 163750 [details] [diff] [review]
265100-sortbyname-context-menu-crash-0.patch

a=asa for checkin to the aviary branch (post rc1 approval)

Comment 13

[Tracy Walker [:tracy]]

verified Windows FF build 2004-11-04-06-0.11

Comment 14

[Jay Patel [:jay]]

Adding topcrash info for tracking.  This was a topcrash for Firefox 1.0 RC1.

Comment 15

[Mike Connor [:mconnor]]

sorry for bugspam, long-overdue mass reassign of ancient QA contact bugs, filter on "beltznerLovesGoats" to get rid of this mass change