267817 - Using Keyboard commands in Ext/Theme Manager causes crash [@ nsParser::DidBuildModel() ][@ nsWindow::DispatchEvent() ]

Status: RESOLVED WORKSFORME

(Toolkit :: Add-ons Manager, defect, P1)

Description

[Marcia Knous [:marcia]]

Seen on the Mac using Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US;
rv:1.7.5) Gecko/20041103 Firefox/1.0RC2

Sarah uncovered this and I have been able to reproduce it consistently.

STR:

1. Open Extension manager and Control + Space to bring up the context menu.
2. Using the arrow keys, move down and "disable" the extension. Also tested
"enable", "uninstall" with the same results.
3. Command + W or ESC to close the window
4. A bit of a delay, then a crash.

I have also been able to reproduce this in theme Manager.

Note that this does not happen when you right click and use the context menu,
and then close the window by clicking "X" with your mouse.

talkback hasn't caught up yet, but the ID I filed is TB1730646Q. Sarah also
filed a talkback report.

Next step is to check whether similar behavior exists on Windows/Linux.

Comment 1

[Marcia Knous [:marcia]]

Just tested with the same build on Windows XP - not able to reproduce this crash
using keyboard commands. Looks as if this might be confined to Mac.

Comment 2

[sairuh (rarely reading bugmail)]

cc'ing jay in case he sees similar talkback reports concerning extensions/themes.

however, the stacks that marcia and I generated differed somewhat

marcia's:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1730646Q

0x08901e00
nsParser::DidBuildModel() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 1323]
nsParser::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 2593]
nsRDFXMLParser::ParseString() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/rdf/base/src/nsRDFXMLParser.cpp,
line 198]
nsFeedLoadListener::TryParseAsRDF() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp,
line 378]
nsFeedLoadListener::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/browser/components/bookmarks/src/nsBookmarksFeedHandler.cpp,
line 263]
nsHttpChannel::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 607]
nsInputStreamPump::OnStateStop() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 607]
nsInputStreamPump::OnInputStreamReady() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 339]
nsInputStreamReadyEvent::EventHandler()
PL_HandleEvent() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 608]
_md_EventReceiverProc() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 1578]
HIToolbox.145.0.0 + 0x1fc8 (0x927d1fc8)
HIToolbox.145.0.0 + 0x223c (0x927d223c)
HIToolbox.145.0.0 + 0x66bc (0x927d66bc)
HIToolbox.145.0.0 + 0x12d54 (0x927e2d54)
HIToolbox.145.0.0 + 0x2084 (0x927d2084)
HIToolbox.145.0.0 + 0x223c (0x927d223c)
HIToolbox.145.0.0 + 0x146e4 (0x927e46e4)
HIToolbox.145.0.0 + 0x18600 (0x927e8600)
HIToolbox.145.0.0 + 0x28740 (0x927f8740)
HIToolbox.145.0.0 + 0x8db0 (0x927d8db0)
HIToolbox.145.0.0 + 0x908c (0x927d908c)
HIToolbox.145.0.0 + 0x1ca18 (0x927eca18)
HIToolbox.145.0.0 + 0x2d730 (0x927fd730)
nsMacMessagePump::GetEvent() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsMacMessagePump.cpp,
line 407]
nsMacMessagePump::DoMessagePump() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsMacMessagePump.cpp,
line 312]
nsAppShell::Run() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsAppShell.cpp,
line 114]
xre_main() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 710]
_start()   start()

mine:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=1730330%0D%0A

0x6f726b2c
nsWindow::DispatchEvent() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsWindow.cpp,
line 2032]
nsMacEventHandler::HandleUKeyEvent() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsMacEventHandler.cpp,
line 1275]
nsMacTSMMessagePump::UnicodeNotFromInputMethodHandler() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsMacTSMMessagePump.cpp,
line 570]
AE.287.0.0 + 0x4a10 (0x91674a10)
AE.287.0.0 + 0xbec4 (0x9167bec4)
AE.287.0.0 + 0x8108 (0x91678108)
AE.287.0.0 + 0xba74 (0x9167ba74)
HIToolbox.145.0.0 + 0x11d8d0 (0x928ed8d0)
HIToolbox.145.0.0 + 0x786d8 (0x928486d8)
HIToolbox.145.0.0 + 0x12ca0 (0x927e2ca0)
HIToolbox.145.0.0 + 0x2084 (0x927d2084)
HIToolbox.145.0.0 + 0x223c (0x927d223c)
HIToolbox.145.0.0 + 0x146e4 (0x927e46e4)
HIToolbox.145.0.0 + 0x80ef8 (0x92850ef8)
HIToolbox.145.0.0 + 0x46e10 (0x92816e10)
HIToolbox.145.0.0 + 0x50fb0 (0x92820fb0)
HIToolbox.145.0.0 + 0x80df8 (0x92850df8)
HIToolbox.145.0.0 + 0x322d4 (0x928022d4)
HIToolbox.145.0.0 + 0x63b1c (0x92833b1c)
HIToolbox.145.0.0 + 0x24cb0 (0x927f4cb0)
HIToolbox.145.0.0 + 0x1fc8 (0x927d1fc8)
HIToolbox.145.0.0 + 0x223c (0x927d223c)
HIToolbox.145.0.0 + 0x66bc (0x927d66bc)
HIToolbox.145.0.0 + 0x3b07c (0x9280b07c)
HIToolbox.145.0.0 + 0x12c94 (0x927e2c94)
HIToolbox.145.0.0 + 0x2084 (0x927d2084)
HIToolbox.145.0.0 + 0x223c (0x927d223c)
HIToolbox.145.0.0 + 0x146e4 (0x927e46e4)
HIToolbox.145.0.0 + 0x18600 (0x927e8600)
HIToolbox.145.0.0 + 0x28740 (0x927f8740)
HIToolbox.145.0.0 + 0x8db0 (0x927d8db0)
HIToolbox.145.0.0 + 0x908c (0x927d908c)
HIToolbox.145.0.0 + 0x1ca18 (0x927eca18)
HIToolbox.145.0.0 + 0x2d730 (0x927fd730)
nsMacMessagePump::GetEvent() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsMacMessagePump.cpp,
line 407]
nsMacMessagePump::DoMessagePump() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsMacMessagePump.cpp,
line 312]
nsAppShell::Run() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsAppShell.cpp,
line 114]
xre_main() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 710]
_start()   start()

Comment 3

[sairuh (rarely reading bugmail)]

I think the key to causing this crash is to use Control+Spacebar to bring up the
context menu.

Comment 4

[sairuh (rarely reading bugmail)]

context-menu key and shift-F10 don't exhibit this on WinXP or Linux fc2.

Comment 5

[Isaac]

This crashes on a 2004-11-03 1.0 branch.  Wouldn't this mess with disabled
people who use alternate (keyboard based) input devices?

Comment 6

[Marcia Knous [:marcia]]

robert strong and I were talking about this bug last evening.  Currently I am not able to reproduce this using Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1a3) Gecko/20060602 BonEcho/2.0a3.

However, the bug is still present on the 1.8.0 branch - using our 1.5.0.4 release Firefox crashes if I follow the original STR.

Comment 7

[Robert Strong (they/them - no direct email)]

If some other Mac OS X users could try to reproduce it would be a good thing. When trying to reproduce please also try similar steps in the download mgr. since they both use the richlistbox. For the download mgr.
1. Open Download Mgr. (e.g. Tools -> Downloads).
2. If no downloads are listed download something.
3. Select a download and Control + Space to bring up the context menu.
2. Using the arrow keys, move down and "remove" the download. Also test "open", "open containing folder", and "properties".
3. Command + W or ESC to close the window.

Comment 8

[Aaron Leventhal]

This bug is old and not everyone could reproduce it. Is it still valid?

Comment 9

[Robert Strong (they/them - no direct email)]

On the same system where I was able to reproduce it with Firefox 2.0a1 and below I am no longer able to reproduce it with Firefox 2.0a3

Comment 10

[Aaron Leventhal]

Works for me based on comment 9.