268399 - Crash when clicking on item on regular right click menu, when sub menu is open (ex. developer tools extension menu) [@ nsTimerImpl::PostTimerEvent - nsPrintObject::Init][@ nsEventStateManager::PostHandleEvent - nsPrintObject::Init]

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Jeff F.]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.1) Gecko/20040707
Build Identifier: http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/0.10.1/Firefox%20Setup%201.0PR.exe

When you open the right-click menu on any page and scroll over a sub menu like
devloper tools, than click on any item on the ORIGINAL right-click menu it
either crashes, or the sub-menu becomes disabled.

Reproducible: Always
Steps to Reproduce:
1.Right click on content
2.Select any sub-menu(like developer tools extention sub-menu)
3.Select any item on original right-click menu, such as reload

Actual Results:  
Crash, or menu is disabled

Expected Results:  
Worked...

Comment 1

[Patrick]

*** Bug 268401 has been marked as a duplicate of this bug. ***

Comment 2

[Patrick]

Jeff can you try with a more recent built of Firefox if the problem still persist.
Do you have any Talkback ID's?

Comment 3

[Jeff F.]

I have an error report, but i do not have an Id i am aware of. (Im a newbi on 
bug smashing). Error is on 1.0PR: most of the time disables sub-menu, crshes 
periodicly.

Comment 4

[Nickolay_Ponomarev]

Jeff, please see http://kb.mozillazine.org/index.phtml?title=Talkback

do you have Talkback installed? If you do, please make it send a report and post
the ID it gives you, here.

Also, is "developer tools" menu item from an extension? Which one? That may also
be the problem

Comment 5

[Rotem Liss]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041115
Firefox/1.0.

It happened to me at least 5 times. I reported to the Talkback 4 times, here are
the IDs:
TB1881891M TB2006845Y TB2351287M TB2387909G.

I can add it is not only on original menu items: I tried to click "Mark Link as
Visited" of the extension LinkVisitor.

It is not a problem on a specific extension. It happened to me with "Charcter
Encoding" of "Right Encoding", and before it with "History" of "LinkVisitor".

Shouldn't it be in "menus" componet?

Comment 6

[timeless]

[e-mail]: this bug will move as soon as we get a stack trace from your
incident.

Comment 7

[timeless]

Incident ID: 2351287
Stack Signature	nsTimerImpl::PostTimerEvent d0a1157d
Product ID	Firefox10
Build ID	2004110711
Trigger Time	2004-12-04 06:09:57.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	xpcom.dll + (0002951f)
URL visited	Not Important
User Comments	I pointed a sub-menu item on the context menu, clicked other when
sub-menu not closed > Crash.
Since Last Crash	235142 sec
Total Uptime	333386 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 461
Stack Trace 	
nsTimerImpl::PostTimerEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 461]
0x778b0c24
nsPrintObject::Init 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintObject.cpp,
line 97]
0x0450ff56

Incident ID: 2387909
Stack Signature	nsEventStateManager::PostHandleEvent f1e239f5
Product ID	Firefox10
Build ID	2004110711
Trigger Time	2004-12-06 05:54:14.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00280049)
URL visited	Not Important
User Comments	
Since Last Crash	32081 sec
Total Uptime	365467 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1951
Stack Trace 	
nsEventStateManager::PostHandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1951]
0x778b0c24
nsPrintObject::Init 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsPrintObject.cpp,
line 97]
0x0450ff56

Comment 8

[Jeff F.]

I've noticed that it always has one of two effects: Firefox crashes, or the sub
menu is disabled. It never has failed to occer.

Comment 9

[c1a9r8d5]

It happened on my PC too.

Comment 10

[Robert Whittaker]

*** Bug 274642 has been marked as a duplicate of this bug. ***

Comment 11

[Rotem Liss]

It doesn't happen for me in my newer computer, Pentium 4 3GHZ 512MB RAM (my
older was Pentium 3 ~800Mhz 128MB RAM) - I suppose it is because of the sub-menu
manages closing till I click an option.

Comment 12

[Jeff F.]

Error Still occers in 1.0.1, Possible fix: possibly if the menu is removed right
away on mouse out it would prevent problems.

Comment 13

[Unknown W. Brackets]

I have messed around with this more than a little, because I've been hit with it
many times using the Web Developer extension.

I've noticed a few things, which are really just one thing, which seem critical.
 I am unable to get it to happen, in any way, using Thunderbird (no extension,
just its submenus), and I can't find anywhere it happens outside the context
menu for the web developer extension.

In other words, it seems to be directly caused by said extension, and not caused
at all (or only indirectly so) by submenus themselves.

Said extension is available here:
https://addons.update.mozilla.org/extensions/moreinfo.php?category=Developer%20Tools&id=60

I would say that, among web developers, it is a fairly popular extension and has
indeed been the reason at least a few people switched from whatever browser they
were using (IE, Safari, etc.) to Firefox.

Anyway, my point is that this may simply be a bug in the extension, although I
would assert that you shouldn't be able to write any xul or css that might crash
the browser, whatever the condition.

-[Unknown]

Comment 14

[Jeff F.]

(In reply to comment #13)
> I have messed around with this more than a little, because I've been hit with it
> many times using the Web Developer extension.
> 
> I've noticed a few things, which are really just one thing, which seem critical.
>  I am unable to get it to happen, in any way, using Thunderbird (no extension,
> just its submenus), and I can't find anywhere it happens outside the context
> menu for the web developer extension.
> 
> In other words, it seems to be directly caused by said extension, and not caused
> at all (or only indirectly so) by submenus themselves.
> 
> Said extension is available here:
>
https://addons.update.mozilla.org/extensions/moreinfo.php?category=Developer%20Tools&id=60
> 
> I would say that, among web developers, it is a fairly popular extension and has
> indeed been the reason at least a few people switched from whatever browser they
> were using (IE, Safari, etc.) to Firefox.
> 
> Anyway, my point is that this may simply be a bug in the extension, although I
> would assert that you shouldn't be able to write any xul or css that might crash
> the browser, whatever the condition.
> 
> -[Unknown]

I have been able to reproduce it WITHOUT developer tools installed, try any
extention that adds a sub menu.

Comment 15

[Martijn Wargers (dead)]

I think bug 246712 is basically the same as this bug. The steps to reproduce are
the same.

Comment 16

[Rotem Liss]

It just crashed to me, see TB11080120W when it won't be in queue for processing any more.

Comment 17

[Jeff F.]

still exists.. TB11083987Q it seems harder to produce, however.

Comment 18

[Rotem Liss]

(In reply to comment #16)
> It just crashed to me, see TB11080120W when it won't be in queue for processing
> any more.

Here it is:

Incident ID: 11080120
Stack Signature	0x06539cb8 0a8d417a
Product ID	Firefox10
Build ID	2005091517
Trigger Time	2005-10-25 10:12:22.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	Not Important
User Comments	Clicked on LinkVisitor in context, after pointing on sub-menu didn't open still.
Since Last Crash	71504 sec
Total Uptime	71504 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x06539cb8
0x778b0c24
nsMathMLChar::Stretch  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/mathml/base/src/nsMathMLChar.cpp, line 1611]
0x26eb8007

Comment 19

[Alexander Gagarin]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 

Still crashes or disables submenu as described.  Also on my winME box too (same build)

Comment 20

[Jeff F.]

seems reslovled, can anyone confirm?

Comment 21

[Jeff Bailes]

I'm still getting this bug,
I got Thunderbird 1.5 RC2 to crash using this technique and Firefox 1.5 Final also still crashes, I mainly see it when using the undo closed tabs option from tab mix plus as the option is right next to the List of closed tabs submenu.

Comment 22

[Jeff F.]

Ah, I got it again three more TBs:TB15457766H , TB15457778X , TB15457808H

Comment 23

[Jeff F.]

this is a core issue, see: https://bugzilla.mozilla.org/show_bug.cgi?id=302584

Comment 24

[Martijn Wargers (dead)]

Now that bug 246712 is fixed, you might want to recheck in tomorrow's builds to see if it is still happening.

Comment 25

[Jeff F.]

I checked to nightly build and it seems resolved to me. (as well as the whole dang browser going 100000% faster) nice job guys its now WFM

Comment 26

[Martijn Wargers (dead)]

Ok, marking WORKSFORME based on comment 25.

Comment 27

[Jeff F.]

I can now reproduce this bug again, TB20252823Y , TB20252783M , TB20252752Z
Although significatly harder

Comment 28

[Jeff F.]

Bug needs reopened I think

Comment 29

[Martijn Wargers (dead)]

From bug TB20252783M
destroyTimerEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 467]
0x778b0c24
nsHTMLUnknownElement::nsHTMLUnknownElement  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLSpanElement.cpp, line 136]
0x0674c63b

Realted to bug 327947, bug 333504 and bug 220959 I guess.