Closed Bug 274425 Opened 20 years ago Closed 15 years ago

Crash adding url found in iframe to adblock - FF10 FFTrunk Trunk [@ nsEventStateManager::PreHandleEvent]

Categories

(Core :: DOM: UI Events & Focus Handling, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: koppel, Unassigned)

References

Details

(Keywords: crash, topcrash+, Whiteboard: [needs retesting with component.js from comment 8])

Crash Data

Attachments

(1 file)

3.38 KB, application/x-javascript
Details
FF crashed after adding an iframe in
http://www.wunderground.com/US/LA/Baton_Rouge.html to adblock's list of sites to
block.  The iframe was a vertical ad found on the right-hand side of the page.

Incident ID: 2503500

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041212
Firefox/1.0+
Severity: normal → critical
Keywords: crash
Summary: Crash adding url found in iframe to adblock → Crash adding url found in iframe to adblock
Keywords: talkbackid
i've seen this a lot, too, but my guess is you're going to have to pursue this
with the adblock devs, not the mozilla folks.
> i've seen this a lot, too, but my guess is you're going to have to pursue this
> with the adblock devs, not the mozilla folks.

What is the "this" that you're referring to?  Was it a specific way that adblock
was misusing an extension api?
i just mean i've seen this exact same crash a bunch of times...  i know nothing
of the innards of adblock.  just a happy user :)
Stack Signature	nsEventStateManager::PreHandleEvent c107d8f3
Product ID	FirefoxTrunk
Build ID	2004121207
Trigger Time	2004-12-12 11:01:28.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00268c35)
URL visited	
User Comments	Using adblock to block an iframe hoping that the crash bug would
be fixed in the build I was using.
Since Last Crash	4434 sec
Total Uptime	4434 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 801
Stack Trace 	
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 801]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5914]
PresShell::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5772]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2354]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2127]
HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1102]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5578]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 4244]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x3a50 (0x77d43a50)
USER32.dll + 0x3b1f (0x77d43b1f)
USER32.dll + 0x44f5 (0x77d444f5)
USER32.dll + 0x4525 (0x77d44525)
ntdll.dll + 0x25da3 (0x77f75da3)
nsGlobalWindow::Focus 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 2548]
nsWebShellWindow::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 608]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1102]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5578]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 4241]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x3a50 (0x77d43a50)
USER32.dll + 0x3b1f (0x77d43b1f)
USER32.dll + 0x44f5 (0x77d444f5)
USER32.dll + 0x4525 (0x77d44525)
ntdll.dll + 0x25da3 (0x77f75da3)
USER32.dll + 0x58dd (0x77d458dd)
nsWindow::DefaultWindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1409]
USER32.dll + 0x3a50 (0x77d43a50)
USER32.dll + 0x3b1f (0x77d43b1f)
USER32.dll + 0x5b3b (0x77d45b3b)
USER32.dll + 0x5b5a (0x77d45b5a)
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1390]
USER32.dll + 0x3a50 (0x77d43a50)
USER32.dll + 0x3b1f (0x77d43b1f)
USER32.dll + 0x44f5 (0x77d444f5)
USER32.dll + 0x4525 (0x77d44525)
ntdll.dll + 0x25da3 (0x77f75da3)
nsXULWindow::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 481]
nsWebShellWindow::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 1624]
nsChromeTreeOwner::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsChromeTreeOwner.cpp,
line 346]
nsGlobalWindow::CloseWindow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 4815]
nsJSContext::ScriptEvaluated 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1867]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5179]
nsGlobalWindow::TimerCallback 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5540]
nsXULWindow::ShowModal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 378]
nsContentTreeOwner::ShowAsModal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp,
line 441]
nsGlobalWindow::OpenInternal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 4775]
nsGlobalWindow::OpenDialog 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 3386]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2034]
XPC_WN_CallMethod 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1286]
js_Interpret 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3619]
js_Invoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1306]
js_Interpret 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3619]
js_Invoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1306]
js_InternalInvoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1383]
JS_CallFunctionValue 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 3767]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1352]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1520]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1597]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2820]
Assignee: firefox → events
Component: General → DOM: Events
Keywords: talkbackid
Product: Firefox → Core
QA Contact: firefox.general → ian
Summary: Crash adding url found in iframe to adblock → Crash adding url found in iframe to adblock [@ nsEventStateManager::PreHandleEvent c107d8f3]
Component: DOM: Events → Event Handling
A minimal testcase that shows the problem would be nice...
I've tried it, but I can't reproduce the crash. By the way, this seems more or
less a follow-up of bug 274096.
This is a topcrasher for Firefox 1.0 and recent MozillaTrunk builds.  All
comments point to this being a bug in the AdBlock extension.  Blocking iframes
leads to a crash.

Here is a link to all crashes for nsEventStateManager::PreHandleEvent:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsEventStateManager%3A%3APreHandleEvent&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Not sure if there is anything more we can do on our end (other than what Brendan
did in bug 274096), but it's worth a look.  If not, perhaps we can get the
AdBlock developers to look into this.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: topcrash
Summary: Crash adding url found in iframe to adblock [@ nsEventStateManager::PreHandleEvent c107d8f3] → Crash adding url found in iframe to adblock - FF10 Trunk [@ nsEventStateManager::PreHandleEvent]
Summary: Crash adding url found in iframe to adblock - FF10 Trunk [@ nsEventStateManager::PreHandleEvent] → Crash adding url found in iframe to adblock - FF10 FFTrunk Trunk [@ nsEventStateManager::PreHandleEvent]
Attached file component.js
Well, I crash 100% reproducable with this stack trace when I block iframes at
http://nu.nl with Adblock.
I have the default options for Adblock.
Steps to reproduce:
- Right-click and choose: block iFrame (they are the adverts, one at the top,
three to the left at http://nu.nl)
- When the dialog pops up, press Enter

I've tried to tear down component.js as much as possible. I've attached it
here.
With this component.js I still crash with the just described steps to reproduce
(only it crashes now also when you click with the mouse on OK when the dialog
pops up).

If you want to try Adblock with this torn down component.js, I recommend using
a separate profile for this.
Hmm...  If you comment out the line where we set display:none on the iframe,
does it stop crashing?  It sounds like we're trying to focus a torn-down
document for some reason...
(In reply to comment #9)
> Hmm...  If you comment out the line where we set display:none on the iframe,
> does it stop crashing? 
Yes, it stops crashing then.
By the way, component.js I attached here is not enough, to make it work as a
modified Adblock extension. Probably I changed something else also.
So I bet the problem is in the code at
http://lxr.mozilla.org/seamonkey/source/xpfe/appshell/src/nsXULWindow.cpp#491 --
that tries to focus the parent when a window with a parent is torn down (on
Windows only!) but here the parent has been destroyed by this point (not the
nsIBaseWindow, but the ESM, presshell, etc).

Martijn, if you put #if 0 around that whole ifdeffed block of code from line 490
to line 510, does that make this crash go away?
(In reply to comment #11)
> Martijn, if you put #if 0 around that whole ifdeffed block of code from line 490
> to line 510, does that make this crash go away?
No, that doesn't help.

I managed to get a regression range for this particular crash (for the trunk
builds).
The iframes become directly removed and collapsed in Mozilla build 20040809 08:28am.
The iframes stay visible in Mozilla build 20040810 08:55am.
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=20040809+08%3A28%3A00&maxdate=20040810+08%3A55%3A00&cvsroot=%2Fcvsroot
I guess this could be related to bug 230170.

It doesn't crash with (but with the previous mentioned bug):
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a3) Gecko/2004081208
But it does crash with:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a3) Gecko/2004081308
I backed out the patch from bug 255236 and rebuild. After that my build didn't
crash anymore (but showed the previous mentioned bug).

By the way, my Adblock preferences are: "Remove Ads" and "Collapse Blocked
Elements".
OK...  Well, when you crash, at what line in nsXULWindow.cpp are we in the
callstack, inside nsXULWindow::Destroy?

As for bug 255236, that's just weird....  That really shouldn't affect this
code.  :(
*** Bug 280484 has been marked as a duplicate of this bug. ***
Not crashing with latest builds, getting an assertion instead.

###!!! ASSERTION: Focus events should not be getting thru when this is null!:
'shell', file d:/mozilla/content/events/src/nsEventStateManager.cpp, line 801
Still a topcrash and plenty of incidents on the Trunks (both Mozilla and
Firefox).  Here is a recent incident:
Incident ID: 4186123
Stack Signature	nsEventStateManager::PreHandleEvent b90e9ab6
Product ID	FirefoxTrunk
Build ID	2005030706
Trigger Time	2005-03-07 16:08:44.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	firefox.exe + (0026d896)
URL visited	http://www.nma-fallout.com
User Comments	Crash while trying to "AdBlock" (extension plugin) the topmost
banner (iFrame).
Since Last Crash	1334 sec
Total Uptime	1334 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 810
Stack Trace 	
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 810]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6053]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5900]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2450]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2217]
HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1127]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5690]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4312]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1419]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4750 (0x77e14750)
USER32.dll + 0x55b0 (0x77e155b0)
ntdll.dll + 0x1ff57 (0x77f9ff57)
nsGlobalWindow::Focus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 2590]
nsWebShellWindow::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 500]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1127]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5690]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4309]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1419]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4750 (0x77e14750)
USER32.dll + 0x55b0 (0x77e155b0)
ntdll.dll + 0x1ff57 (0x77f9ff57)
USER32.dll + 0xdd5a (0x77e1dd5a)
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x6b41 (0x77e16b41)
USER32.dll + 0x15073 (0x77e25073)
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1426]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4750 (0x77e14750)
USER32.dll + 0x55b0 (0x77e155b0)
ntdll.dll + 0x1ff57 (0x77f9ff57)
nsXULWindow::Destroy 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 498]
nsWebShellWindow::Destroy 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 848]
nsChromeTreeOwner::Destroy 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsChromeTreeOwner.cpp,
line 354]
nsGlobalWindow::CloseWindow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 4824]
nsJSContext::ScriptEvaluated 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1899]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5188]
nsGlobalWindow::TimerCallback 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5549]
nsXULWindow::ShowModal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 395]
nsContentTreeOwner::ShowAsModal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp,
line 428]
nsGlobalWindow::OpenInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 4784]
nsGlobalWindow::OpenDialog 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 3421]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2067]
XPC_WN_CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1293]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3568]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3568]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1390]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsapi.c, line 3804]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1384]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1529]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1626]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2046]
PresShell::HandleDOMEventWithTarget 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6152]
nsMenuFrame::Execute 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1620]
nsMenuFrame::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 444]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6117]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5900]

Nominating for Aviary 1.1 and marking topcrash+ since this is a highly visible
crash with a popular extension.
Flags: blocking-aviary1.1?
Keywords: topcrashtopcrash+
Flags: blocking-aviary1.1? → blocking-aviary1.1+
Flags: blocking1.8b3?
Flags: blocking1.8b3?
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050613
Firefox/1.0+ ID:2005061308

WFM

using Adblock Plus 0.5.7 which has been properly developped and is maintained
all the time

http://bene.sitesled.com/install.htm
Flags: blocking-aviary1.1+ → blocking-aviary1.1-
1) Is this a valid bug, if it is ad-block related?
2) Is this bug still valid given comment 17 - or can it now be closed?
> 1) Is this a valid bug, if it is ad-block related?

Yes, given that ad-block is implemented in JavaScript.  The burden is on us to
prove this is an adblock problem; I have seen no such proof.

> 2) Is this bug still valid given comment 17 - or can it now be closed?

That bug is talking about a different extension which presumably has different
code and probably doesn't exercise the same (buggy) Gecko codepaths.  Hence it
not crashing is irrelevant to this bug.  Even if adblock itself is fixed to work
around this bug and hence no longer crash, that would be irrelevant to this bug
(esp. given that the bug has a testcase component that does crash, if I
understand correctly).
I've recently experienced crashes on one of the older adlock mods on a nightly
while adding an iframe, so the bug (or a new bug with the same effect) is still
there.
*** Bug 301812 has been marked as a duplicate of this bug. ***
Well the examples listed so far don't crash for me. But I did find an ad that
crashes reliably, the "http://rad.msn.com/ADSAdClient31.dll?GetAd?..." ad that
appears as soon as you log onto Hotmail.

I don't profess to understand the Adblock code too well but I can at least tell
you that it is failing on line 488 in the component.js file. This is the part
that causes Firefox to crash:

node.style.display = "none"

Where the image is the node. This line works before the image is loaded, it only
crashes after the image has loaded hence why it's only happening to people when
they are adding a new filter.

The function executes:

node.style.display = "none"

Only after the page has loaded and:

-------------------------------------------
var nodeIndex = adblockNodeIndex(wnd, node);
wnd.setTimeout(
   "var node = window._AdblockObjects["+nodeIndex+"];\
   "+  (removalCode ? removalCode : "node.style.display = 'none';")  +"\
   delete window._AdblockObjects["+nodeIndex+"];", 0);
-------------------------------------------

Before the image has loaded. Strangely before the image has loaded the first and
second method work fine. But after the image has loaded only the second method
works, but since it's currently setup to use the first method people experience
crashes.
Note to anyone wanting to overcome this issue with Adblock set
"adblock.fastcollapse" to true under "about:config". It will then use a
different function to remove the ads which doesn't crash (at least for me in my
testcase).
for another workaround, a hacked adblock is here:
http://aasted.org/adblock/viewtopic.php?t=2264
better yet, adblock plus versions 0.5.9 and higher have the workaround :)
http://bene.sitesled.com/adblock.htm
There seem to be many different variants and versions of AdBlock.  Which one
should I download to see the crash?
The last official version (0.5.2.039) is still the main one being used and
experiences the crash. It is available from either of these locations:

https://addons.mozilla.org/extensions/moreinfo.php?id=10
http://adblock.mozdev.org/dev.html
http://www.extensionsmirror.nl/index.php?showtopic=774
(In reply to comment #27)
> The last official version (0.5.2.039) is still the main one being used and
> experiences the crash. It is available from either of these locations:
> 
> https://addons.mozilla.org/extensions/moreinfo.php?id=10
> http://adblock.mozdev.org/dev.html
> http://www.extensionsmirror.nl/index.php?showtopic=774

I thought that one was abandoned and Adblock "Plus" is now taking its place. At
least that is what it seemed like from Mozillazine page and here
http://aasted.org/adblock/viewtopic.php?p=12398


Maybe it is just an extension issue after all.

my DPA2 do not crash when right-click "adblick iFrame", but click adblock icon
on status, the DPA2 crash~
Is is related to bug 304590 which has been RESOLVED?
Assignee: events → nobody
QA Contact: ian → events
Martijn, can you determine whether the component.js in comment 8 still causes a crash?
Whiteboard: [needs retesting with component.js from comment 8]
Martijn, any thoughts on coment 31. comment 29 suggest its time to close this as WFM
Sure, if you want to do that, that's fine by me.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ nsEventStateManager::PreHandleEvent]
(In reply to chris hofmann from comment #32)
> Martijn, any thoughts on coment 31. comment 29 suggest its time to close
> this as WFM

Is David Koppelman still around to confirm? (sorry, just cleaning old bugs out of mailbox)
Flags: needinfo?(koppel)
I'm still around, but of course I've upgraded since then. I have not experienced the problem, I guess, in over a decade and I'm sorry but I don't remember when the problem disappeared.
Flags: needinfo?(koppel)
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.