27660 - crash in nsGenericElement::HandleDOMEvent

Status: VERIFIED DUPLICATE of bug 31048

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[Warren Harris]

I just crashed while un-zooming a window from full screen to overlapping. 
I just tried to reproduce it, but couldn't. mParent has been deleted 0xdddddddd:

    //} else {
      // Node capturing stage
      if (mParent) {
        // Pass off to our parent.
=>        mParent->HandleDOMEvent(aPresContext, aEvent, aDOMEvent, 
NS_EVENT_FLAG_CAPTURE, aEventStatus);
      } else {
        //Initiate capturing phase.  Special case first call to document
        if (nsnull != mDocument) {


nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02fddf10, nsEvent * 
0x0012ef58, nsIDOMEvent * * 0x0012eb48, unsigned int 0x00000001, nsEventStatus * 
0x0012ef7c) line 996 + 33 bytes
nsGenericHTMLElement::HandleDOMEventForAnchors(nsIPresContext * 0x02fddf10, 
nsEvent * 0x0012ef58, nsIDOMEvent * * 0x00000000, unsigned int 0x00000001, 
nsEventStatus * 0x0012ef7c) line 598 + 31 bytes
nsHTMLAnchorElement::HandleDOMEvent(nsHTMLAnchorElement * const 0x02f5725c, 
nsIPresContext * 0x02fddf10, nsEvent * 0x0012ef58, nsIDOMEvent * * 0x00000000, 
unsigned int 0x00000001, nsEventStatus * 0x0012ef7c) line 342
nsEventStateManager::SendFocusBlur(nsEventStateManager * const 0x03024420, 
nsIPresContext * 0x02fddf10, nsIContent * 0x02f5725c) line 2292
nsEventStateManager::SetContentState(nsEventStateManager * const 0x03024420, 
nsIContent * 0x02f5725c, int 0x00000002) line 2083
nsHTMLAnchorElement::SetFocus(nsHTMLAnchorElement * const 0x02f57260, 
nsIPresContext * 0x02fddf10) line 244
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x0296a3b0, 
nsIPresContext * 0x0206cd00, nsGUIEvent * 0x0012f478, nsIFrame * 0x024e3d64, 
nsEventStatus * 0x0012f3e0, nsIView * 0x0206bc20) line 530
PresShell::HandleEvent(PresShell * const 0x0206b764, nsIView * 0x0206bc20, 
nsGUIEvent * 0x0012f478, nsEventStatus * 0x0012f3e0) line 2862 + 43 bytes
nsView::HandleEvent(nsView * const 0x0206bc20, nsGUIEvent * 0x0012f478, unsigned 
int 0x0000001c, nsEventStatus * 0x0012f3e0, int & 0x00000000) line 799
nsViewManager::DispatchEvent(nsViewManager * const 0x0206bec0, nsGUIEvent * 
0x0012f478, nsEventStatus * 0x0012f3e0) line 1704
HandleEvent(nsGUIEvent * 0x0012f478) line 69
nsWindow::DispatchEvent(nsWindow * const 0x0206bb04, nsGUIEvent * 0x0012f478, 
nsEventStatus & nsEventStatus_eIgnore) line 493 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f478) line 514
nsWindow::DispatchFocus(unsigned int 0x0000006a) line 3078 + 15 bytes
nsWindow::ProcessMessage(unsigned int 0x00000007, unsigned int 0x0175071a, long 
0x00000000, long * 0x0012f6cc) line 2329 + 19 bytes
nsWindow::WindowProc(HWND__ * 0x012c087a, unsigned int 0x00000007, unsigned int 
0x0175071a, long 0x00000000) line 673 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
GlobalWindowImpl::Focus(GlobalWindowImpl * const 0x020d23d8) line 1193 + 23 
bytes
nsWebShellWindow::HandleEvent(nsGUIEvent * 0x0012f934) line 524
nsWindow::DispatchEvent(nsWindow * const 0x020d1ad4, nsGUIEvent * 0x0012f934, 
nsEventStatus & nsEventStatus_eIgnore) line 493 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f934) line 514
nsWindow::DispatchFocus(unsigned int 0x00000068) line 3078 + 15 bytes
nsWindow::ProcessMessage(unsigned int 0x00000007, unsigned int 0x00000000, long 
0x00000000, long * 0x0012fb88) line 2326 + 19 bytes
nsWindow::WindowProc(HWND__ * 0x0175071a, unsigned int 0x00000007, unsigned int 
0x00000000, long 0x00000000) line 673 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
USER32! 77e718d2()
nsWindow::DefaultWindowProc(HWND__ * 0x0175071a, unsigned int 0x00000006, 
unsigned int 0x00000001, long 0x00000000) line 700
USER32! 77e727fe()
USER32! 77e72889()
nsWindow::WindowProc(HWND__ * 0x0175071a, unsigned int 0x00000006, unsigned int 
0x00000001, long 0x00000000) line 680 + 31 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
USER32! 77e71bd8()
nsAppShell::Run(nsAppShell * const 0x00c8dca0) line 96 + 77 bytes
nsAppShellService::Run(nsAppShellService * const 0x00cf77a0) line 404
main1(int 0x00000001, char * * 0x00c740d0, nsISplashScreen * 0x00000000) line 
562 + 32 bytes
main(int 0x00000001, char * * 0x00c740d0) line 675 + 17 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77f1ba06()

Comment 1

[Christine Begle]

reassigning browser-general bugs (again!) so triagers can find all the bugs 
with one query.

Comment 2

[Christine Begle]

updating component and owner

Comment 3

[joki (gone)]

Going to dupe this onto 31048.  Recreated the same stack trace there as here but 
that one has a repeatable test case.

*** This bug has been marked as a duplicate of 31048 ***

Comment 4

[John Unruh]

Verified duplicate.