Closed Bug 279205 Opened 15 years ago Closed 15 years ago

[FIX]Crash in Trunk [@ nsEventStateManager::DispatchMouseEvent] [@ nsDOMEvent::GetTargetFromFrame]

Categories

(Core :: DOM: UI Events & Focus Handling, defect, P1, critical)

defect

Tracking

()

VERIFIED FIXED
mozilla1.8beta1

People

(Reporter: stephend, Assigned: bzbarsky)

References

Details

(Keywords: crash, topcrash)

Crash Data

Attachments

(1 file)

I think (though of course I'm not entirely sure) that this is fallout from bug
244366; I only started crashing with today's build; usually when loading large
pages (such as Bonsai checkins) and doing something while it's doing that (i.e.
moving the mouse).

I still don't have the steps to reproduce yet, sorry.

0x00000000
nsEventStateManager::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2542]
nsEventStateManager::GenerateMouseEnterExit 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2618]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 474]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5902]
PresShell::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5761]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2424]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2151]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1103]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5402]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5653]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1389]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0x89a5 (0x77d489a5)
USER32.dll + 0x89e8 (0x77d489e8)
nsAppShell::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppStartup::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 208]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1811]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1839]
kernel32.dll + 0x16d4f (0x7c816d4f)
*** Bug 279204 has been marked as a duplicate of this bug. ***
dupe of bug 279238 ?
That one has slightly more details
Yes, but this one is in the right product/component, has reliable steps to
reproduce (which aren't in the bug because they involve a private page), and is
pretty definitely a regression from bug 244366.

Marking blocking the other for now.
Blocks: 279238
Attached patch Patch, I thinkSplinter Review
Robert, see bug 244366 comment 14 for the background on this change... 
Changing this is definitely the right thing to do, and seems to fix this crash.
Assignee: events → bzbarsky
Status: NEW → ASSIGNED
Attachment #172067 - Flags: superreview?(roc)
Attachment #172067 - Flags: review?(roc)
OS: Windows XP → All
Priority: -- → P1
Hardware: PC → All
Summary: Crash in [ @ nsEventStateManager::DispatchMouseEvent] → [FIX]Crash in [ @ nsEventStateManager::DispatchMouseEvent]
Target Milestone: --- → mozilla1.8beta
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=3221984#id
TB3221984H, TB3221865K, TB3221839Y

Steps to reproduce:
1. load http://www.bzga.de/
2. click in the menus to the left, may take 3 to 6 minuts to crash.

I first crashed after a long browsing session, had lots of tabs open, when I
loaded that page, and wanted to read more of an article, and clicked 'gesamten
Text lesen...' (read full text..), and instantly crashed.

I reopened the browser, went directly to that page bzga.de, got redirected,
retried reading the article, reading some others, reloading, then concentrated
on clicking the menu to the left, and succeeded in another crash.

Installed nightly, produced three more crashs, now with talkback.
better steps to repeat:
1. load http://www.bzga.de/  (JS must be enabled to get redirected)
2. in the top menu click 2nd link to the right, 'English', to crash.
3. if it didn´t crash, click on Mozilla´s Back button to crash.

direct link to the English site, but I didn´t try, suspect you must click the
original button:
http://www.bzga.de/jumpto.php3?uid=41972a04a048bf686a52fd244708cd00&id=home

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=url&match=contains&searchfor=bzga&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

TB3222651W, TB3222606E crashed twice  'in
nsEventStateManager::DispatchMouseEvent', when after loading the page I switched
to 'english', and when I pressed back.
TB3222461E, TB3221984H crashed twice in
'nsEventStateManager::GenerateMouseEnterExit'

TB3221865K, TB3221839Y crashed twice in '0x00000013 5a3a859f', no other useful info
Yeah, this patch seems to fix the steps in comment 6.
Blocks: 279458
Patch works for me too (Firefox/BeOS).

It always used to crash on the first click of the 'Sign In' button on
mail.lycos.co.uk before applying the patch.
Attachment #172067 - Flags: superreview?(roc)
Attachment #172067 - Flags: superreview+
Attachment #172067 - Flags: review?(roc)
Attachment #172067 - Flags: review+
Checked in.
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
*** Bug 279458 has been marked as a duplicate of this bug. ***
*** Bug 279238 has been marked as a duplicate of this bug. ***
Verified FIXED for me using build 2005-01-24-05 on Windows XP.  Thanks Boris!
Status: RESOLVED → VERIFIED
Adding topcrash info for tracking.  This was a regression on the Trunk starting
on 1/20 and has gone away since this patch was checked in 1/23.
Keywords: topcrash
Summary: [FIX]Crash in [ @ nsEventStateManager::DispatchMouseEvent] → [FIX]Crash in Trunk [@ nsEventStateManager::DispatchMouseEvent]
Adding [@ nsDOMEvent::GetTargetFromFrame] from duped bug 279458 for future
reference.
Summary: [FIX]Crash in Trunk [@ nsEventStateManager::DispatchMouseEvent] → [FIX]Crash in Trunk [@ nsEventStateManager::DispatchMouseEvent] [@ nsDOMEvent::GetTargetFromFrame]
*** Bug 279752 has been marked as a duplicate of this bug. ***
Blocks: 244366
*** Bug 280490 has been marked as a duplicate of this bug. ***
Crash Signature: [@ nsEventStateManager::DispatchMouseEvent] [@ nsDOMEvent::GetTargetFromFrame]
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.