281035 - Crash [@ nsGenericHTMLElement::HandleDOMEventForAnchors] clicking on a "Close Window" link

Status: RESOLVED DUPLICATE of bug 343953

(Core :: Layout, defect)

Description

[Simon Fraser [no longer active]]

I've been seeing a crash in Camino when closing the SFGate 'Day in Pictures'
window, with the following stack:

bt
#0  0x1424c200 in nsGenericHTMLElement::HandleDOMEventForAnchors(nsPresContext*,
nsEvent*, nsIDOMEvent**, unsigned, nsEventStatus*) (this=0xdfea330,
aPresContext=0xdfdb860, aEvent=0xbfffee40, aDOMEvent=0xbfffe6b0, aFlags=2,
aEventStatus=0xbfffead4) at
../../../../../../mozilla/content/html/content/src/nsGenericHTMLElement.cpp:1520
#1  0x1425b8cc in nsHTMLAnchorElement::HandleDOMEvent(nsPresContext*, nsEvent*,
nsIDOMEvent**, unsigned, nsEventStatus*) (this=0xdfea330,
aPresContext=0xdfdb860, aEvent=0xbfffee40, aDOMEvent=0xbfffe6b0, aFlags=2,
aEventStatus=0xbfffead4) at
../../../../../../mozilla/content/html/content/src/nsHTMLAnchorElement.cpp:276
#2  0x141e5084 in nsGenericElement::HandleDOMEvent(nsPresContext*, nsEvent*,
nsIDOMEvent**, unsigned, nsEventStatus*) (this=0xdfea620,
aPresContext=0xdfdb860, aEvent=0xbfffee40, aDOMEvent=0xbfffe6b0, aFlags=7,
aEventStatus=0xbfffead4) at
../../../../../mozilla/content/base/src/nsGenericElement.cpp:2019
#3  0x142770a4 in nsHTMLImageElement::HandleDOMEvent(nsPresContext*, nsEvent*,
nsIDOMEvent**, unsigned, nsEventStatus*) (this=0xdfea620,
aPresContext=0xdfdb860, aEvent=0xbfffee40, aDOMEvent=0x0, aFlags=1,
aEventStatus=0xbfffead4) at
../../../../../../mozilla/content/html/content/src/nsHTMLImageElement.cpp:506
#4  0x13f502bc in PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned,
nsEventStatus*) (this=0x40e8800, aEvent=0xbfffee40, aView=0xdfe70d0, aFlags=1,
aStatus=0xbfffead4) at ../../../../mozilla/layout/base/nsPresShell.cpp:5918
#5  0x13f4fc88 in PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*,
int, int&) (this=0x40e8800, aView=0xdfe70d0, aEvent=0xbfffee40,
aEventStatus=0xbfffead4, aForceHandle=0, aHandled=@0xbfffeb44) at
../../../../mozilla/layout/base/nsPresShell.cpp:5774
#6  0x1434f444 in nsViewManager::HandleEvent(nsView*, nsGUIEvent*, int)
(this=0xdfdcda0, aView=0xdfe6d20, aEvent=0xbfffee40, aCaptured=0) at
../../../../mozilla/view/src/nsViewManager.cpp:2422
#7  0x1434e860 in nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*)
(this=0xdfdcda0, aEvent=0xbfffee40, aStatus=0xbfffec90) at
../../../../mozilla/view/src/nsViewManager.cpp:2151
#8  0x14342c44 in HandleEvent(nsGUIEvent*) (aEvent=0xbfffee40) at
../../../../mozilla/view/src/nsView.cpp:171
#9  0x0c060554 in nsChildView::DispatchEvent(nsGUIEvent*, nsEventStatus&)
(this=0xdfe6da0, event=0xbfffee40, aStatus=@0xbfffed50) at
../../../../../mozilla/widget/src/cocoa/nsChildView.mm:1737
#10 0x0c06064c in nsChildView::DispatchWindowEvent(nsGUIEvent&) (this=0xdfe6da0,
event=@0xbfffee40) at ../../../../../mozilla/widget/src/cocoa/nsChildView.mm:1752
#11 0x0c06076c in nsChildView::DispatchMouseEvent(nsMouseEvent&)
(this=0xdfe6da0, aEvent=@0xbfffee40) at
../../../../../mozilla/widget/src/cocoa/nsChildView.mm:1779
#12 0x0c062b5c in -[ChildView mouseDown:] (self=0xdfe6e50, _cmd=0x90883610,
theEvent=0xccdb530) at ../../../../../mozilla/widget/src/cocoa/nsChildView.mm:2585
#13 0x92e03178 in -[NSWindow sendEvent:] ()
#14 0x0004803c in -[BrowserWindow sendEvent:] (self=0xdfc8360, _cmd=0x9088f8a4,
theEvent=0xccdb530) at
/Volumes/Ocelot/projects/mozilla/camino/trunk/builds/camino/camino/src/browser/BrowserWindow.mm:71
#15 0x92df583c in -[NSApplication sendEvent:] ()
#16 0x92dfdc54 in -[NSApplication run] ()
#17 0x92eba2b8 in NSApplicationMain ()
#18 0x000028cc in main (argc=1, argv=0xbffffc04) at
/Volumes/Ocelot/projects/mozilla/camino/trunk/builds/camino/camino/src/application/main.m:53

It crashes because the focus controller is null.

To reproduce:
1. Go to www.sfgate.com
2. click on the Day in Pictures (on the right side of the page)
3. In the resulting window, click the Close Window link at the middle-top.

It crashes for me fairly consistently, but not every time.
I tried this in Mozilla, and it didn't crash. It crashed both with and without
the patch from bug 278916.

Comment 1

[Boris Zbarsky [:bzbarsky]]

The focus controller is being fetched after the window.close call, and we call
out to nsIChromeEventHandler to get it (via nsPIWindowRoot).

Now window.close calls into CHBrowserListener::DestroyBrowserWindow.  I don't
read objective C well enough to trace it from here, but I would not be surprised
if it nulls out the focus controller...

Sounds like we need a null-check in the anchor code.

Comment 2

[Simon Fraser [no longer active]]

I should add that sometimes the first click on that Close Window link does
nothing. Then the second click crashes.

Comment 3

[Simon Fraser [no longer active]]

I haven't seen this recently.

Comment 4

[Jay Patel [:jay]]

Reopening and adding topcrash info.  A few users have been crashing with recent
Firefox Trunk builds with a similar stack, making this somewhat of a topcrasher.
 Current Talkback data can be found here:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsGenericHTMLElement%3A%3AHandleDOMEventForAnchors&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

If this is a different crash, I can log another bug.  Let me know.

Comment 5

[Jay Patel [:jay]]

Updating product, component and platforms...since the latest Talkback data says
Firefox and Mozilla are crashing as well.

Comment 6

[Steve England [:stevee]]

Severity -> Critical

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050327
Firefox/1.0+
I see this bug at http://www.exotec-design.de/index.php?id=745
1. Go to the above site
2. Click on any picture
3. A new popuped window appears. Left click on it should dismiss the window, but
often it doesn't. A second Left click results in firefox crashing.
Talkback TB4636461Y

Athough I have to add that with a new profile this problem seems to go away for
the particular example at http://www.exotec-design.de/index.php?id=745 for me.

Comment 7

[Boris Zbarsky [:bzbarsky]]

The stack in comment 6 is bogus (that is, those functions don't call each other)...

Comment 8

[Pardal Freudenthal (:ShareBird)]

I don't have this behaviour if I disable the Extension TabMix.

Testing with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2)
Gecko/20050410 Firefox/1.0+

Comment 9

[Steve England [:stevee]]

re comment 8; indeed, when I disable TabMix extension the crashing in both cases
goes away.

Simon, can you reproduce the crashing with a new profile (eg: no extensions)?

Comment 10

[Simon Fraser [no longer active]]

My crashes were in Camino, which doesn't have extensions.

Comment 11

[Pardal Freudenthal (:ShareBird)]

Using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050609
Firefox/1.0+ ID:2005060906 and TabMix Plus 0.2.2 I don't have anymore crashes at
http://www.exotec-design.de/index.php?id=745

Comment 12

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050702
Firefox/1.0+ ID:2005070216
This also WFM; new profile.

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Since bug 343953 has a patch for this, marking a dup of it

*** This bug has been marked as a duplicate of 343953 ***