Closed
Bug 281246
Opened 20 years ago
Closed 18 years ago
mozilla crashes if I Drag and Drop anything to a treeelement an call builder.rebuild [@ nsTreeBodyFrame::OnDragDrop]
Categories
(Core :: XUL, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: mbaumann, Unassigned)
References
()
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(3 files, 1 obsolete file)
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041217 Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041217 I write a application with xul. Since mozilla version 1.7.5 , the complite mozilla process is crashed if I Drag and Drop anything to a tree element and call on onDragExit: <treeobject>.builder.rebuild() or at end of onDrop handler. I have reproduced this Problem with a simple Application. On Firefox this problem does not occur. Reproducible: Always Steps to Reproduce: 1. Download the testfile from http://www.webware-experts.de/ebmt/ddtest.zip 2. register this in the mozilla installed-chrome.txt 3. Drag and Drop the Buttoon on the left to the tree Actual Results: mozilla crashes Expected Results: mozilla works well
|
||
Updated•20 years ago
|
Summary: mozilla chrashes if I Drag and Drop anything to a treeelement an call builder.rebuild → mozilla crashes if I Drag and Drop anything to a treeelement an call builder.rebuild
|
||
Comment 1•20 years ago
|
||
Does this require editing chrome, or can you reproduce the problem with a standalone XUL testcase? What's the talkback incident ID for this crash?
|
||
Comment 2•20 years ago
|
||
(In reply to comment #1) > Does this require editing chrome We can't do drag&drop in content. #0 0x42029241 in kill () from /lib/i686/libc.so.6 #1 0x402abc4b in raise () from /lib/i686/libpthread.so.0 #2 0x4202a7d2 in abort () from /lib/i686/libc.so.6 #3 0x40585b8b in __default_terminate () at ../../gcc/libgcc2.c:-1 #4 0x40585baa in __terminate () from /usr/lib/libstdc++-libc6.2-2.so.3 #5 __pure_virtual () at ../../gcc/libgcc2.c:-1 #6 0x418a3b23 in nsWindow::OnDragLeave (this=0x8d63858) at nsWindow.cpp:3450 3450 AddRef(); #7 0x418a396f in nsWindow::OnDragDropSignal (this=0x8b70d98, aWidget=0x8b70f68, aDragContext=0x8982840, aX=138, aY=31, aTime=410010777, aData=0x8b70d98) at nsWindow.cpp:3392 3392 innerMostWidget->OnDragLeave(); #8 0x418a3642 in nsWindow::DragDropSignal (aWidget=0x8b70f68, aDragContext=0x8982840, aX=138, aY=31, aTime=410010777, aData=0x8b70d98) at nsWindow.cpp:3288 3288 return window->OnDragDropSignal(aWidget, aDragContext, aX, aY, aTime, aData); #9 0x40352b48 in gtk_marshal_BOOL__POINTER_INT_INT_INT () from /usr/lib/libgtk-1.2.so.0 #10 0x403863e6 in gtk_handlers_run () from /usr/lib/libgtk-1.2.so.0 #11 0x4038571d in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0 #12 0x403838b9 in gtk_signal_emit_by_name () from /usr/lib/libgtk-1.2.so.0 #13 0x403203ad in gtk_drag_dest_drop () from /usr/lib/libgtk-1.2.so.0 #14 0x4031facd in gtk_drag_find_widget () from /usr/lib/libgtk-1.2.so.0 #15 0x4031f244 in gtk_drag_dest_handle_event () from /usr/lib/libgtk-1.2.so.0 #16 0x40351b43 in gtk_main_do_event () from /usr/lib/libgtk-1.2.so.0 #17 0x4188d647 in handle_gdk_event (event=0x8200498, data=0x0) at nsGtkEventHandler.cpp:859 #18 0x40402d6f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0 #19 0x40435773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0 #20 0x40435d39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0 #21 0x40435eec in g_main_run () from /usr/lib/libglib-1.2.so.0 #22 0x403512e3 in gtk_main () from /usr/lib/libgtk-1.2.so.0 #23 0x4187f06d in nsAppShell::Run (this=0x81724c8) at nsAppShell.cpp:293 #24 0x417e9bd9 in nsAppStartup::Run (this=0x8172490) at nsAppStartup.cpp:207 #25 0x080584c5 in main1 (argc=4, argv=0xbffffa74, nativeApp=0x80d2d70) at nsAppRunner.cpp:1325 #26 0x08059387 in main (argc=4, argv=0xbffffa74) at nsAppRunner.cpp:1812 #27 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6
|
|
||
Comment 3•20 years ago
|
||
Er... how is that ending up with a pure virtual call? nsWindow certainly (via nsBaseWidget) implements AddRef on GTK2....
|
|
||
Comment 4•20 years ago
|
||
(In reply to comment #3) >Er... how is that ending up with a pure virtual call? nsWindow certainly (via >nsBaseWidget) implements AddRef on GTK2.... Actually I think you'll find that this is a GTK1 Suite build. But I have no idea where the pure virtual call comes from.
|
Reporter | |
Comment 5•20 years ago
|
||
(In reply to comment #1) > Does this require editing chrome, or can you reproduce the problem with a > standalone XUL testcase? > > What's the talkback incident ID for this crash? Where can i find the talkback ID ? And now I have the same crash with firefox on different maschines an OS. Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0 and Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
|
|
||
Comment 6•20 years ago
|
||
> Where can i find the talkback ID ?
Run components/talkback/talkback from the Mozilla install directory.|
|
Reporter | |
Comment 7•20 years ago
|
||
The talkback incident ID is: TB3772518G
Incident ID: 3772518 Stack Signature nsTreeBodyFrame::OnDragDrop() 30cddd0f Product ID Mozilla17 Build ID 2004121706 Trigger Time 2005-02-17 23:07:37.0 Platform LinuxIntel Operating System Linux 2.6.5-7.111.30-default Module libgklayout.so + (0041b0ad) URL visited chrome://ddtest/content User Comments darg and drop , drop a button to a tree an call tree.builder.rebuild() Since Last Crash 0 sec Total Uptime 3 sec Trigger Reason SIGSEGV: Segmentation Fault: (signal 11) Source File, Line No. /builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 710 Stack Trace nsTreeBodyFrame::OnDragDrop() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 710] nsTreeBoxObject::OnDragDrop() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp, line 469] XPTC_InvokeByIndex() XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2939] XPC_WN_CallMethod() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1287] js_Invoke() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/js/src/jsinterp.c, line 941] js_Interpret() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/js/src/jsinterp.c, line 2980] js_Invoke() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/js/src/jsinterp.c, line 958] js_InternalInvoke() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/js/src/jsinterp.c, line 1035] JS_CallFunctionValue() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/js/src/jsapi.c, line 3705] nsJSContext::CallEventHandler() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1299] nsJSEventListener::HandleEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp, line 177] nsXBLPrototypeHandler::ExecuteHandler() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp, line 458] nsXBLEventHandler::HandleEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/content/xbl/src/nsXBLEventHandler.cpp, line 84] nsEventListenerManager::HandleEventSubType() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1436] nsEventListenerManager::HandleEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1529] nsXULElement::HandleDOMEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 2841] nsXULElement::HandleDOMEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 710] nsXULElement::HandleDOMEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 710] nsXULElement::HandleDOMEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 710] PresShell::HandleEventInternal() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 710] PresShell::HandleEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp, line 5901] nsViewManager::HandleEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/view/src/nsViewManager.cpp, line 710] nsViewManager::DispatchEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/view/src/nsViewManager.cpp, line 2066] HandleEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/view/src/nsView.cpp, line 77] nsWidget::DispatchEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/widget/src/gtk/nsWidget.cpp, line 1496] nsWidget::DispatchWindowEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/widget/src/gtk/nsWidget.cpp, line 1386] nsWidget::DispatchMouseEvent() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/widget/src/gtk/nsWidget.cpp, line 1570] nsWindow::OnDragDropSignal() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/widget/src/gtk/nsWindow.cpp, line 3419] nsWindow::DragDropSignal() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/widget/src/gtk/nsWindow.cpp, line 3329] libgtk-1.2.so.0 + 0xa4609 (0x401a2609) libgtk-1.2.so.0 + 0xd9e87 (0x401d7e87) libgtk-1.2.so.0 + 0xdada4 (0x401d8da4) libgtk-1.2.so.0 + 0xdc25b (0x401da25b) libgtk-1.2.so.0 + 0x6e1d5 (0x4016c1d5) libgtk-1.2.so.0 + 0x6c6cf (0x4016a6cf) libgtk-1.2.so.0 + 0x6e5b8 (0x4016c5b8) libgtk-1.2.so.0 + 0xa3692 (0x401a1692) handle_gdk_event() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/widget/src/gtk/nsGtkEventHandler.cpp, line 863] libgdk-1.2.so.0 + 0x19240 (0x40266240) libglib-1.2.so.0 + 0x11fbb (0x4029bfbb) libglib-1.2.so.0 + 0x128b7 (0x4029c8b7) libglib-1.2.so.0 + 0x1298f (0x4029c98f) libgtk-1.2.so.0 + 0xa3c4f (0x401a1c4f) nsAppShell::Run() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/widget/src/gtk/nsAppShell.cpp, line 319] nsAppShellService::Run() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 524] main1() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 710] main() [/builds/tinderbox/SeaMonkey-Branch/Linux_2.4.18-3_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1784] libc.so.6 + 0x154b0 (0x403fa4b0)
Severity: normal → critical
Keywords: crash
Summary: mozilla crashes if I Drag and Drop anything to a treeelement an call builder.rebuild → mozilla crashes if I Drag and Drop anything to a treeelement an call builder.rebuild [@ nsTreeBodyFrame::OnDragDrop]
|
|
Reporter | |
Comment 9•20 years ago
|
||
on firefox I get the same error now. the Talkback id is: TB3772585E Do you need ID's for the Windows OS ?
|
|
||
Comment 10•20 years ago
|
||
> nsTreeBodyFrame::OnDragDrop()
There is no such method, and hasn't been since April 16 (about a week and a half
after 1.7 branched off the trunk). So if/when this crashes on trunk (as for
Neil), it'll be something pretty different from the crash reporter is seeing...
|
||
Comment 11•19 years ago
|
||
The url is gone now.
|
|
Reporter | |
Comment 12•19 years ago
|
||
The testcase is available again on http://www.webware-experts.de/ebmt/ddtest.zip For linux I have found a workaround. If I call builder.rebuild on onDragExit the my tree show the right values an firefox works fine. But on windows I cat the same crash . tested with firefox 1.0.5 to 1.0.7 all version perform the same behavior .
|
|
||
Comment 13•19 years ago
|
||
Thanks Matthias! This not minimal testcase needs to be tested locally to trigger the crash. Talkback ID with current trunk build: TB11023333Q nsNativeDragTarget::Drop [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsNativeDragTarget.cpp, line 360] ole32.dll + 0xea0f9 (0x7725a0f9) ole32.dll + 0xea31f (0x7725a31f) ole32.dll + 0xb1f0e (0x77221f0e) ole32.dll + 0xb1dc7 (0x77221dc7) nsDragService::StartInvokingDragSession [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsDragService.cpp, line 188] nsDragService::InvokeDragSession [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsDragService.cpp, line 149] XPTC_InvokeByIndex [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102] XPCWrappedNative::CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2139] XPC_WN_CallMethod [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177] js_Interpret [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3501] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197] js_InternalInvoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1274] JS_CallFunctionValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4183] nsJSContext::CallEventHandler [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1422] nsJSEventListener::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 195] nsEventListenerManager::HandleEventSubType [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1684] nsEventListenerManager::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1785] nsXULElement::HandleDOMEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2037] nsEventStateManager::GenerateDragGesture [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 1591] nsEventStateManager::PreHandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 526] PresShell::HandleEventInternal [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6008] PresShell::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5850] nsViewManager::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2545] nsViewManager::DispatchEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2237] HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1135] nsWindow::DispatchMouseEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 5926] ChildWindow::DispatchMouseEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6174] nsWindow::WindowProc [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1324] USER32.dll + 0x27b17 (0x77d37b17) USER32.dll + 0x2cdce (0x77d3cdce) USER32.dll + 0x4435 (0x77d14435) USER32.dll + 0x9611 (0x77d19611) nsAppStartup::Run [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 162] main [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61] kernel32.dll + 0x1eb69 (0x77e5eb69)
|
|
Reporter | |
Comment 14•19 years ago
|
||
need you any other help, tell it me
|
|
||
Comment 15•19 years ago
|
||
This file is also needed in order for the "Not minimal testcase" to crash on drag/drop.
|
|
||
Updated•19 years ago
|
Status: UNCONFIRMED → NEW
Ever confirmed: true
|
|
Reporter | |
Comment 16•19 years ago
|
||
hi all ,
I have found a workaround for this bug.
After drag and drop i do not call treeOBJECTVARIABLE.builder.rebuild();
the this will crash.
I call now setTimeout("treeOBJECTVARIABLE.builder.rebuild();",500);.
This rebuild delay will firefox help that it not to become a crash :-)
Maybe is helps to fix this bug ?|
|
||
Comment 18•19 years ago
|
||
The old "Not minimal testcase" doesn't work anymore in current trunk builds, because of the use of preventBubble. I get js warnings about that in the console. This is strange because I still would expect it to work. I filed bug 336584 about that. So you need this file and https://bugzilla.mozilla.org/attachment.cgi?id=203743&action=view (ddtest.rdf), download to you desktop and test it there to get the crash.
Attachment #200597 -
Attachment is obsolete: true
|
|
||
Comment 19•19 years ago
|
||
This is wfm with current trunk build. This was fixed between 2006-05-11 and 2006-05-12 for me: http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-05-11+07&maxdate=2006-05-12+10&cvsroot=%2Fcvsroot Fixed by bug 336241 or by bug 336586 (but that's windows only), I guess.
|
||
Comment 20•18 years ago
|
||
wfm, reopen if you still see this
Status: NEW → RESOLVED
Closed: 18 years ago
Flags: blocking1.9a2?
Resolution: --- → WORKSFORME
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.widgets
|
Assignee | |
Updated•13 years ago
|
Crash Signature: [@ nsTreeBodyFrame::OnDragDrop]
You need to log in
before you can comment on or make changes to this bug.
Description
•