284951 - Trunk crash [@ MouseTrailer::TimerProc] [@ nsFontMetricsWin::Init] [@ 0x00000000 | nsSubstring::Assign - MouseTrailer::TimerProc] [@ 0x0??????? - nsWindow::DispatchMouseEvent]

Status: RESOLVED FIXED

(Core :: Widget: Win32, defect)

Description

[Frank Wein [:mcsmurf]]

This is a follow-up bug to Bug 125386 to track this hard-to-reproduce crash.

I applied the patch from that Bug, it still crashes :/. Now it crashes in this line:
holdMouse->DispatchMouseEvent(NS_MOUSE_EXIT);

Stack and var info (debug build) can be found under
http://www.mcsmurf.de/stack11.txt
Stack (debug build) without the patch can be found under
http://www.mcsmurf.de/stack10.txt

Comment 1

[timeless]

Attachment: purify stacks

i'm not sure my build is new enough, but it's interesting.

this is from 9 or 10 browser busters on winEmbed under purify. build seems to
be from 3/2.

Comment 2

[Jesse Ruderman]

This crash first appeared Feb 28 (022806) according to
http://talkback-public.mozilla.org/reports/firefox/FFTrunk/FFTrunk-topcrashers.html.

Comment 3

[Frank Wein [:mcsmurf]]

(In reply to comment #0)
> This is a follow-up bug to Bug 125386 to track this hard-to-reproduce crash.
> 
> I applied the patch from that Bug, it still crashes :/. Now it crashes in this
line:
> holdMouse->DispatchMouseEvent(NS_MOUSE_EXIT);

If there was any confusion about what patch i mean, i meant Attachment 176311 [details] [diff]
from Bug 125386.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Wrong component, wrong ccs...  Expecting me to do something about a
win32-specific bug will only get you so far (and bug 125386 is a few miles past
that line).

Comment 5

[Boris Zbarsky [:bzbarsky]]

So is the purify stack saying that mHoldMouse is bogus at that point?

Comment 6

[timeless]

actually, it says it happened twice :), but yes.

Comment 7

[Jay Patel [:jay]]

This is also topcrasher on the Firefox Trunk and regressed on 2/28 according to
the latest Talkback data:
http://talkback-public.mozilla.org/reports/firefox/FFTrunk/FFTrunk-topcrashers.html

It's showing up under a number of stack signatures.  Just do a search for
"MouseTrailer::TimerProc" at:
http://talkback-public.mozilla.org/reports/firefox/FFTrunk/smart-analysis.all

Here is just one set of crashes from that report:
Count   Offset    Real Signature
[ 15   MouseTrailer::TimerProc 772830ad - MouseTrailer::TimerProc ]
 
     Crash date range: 01-MAR-05 to 06-MAR-05
     Min/Max Seconds since last crash: 690 - 128358
     Min/Max Runtime: 2770 - 192525
 
     Count   Platform List 
     15   Windows XP [Windows NT 5.1 build 2600] 
 
     Count   Build Id List 
     5   2005030406
     4   2005030506
     3   2005022806
     2   2005030106
     1   2005030206
 
     No of Unique Users        15
 
 Stack trace(Frame) 

	 MouseTrailer::TimerProc
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsToolkit.cpp
 line 1051] 
	 nsWindow::DispatchMouseEvent
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp
 line 5506] 
	 ChildWindow::DispatchMouseEvent
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp
 line 5750] 
	 nsWindow::WindowProc
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp
 line 1419] 
	 USER32.dll + 0x8709 (0x77d48709)  
	 USER32.dll + 0x87eb (0x77d487eb)  
	 USER32.dll + 0x89a5 (0x77d489a5)  
	 USER32.dll + 0x89e8 (0x77d489e8)  
	 nsAppShell::Run
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsAppShell.cpp
 line 159] 
	 nsAppStartup::Run
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp
 line 145] 
	 main
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp
 line 60] 
	 kernel32.dll + 0x16d4f (0x7c816d4f)   
 
     (4142601)	URL: http://browse.deviantart.com
     (4142601)	Comments: I clicked on a link that would have taken me to a
webpage where I would have viewed a piece of artwork  but firefox failed. I am
also listening to music in Winamp.
     (4138260)	URL: http://mozillazine.org
     (4138260)	Comments: attempting to create a new thread topic on the Firefox
Builds forum of Mozillazine  using the 3/5/05 trunk build
 
====================================================================================================
     Count   Offset    Real Signature
[ 7   MouseTrailer::TimerProc 8a4550a6 - MouseTrailer::TimerProc ]
 
     Crash date range: 01-MAR-05 to 05-MAR-05
     Min/Max Seconds since last crash: 125 - 34787
     Min/Max Runtime: 125 - 34787
 
     Count   Platform List 
     7   Windows XP [Windows NT 5.1 build 2600] 
 
     Count   Build Id List 
     3   2005030206
     2   2005030106
     1   2005030406
     1   2005030306
 
     No of Unique Users         6
 
 Stack trace(Frame) 

	 MouseTrailer::TimerProc
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsToolkit.cpp
 line 1051] 
	 nsWindow::DispatchMouseEvent
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp
 line 5506] 
	 ChildWindow::DispatchMouseEvent
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp
 line 5750] 
	 nsWindow::WindowProc
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp
 line 1419] 
	 USER32.dll + 0x8709 (0x77d18709)  
	 USER32.dll + 0x87eb (0x77d187eb)  
	 USER32.dll + 0x89a5 (0x77d189a5)  
	 USER32.dll + 0x89e8 (0x77d189e8)  
	 nsAppShell::Run
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsAppShell.cpp
 line 159] 
	 nsAppStartup::Run
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp
 line 145] 
	 main
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp
 line 60] 
	 kernel32.dll + 0x16d4f (0x7c816d4f)   
 
     (4114630)	URL: http://www.usatoday.com/news/offbeat/2005-03-04-tabby_x.htm
     (4114630)	Comments: I just changed the to the another bookmark.
     (4112884)	Comments: closed a tab with CTRL + W

Adding topcrash info and zt4newcrash to make sure we get this regression fixed asap.

Comment 8

[Jay Patel [:jay]]

Looks like Boris did some work around the area of the crash on 2/27:
3.46 <[e-mail]> 2005-02-27 09:52
Followup fix to bug 125386 -- on Windows, we need to make sure that the
MouseTrailer events fire off the Mozilla event queue, so we don't reenter drag
code. Patch by me and ere, r=ere on the parts I wrote, r+sr=me on the parts ere
wrote. This is wallpaper; we need a real fix here.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Jay, see comment 0 of this bug.

Also, see bug 285000 comment 0.

Comment 10

[Jay Patel [:jay]]

Boris: I did look at both of those bugs, and decided this was the best place to
put the topcrash info since it is the central bug for the remaining issue (I
didn't want to reopen the bug you already fixed, and this one has more info than
285000).  

Comment 11

[Boris Zbarsky [:bzbarsky]]

Sure.  Just wasn't sure what comment 8 was really saying... ;)

Comment 12

[Jay Patel [:jay]]

Adding a few more stack signatures to the summary for tracking.

Comment 13

[Alex Vincent [:WeirdAl]]

I just hit this bug myself, and I got a ton of these right before my debugger
showed up:
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file
m:/mozilla/intl/strres/src/nsStringBundle.cpp, line 279

Related?

Comment 14

[Ere Maijala (slow)]

Talkback shows crashes at least on lines 1051, 1066, 1071 and 1075. Smells like
something trashing the mouse trailer to me. 

Comment 15

[Ere Maijala (slow)]

I'm hopeful we'll soon have a fix for this in bug 285000.

Comment 16

[Frank Wein [:mcsmurf]]

I didn't crash a single time since Bug 285000 was fixed. Marking fixed now, will
verify in a few days if it still doesn't crash.