288406 - crash when dragging bookmark proxy icon (favicon) from Location Bar [@ 0x00000013 + OLE32.DLL - nsDragService::StartInvokingDragSession]

Status: VERIFIED FIXED

(Core :: Widget: Win32, defect)

Description

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050330

crash when dragging bookmark proxy icon (favicon) from Location Bar to Folder in
Personal Toolbar or to Windows Desktop. Working Bookmark on Desktop invokes
Browser when clicked, but can´t be dragged into Location bar.

Talkback Ids: TB4729029G, TB4728956W, TB4728931Z, TB4728904W

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4728904W

Stack Trace  	
0x00000013
OLE32.DLL + 0x52f3a (0x65f52f3a)
OLE32.DLL + 0x533e8 (0x65f533e8)
nsDragService::StartInvokingDragSession 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp,
line 188]
nsDragService::InvokeDragSession 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp,
line 149]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2065]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1293]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3568]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1313]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1390]
JS_CallFunctionValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3804]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1384]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1545]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1642]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2046]
nsEventStateManager::GenerateDragGesture 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1534]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 486]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6285]
PresShell::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6132]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2497]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2217]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1150]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5764]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 6017]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1442]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00638bea

Comment 1

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050329
regressed 1.8b2: 2005033006

Comment 2

[Hermann Schwab]

wfm   Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050329 Firefox/1.0+
crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050330 Firefox/1.0+

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4732278Z

1 day timeframe for regression:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-03-29+00%3A00&maxdate=2005-03-30+06%3A00&cvsroot=%2Fcvsroot

maybe: Bug 255863 unfocused links cannot be drag&dropped quickly ?

Comment 3

[Adam Hauner]

Dupe of bug 288006?

Comment 4

[Hermann Schwab]

(In reply to comment #3)
> Dupe of bug 288006?

No, I´ve not seen this bug on 2 computers, win98 and win98SE, using the 20050329
builds. Using Gecko/20050330 it always is seen on Mozilla suite and tested once
Firefox.

bug 288006 is rv:1.7.6 Gecko/20050318, so older, and Branch instead of Trunk.
Or has this bug been ported yesterday?


Asking for blocking 1.8b2, as it is a recent regression.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

probably mine

Comment 6

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050330
I just tested bug 288006, didn´t see it crash. I've dragged the gif below
between two windows. Dragging the favicon instamtly crashed. I also don´t
understand why bug 288006 is filed on trunk, as the crashes are seen on branch only.

https://bugzilla.mozilla.org/mozilla-banner.gif

TB4732893Q

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4732893Q

maybe related:
Bug 233211 Dragging favicon from Location Bar to Personal Toolbar crashes
Mozilla at dropping
Bug 283478 crash when dropping Favicon dragged from Location bar - Trunk [@
nsNativeDragTarget::ProcessDrag][@ 0x00000013 | 0x00000010 -
nsDragService::StartInvokingDragSession ]

Seems I´ve got a subscription on that bug, where can I cancel?

Comment 7

[Adam Hauner]

Hermann: Forget about bug 288006, it was my very fast impression, when I saw
XPTC_InvokeByIndex in stack and dragging in description.

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

windows only? gah

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Anyone with a debugger on Windows want to give me a hand? A stack trace from the
debugger with local variables would be helpful!

Comment 10

[timeless]

roc, from similar crashes, odds favor one of aDataObj, mNativeDragSrc being
null. i'm very tempted to make all the objects we pass to windows functions not
be properties of this (and no, i can't explain why this would happen) but
instead local variables that have addrefed the corresponding member variables.

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Well, one question is whether this is really WIndows only or can be reproduced
somehow on Linux.

Comment 12

[timeless]

can't answer that, sorry, we're only developing/testing windows in house :(

Comment 13

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Well, I can't reproduce it on Linux. Hmm.

Comment 14

[Martijn Wargers (dead)]

Attachment: backtrace

Well, this is a backtrace from my freshly debug Mozilla build, in case it is
still needed. I got the crash when dragging a personal bookmark item to the url
bar, though.
If someone needs local variables, I probably need some help to get those, as
I'm not really good at this debugging stuff.

Comment 15

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050325] (nightly) (W98SE)

(works fine)

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050401] (nightly) (W98SE)

1st time: (I don't find my report on the talkback server :-()

2nd time:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=4817376

Comment 16

[Robert O'Callahan (:roc) (email my personal email if necessary)]

We really need to fix this, but it's going to be hard if I can't get it to crash.

Timeless, can you do a Purify run?

I'll try making a GTK1 build in case it crashes there.

Comment 17

[Robert O'Callahan (:roc) (email my personal email if necessary)]

My GTK1 build doesn't crash :-(

Comment 18

[Hermann Schwab]

This bug already regressed twice, seen on Win9x, WinNT4.0, Win2k, WinXP:
Bug 233211 Dragging favicon from Location Bar ... 
was caused/fixed by check-in/backing out 
Bug 20022 :hover state not set until mouse move 

Bug 283478 crash when dropping Favicon dragged from Location bar - Trunk [@
nsNativeDragTarget::ProcessDrag][@ 0x00000013 | 0x00000010 -
nsDragService::StartInvokingDragSession ]
was caused by 
Bug 125386 flyout menu disappears when mouse passes over scrollable div or iframe
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-23+13%3A46&maxdate=2005-02-23+13%3A46&cvsroot=%2Fcvsroot

This regression was fixed by an additional check-in for bug 125386.


Bug 283478 Comment #1 shows a talkback using same functions with slightly
different line numbers, compare to these current Talkbacks:
MozillaTrunk Build ID 2005040805
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4961172W
MozillaTrunk Build ID 2005040905
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4963133W

from comparing the talkbacks you also could reopen 283478.
I´m adding this bugspam as I got new talkbacks when I forgot I shouldn´t drag ...

Comment 19

[Giles Robertson]

*** Bug 289721 has been marked as a duplicate of this bug. ***

Comment 20

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix?

From discussions on IRC it appears that somehow GenerateDragGesture is being
reentered inside its call to HandleDOMEvent, or something like that. It leads
to drag state being cleared out before we get to use it.

This patch might fix the bug. It should prevent us from doing
GenerateDragGesture again inside HandleDOMEvent.

Comment 21

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I'd appreciate it if people could try this patch and give a verdict...

Comment 22

[TimoT]

I don't crash so I can't test that aspect but the attached patch does fix bug 288509

Comment 23

[Robert O'Callahan (:roc) (email my personal email if necessary)]

For whoever was crashing here (Ctho?) I need feedback on this patch if it's to
make 1.8b2

Comment 24

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

(In reply to comment #23)
> For whoever was crashing here (Ctho?) I need feedback on this patch if it's to
> make 1.8b2

Seems to work.  I couldn't reproduce well before, but after a lot of dragging
and dropping, it still hasn't crashed.

Comment 25

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 180533 [details] [diff] [review]
fix?

Stop tracking the drag gesture before we fire the DOM event. This prevents us
reentering and reinitiating a new drag/drop session while we're already doing
one. This seems to fix the crash and duplicate drop regressions.

Comment 26

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 180533 [details] [diff] [review]
fix?

fixes drag-drop crash regression on Windows, and also fixes "drag-drop drops
twice" bug that screws up bookmark folders.

Comment 27

[Asa Dotzler [:asa]]

Comment on attachment 180533 [details] [diff] [review]
fix?

a=asa

Comment 28

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in

Comment 29

[Boris Zbarsky [:bzbarsky]]

This caused bug 291537