288591 - Crash [@ nsDocShell::GetRootSessionHistory] on URL provided on opening DOM Inspector or clicking (right or left) on whitespace surrounding the map.

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Tristor]

When clicking with either the right or left mouse button on the whitespace in
the center frame surrounding the map on the main map screen of Kingdom Of
Loathing latest-trunk will crash.  I am unable to determine exactly what is
causing the crash.  It only occurs in the 20050331 trunk build.  I also tried
using the DOM Inspector from within latest-trunk and it crashed then as well.

I used the DOM Inspector from another Firefox install to inspect the area, and
the only values listed are
Node Name: Center
Node Type: 1

I have a handful of Talkback IDs for this crash, as I attempted to reproduce
several times.

TB4751239X
TB4755591X
TB4755846Q
TB4755872G
TB4755980H

Build Configuration:

Build platform
target
i586-pc-msvc

Build tools
Compiler 	Version 	Compiler flags
$(CYGWIN_WRAPPER) cl 	12.00.8804 	-TC -nologo -W3 -Gy -Fd$(PDBFILE)
$(CYGWIN_WRAPPER) cl 	12.00.8804 	-TP -nologo -W3 -Gy -Fd$(PDBFILE)

Configure arguments
--enable-application=browser --enable-optimize --disable-debug --disable-tests
--enable-static --disable-shared --enable-official-branding


Steps To Reproduce:
1. Goto http://www.kingdomofloathing.com
2. Login
3. Right or Left click on the white area surrounding the map image in the center
frame
4. Crash

Actual Results:

A crash occurs.

Expected Results:

Nothing should happen, as the whitespace has no significant properties

Comment 1

[Tristor]

To alleviate the need of having to login, I saved a static copy of the page as
it was at the time of reporting using the Save Page As function in Firefox 1.0.2.

http://knightsoftriumph.com/bugzilla/main_c.html

I will switch back to latest-trunk and try to reproduce with the static copy.

Comment 2

[Tristor]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050331
Firefox/1.0+

Trying to reproduce the static copy I mirrored on my website above does indeed
continue to crash following my steps to reproduce in the latest-trunk.  Talkback
ID for the crash using static copy is:

TB4757079G

Comment 3

[Nilson Cain]

WFM
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050327 Firefox/1.0.2

Comment 4

[Tristor]

Attempting to reproduce using a local version of the static copy of that page
doesn't cause a crash, instead it displays a right-click context menu, or does
nothing on a left click, as intended.  I wanted to double-check it was
reproducing with the remote static copy so I attempted again.  I got the
Talkback ID TB4757233M this time around.  I should make a note that this does
/NOT/ reproduce in any build other than 20050331 Trunk.  The 30th's build didn't
crash on this page under the same conditions.

Comment 5

[Martijn Wargers (dead)]

From Talkback ID's:

nsDocShell::GetRootSessionHistory 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 6769]
nsDocShell::CloneAndReplace 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 6746]
NS_NewXBLEventHandler 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xbl/src/nsXBLEventHandler.cpp,
line 168]
nsEventListenerManager::CreateEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1696]
DispatchToInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 133]
nsWindowRoot::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsWindowRoot.cpp,
line 74]
nsGlobalWindow::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 887]
nsXULDocument::ContentRemoved 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1192]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2005]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2001]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2001]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2001]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2001]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2001]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2001]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2001]
nsXULElement::AddPopupListener 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2712]
nsGlobalWindow::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 887]
nsDocument::CreateEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 4004]
nsEventStateManager::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 390]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6293]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6071]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2432]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2133]
nsView::ResetWidgetBounds 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
405]
nsWindow::ScreenToWidget 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1030]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5881]
nsWindow::DispatchPendingEvents 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4101]
nsWindow::DealWithPopups 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1338]
USER32.dll + 0x86cb (0x77d486cb)
USER32.dll + 0x879f (0x77d4879f)
USER32.dll + 0x92ab (0x77d492ab)
USER32.dll + 0x92f5 (0x77d492f5)
ntdll.dll + 0x25da3 (0x77f75da3)
nsGlobalWindow::Focus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 2587]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2099]
XPC_WN_GetterSetter 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1310]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1293]
fun_call  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsfun.c,
line 1460]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1293]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3568]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1390]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsapi.c, line 3804]
nsJSContext::BindCompiledEventHandler 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1427]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5175]
nsGlobalWindow::ClearAllTimeouts 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5515]
nsPasswordManager::FillPassword 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/passwordmgr/base/nsPasswordManager.cpp,
line 1889]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x2141a (0x77e8141a)

Comment 6

[Tristor]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050401
Firefox/1.0+

Retesting using the newest trunk build, WFM on both static copy I put up on my
site, and on the actual page on KoL.com

It appears that whatever was broken is now fixed, as I figured would be.  Going
to resolve this WFM.