289430 - Mozilla crashes on closing tab with textbox focused [@ nsTextEditorFocusListener::Blur ]

Status: RESOLVED DUPLICATE of bug 289379

(Core :: Layout, defect)

Description

[Frank Wein [:mcsmurf]]

To reproduce:
1. Open at least two tabs (so you can close one :)
2. Go to dict.leo.org (any other site with a textbox should work, too) in one
tab and make sure the cursor is blinking in the textbox on the top.
3. Close tab
4. Observe crash

Comment 1

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050407
Firefox/1.0+
I also see this. TB doesn't launch so no talkback id. Doesn't happen when you
only have one tab open and choose 'close window'.

Comment 2

[Frank Wein [:mcsmurf]]

Regression timeframe is from 2005-04-05-06 to 2005-04-06-06.
Bonsai link:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-04-05+05%3A00%3A00&maxdate=2005-04-06+07%3A00%3A00&cvsroot=%2Fcvsroot

Comment 3

[Peter van der Woude [:Peter6]]

Bug 289343 might well be a dupe of this one (or closely related)

Comment 4

[[e-mail]]

#0  0x08503d94 in ?? ()
#1  0x42c40cc2 in nsCOMPtr<nsIEditorIMESupport>::assign_from_qi
(this=0xbfffe080, qi={mRawPtr = 0x8933498}, aIID=@0x42c7d800) at
../../../dist/include/xpcom/nsCOMPtr.h:1232
#2  0x42c404bf in nsCOMPtr<nsIEditorIMESupport>::nsCOMPtr (this=0xbfffe080,
qi={mRawPtr = 0x8933498}) at ../../../dist/include/xpcom/nsCOMPtr.h:645
#3  0x42c4004e in nsTextEditorFocusListener::Blur (this=0x89815f0,
aEvent=0x83d8ae0) at nsEditorEventListeners.cpp:1088
#4  0x40d8c200 in DispatchToInterface (aEvent=0x83d8ae0, aListener=0x89815f0,
aMethod={__delta = 0, __index = 8, __pfn_or_delta2 = {__pfn = <unknown>,
__delta2 = 0}}, aIID=@0x40fea4e0, aHasInterface=0xbfffe124) at
nsEventListenerManager.cpp:136
#5  0x40d9064a in nsEventListenerManager::HandleEvent (this=0x8988e18,
aPresContext=0x88bc538, aEvent=0xbfffe610, aDOMEvent=0xbfffe2cc,
aCurrentTarget=0x8d121e8, aFlags=7, aEventStatus=0xbfffe640) at
nsEventListenerManager.cpp:1635
#6  0x40d51420 in nsGenericElement::HandleDOMEvent (this=0x892e550,
aPresContext=0x88bc538, aEvent=0xbfffe610, aDOMEvent=0xbfffe2cc, aFlags=7,
aEventStatus=0xbfffe640) at nsGenericElement.cpp:2101
#7  0x40df771d in nsHTMLInputElement::HandleDOMEvent (this=0x892e550,
aPresContext=0x88bc538, aEvent=0xbfffe610, aDOMEvent=0x0, aFlags=1,
aEventStatus=0xbfffe640) at nsHTMLInputElement.cpp:1370
#8  0x40d950b8 in nsEventStateManager::PreHandleEvent (this=0x91295b0,
aPresContext=0x914a0d8, aEvent=0xbfffeb00, aTargetFrame=0x942e944,
aStatus=0xbfffe92c, aView=0x928d158) at nsEventStateManager.cpp:558
#9  0x40ad63b1 in PresShell::HandleEventInternal (this=0x928d2d0,
aEvent=0xbfffeb00, aView=0x928d158, aFlags=1, aStatus=0xbfffe92c) at
nsPresShell.cpp:6254
#10 0x40ad5d52 in PresShell::HandleEvent (this=0x928d2d0, aView=0x928d158,
aEvent=0xbfffeb00, aEventStatus=0xbfffe92c, aForceHandle=1,
aHandled=@0xbfffe928) at nsPresShell.cpp:6107
#11 0x40eebe5a in nsViewManager::HandleEvent (this=0x8ff1328, aView=0x928d158,
aEvent=0xbfffeb00, aCaptured=0) at nsViewManager.cpp:2459
#12 0x40eeb5f0 in nsViewManager::DispatchEvent (this=0x8ff1328,
aEvent=0xbfffeb00, aStatus=0xbfffe9f0) at nsViewManager.cpp:2228
#13 0x40ee1196 in HandleEvent (aEvent=0xbfffeb00) at nsView.cpp:171
#14 0x418b8bea in nsWidget::DispatchEvent (this=0x9124c48, aEvent=0xbfffeb00,
aStatus=@0xbfffeabc) at nsWidget.cpp:1520
#15 0x418b87f6 in nsWidget::DispatchWindowEvent (this=0x9124c48,
event=0xbfffeb00) at nsWidget.cpp:1409
#16 0x418b889e in nsWidget::DispatchFocus (this=0x9124c48, aEvent=@0xbfffeb00)
at nsWidget.cpp:1430
#17 0x418bf498 in nsWindow::DispatchSetFocusEvent (this=0x9124c48) at
nsWindow.cpp:1404
#18 0x418bf3ed in nsWindow::SetFocus (this=0x9124c48, aRaise=1) at nsWindow.cpp:1370
#19 0x40f08884 in nsGlobalWindow::Focus (this=0x9139798) at nsGlobalWindow.cpp:2594
#20 0x41867ec5 in nsWebShellWindow::HandleEvent (aEvent=0xbfffedc0) at
nsWebShellWindow.cpp:495
#21 0x418b8bea in nsWidget::DispatchEvent (this=0x8c7b1a0, aEvent=0xbfffedc0,
aStatus=@0xbfffed7c) at nsWidget.cpp:1520
#22 0x418b87f6 in nsWidget::DispatchWindowEvent (this=0x8c7b1a0,
event=0xbfffedc0) at nsWidget.cpp:1409
#23 0x418b889e in nsWidget::DispatchFocus (this=0x8c7b1a0, aEvent=@0xbfffedc0)
at nsWidget.cpp:1430
#24 0x418bf498 in nsWindow::DispatchSetFocusEvent (this=0x8c7b1a0) at
nsWindow.cpp:1404
#25 0x418bf6b2 in nsWindow::HandleMozAreaFocusIn (this=0x8c7b1a0) at
nsWindow.cpp:1498
#26 0x418c30c7 in handle_mozarea_focus_in (aWidget=0x924a418,
aGdkFocusEvent=0xbffff220, aData=0x8c7b1a0) at nsWindow.cpp:2834
#27 0x40354a9c in gtk_marshal_BOOL__POINTER () from /usr/lib/libgtk-1.2.so.0
#28 0x403883e6 in gtk_handlers_run () from /usr/lib/libgtk-1.2.so.0
#29 0x4038771d in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#30 0x403854d5 in gtk_signal_emit () from /usr/lib/libgtk-1.2.so.0
#31 0x403bfb49 in gtk_widget_event () from /usr/lib/libgtk-1.2.so.0
#32 0x403c88bc in gtk_window_focus_in_event () from /usr/lib/libgtk-1.2.so.0
#33 0x40354a9c in gtk_marshal_BOOL__POINTER () from /usr/lib/libgtk-1.2.so.0
#34 0x4038775d in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#35 0x403854d5 in gtk_signal_emit () from /usr/lib/libgtk-1.2.so.0
#36 0x403bfb49 in gtk_widget_event () from /usr/lib/libgtk-1.2.so.0
#37 0x40353ac4 in gtk_main_do_event () from /usr/lib/libgtk-1.2.so.0
#38 0x418aded7 in handle_gdk_event (event=0x825cad0, data=0x0) at
nsGtkEventHandler.cpp:859
#39 0x40404d6f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#40 0x40437773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#41 0x40437d39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#42 0x40437eec in g_main_run () from /usr/lib/libglib-1.2.so.0
#43 0x403532e3 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#44 0x4189f8ed in nsAppShell::Run (this=0x817e288) at nsAppShell.cpp:293
#45 0x4180c1c9 in nsAppStartup::Run (this=0x817e250) at nsAppStartup.cpp:207
#46 0x08058d1c in main1 (argc=3, argv=0xbffffab4, nativeApp=0x80d95c8) at
nsAppRunner.cpp:1268
#47 0x08059b57 in main (argc=3, argv=0xbffffab4) at nsAppRunner.cpp:1752
#48 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6

Comment 5

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050407

I couldn´t produce a crash with one Bugzilla bug in two tabs, or one bug +
tinderboxes + bugs today + checkins.
The bug is seen when I open a Bug and a textfile, like Bug 289292 and Bug 289292
Attachment 179843 [details], place the cursor in the Additional Comments: box, and delete
the tab. It instantly crashes, DocWatson is telling me some labels, but Talkback
doesn´t come up, though it is working on other bugs. 

Comment 6

[Nickolay_Ponomarev]

This is a duplicate of bug 289379 really, similar stack.

Comment 7

[Frank Wein [:mcsmurf]]

Lets recheck this bug, when Bug 289379 gets fixed.

Comment 8

[Asa Dotzler [:asa]]

->bz to resolve or dupe if he thinks it's the same or fixed by the same fix.

Comment 9

[Jo Hermans]

Attachment: mac stacktrace

Just experienced the same bug on Mac OS X when closing a tab (on
<http://webmail.spamcop.net/>, but I couldn't repeat it)
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050408
Firefox/1.0+

Comment 10

[Boris Zbarsky [:bzbarsky]]

Reassigning to try to avoid the bugspam... Will probably just dup once the patch
in bug 289379 has reviews and lands.

Comment 11

[Peter van der Woude [:Peter6]]

*** Bug 289759 has been marked as a duplicate of this bug. ***

Comment 12

[Jo Hermans]

*** Bug 289871 has been marked as a duplicate of this bug. ***

Comment 13

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050411
Firefox/1.0+ 11:38PDT (patch bug 289379 included)

the checkin for bug 289379 has fixed this for me

Comment 14

[Boris Zbarsky [:bzbarsky]]

I'm assuming that the steps in comment 0 meant "close tab buy hitting 'C-w'"
(instead of, say, hitting the little X with the mouse).  If so, this is
definitely a dup.

*** This bug has been marked as a duplicate of 289379 ***

Comment 15

[Frank Wein [:mcsmurf]]

(In reply to comment #14)
> I'm assuming that the steps in comment 0 meant "close tab buy hitting 'C-w'"
> (instead of, say, hitting the little X with the mouse).  If so, this is
> definitely a dup.
> 
> *** This bug has been marked as a duplicate of 289379 ***

I used the little X to close it, but as far as i could see from the stacktrace,
it is a dupe.