296589 - Crash when opening Firefox context menu with java applet context menu open [@ nsViewManager::MoveViewTo]

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[bugzilla.mozilla.org]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

When a java applet fails to load, there is a default context menu that will
appear when the user right clicks where the applet was supposed to be. If the
default Firefox context menu is opened, then the java context menu is opened,
both menus are visible. If the user right clicks on the page again, as if to
open the Firefox context menu, Firefox crashes.

Two pages I have verified this bug with:

http://www.chicago2600.net/java-irc.html
http://www.tools-soft.com/treeicon/

If the pages at the above URLs are fixed, I will try to post some more example
sites or even create my own page.

Reproducible: Always

Steps to Reproduce:
1. Load page with applet that will fail to load.
2. Right click anywhere in page
3. Right click on applet
4. Right click on page again

Actual Results:  
Firefox crashes

Expected Results:  
Firefox should not have crashed

I am running the Java JRE 1.5.0 (build 1.5.0-b64)

Trackback Incident ID TB6373003E:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB6373003E

Comment 1

[bugzilla.mozilla.org]

I have created a testcase on my website:
http://andy.dynamicbits.com/bugzilla.mozilla.org/296589.xhtml

I updated my Java JRE to Version 1.5.0 (build 1.5.0_03-b07) and nothing has
changed in regards to this bug.

Comment 2

[bugzilla.mozilla.org]

I just confirmed this bug on a Windows XP SP1 machine.

Running Firefox 1.0.4, and latest Java JRE (1.5.0 Update 3).

Trackback Incident ID TB6629296H:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB6629296H

Comment 3

[timeless]

Incident ID: 6373003
Stack Signature	nsViewManager::MoveViewTo c3df7df2
Product ID	Firefox10
Build ID	2005051112
Trigger Time	2005-06-03 18:14:26.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	firefox.exe + (001e1f5a)
URL visited
http://www.chicago2600.net/version3/index.php?option=com_wrapper&Itemid=42
User Comments	
Since Last Crash	1407640 sec
Total Uptime	1407640 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2599
Stack Trace 	
nsViewManager::MoveViewTo 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2599]
nsMenuPopupFrame::SyncViewWithFrame 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuPopupFrame.cpp,
line 1203]
nsPopupSetFrame::RepositionPopup 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp,
line 331]
nsPopupSetFrame::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp,
line 230]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsRootBoxFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp,
line 240]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 249]
IncrementalReflow::Dispatch 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 904]
PresShell::ProcessReflowCommands 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6401]
PresShell::FlushPendingNotifications 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5114]
nsDocument::FlushPendingNotifications 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3975]
nsContentTreeOwner::SetStatus 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp,
line 403]
nsPluginInstanceOwner::ShowStatus 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsObjectFrame.cpp,
line 2639]
nsPluginInstanceOwner::ShowStatus 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsObjectFrame.cpp,
line 2606]
nsPluginInstancePeerImpl::ShowStatus 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/modules/plugin/base/src/nsPluginInstancePeer.cpp,
line 284]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x6b41 (0x77e16b41)
USER32.dll + 0x6b64 (0x77e16b64)
PluginWndProc 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp,
line 266]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x4750 (0x77e14750)
USER32.dll + 0x55b0 (0x77e155b0)
ntdll.dll + 0x1ff57 (0x77f9ff57)
nsView::~nsView 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp,
line 165]
nsSplittableFrame::Destroy 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsSplittableFrame.cpp,
line 71]
nsBoxFrame::Destroy 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1065]
nsMenuPopupFrame::Destroy 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuPopupFrame.cpp,
line 2074]
nsCSSFrameConstructor::RecreateFramesForContent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11358]
nsCSSFrameConstructor::AttributeChanged 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 10115]
PresShell::AttributeChanged 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5198]
nsXULElement::UnsetAttr 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2406]
nsPopupSetFrame::DestroyPopup 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp,
line 462]
nsMenuPopupFrame::DismissChain 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuPopupFrame.cpp,
line 1927]
nsMenuDismissalListener::Rollup 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuDismissalListener.cpp,
line 115]
nsWindow::WindowProc 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1318]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppShellService::Run 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
KERNEL32.DLL + 0x2893d (0x7c59893d)

Comment 4

[bugzilla.mozilla.org]

I just tested this bug on a Windows Me machine with the following:

Windows Me (4.90.3000) with all latest patches
Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Java JRE Version 1.5.0 (build 1.5.0_03-b07)

I have some good news and some bad news.
First the good news: Firefox does not crash when recreating this bug.
For the bad news: Firefox still does not behave correctly.

I see two different results of this bug:

To recreate the first:
Right click anywhere on a page (Firefox context menu opens)
Right click on java applet (Java context menu opens, Firefox context menu
remains exactly where it was opened)
Left click anywhere on page (Java context menu closes, old Firefox context menu
closes, new Firefox context menu appears where the left click took place. This
menu is sometimes the default context menu (Back, Forward, Reload, ...) and
sometimes the context menu for the element you clicked on (Open link in new
window, ...) for a link or (Copy, Select All, ...) for highlighted text.)

To recreate the second:
First, open any other application and minimize it.
Right click anywhere on a page (Firefox context menu opens)
Right click on java applet (Java context menu opens, Firefox context menu
remains exactly where it was opened)
ALT+TAB to new window (Other application comes into focus, Firefox context menu
opens on top of the other window, at the current location of the cursor)


I don't think these results deserve their own bug despite the fact that the
behavior is different than in Windows NT. It seems to be the same underlying
cause in all versions of Windows.

Comment 5

[Tanner M. Young [:tmyoung]]

Is this still an issue in Firefox 3.5?

If it is not, we should set the resolution of the bug to WORKSFORME.

Comment 6

[bugzilla.mozilla.org]

This is not an issue with Firefox 3.5.1/Sun Java 1.6.0_13 on Windows XP SP3.
I also tested with Firefox 3.5.1/Sun Java (1.6.x) on Windows 2000 SP4.

There is no longer a context menu when right clicking on the Java applet, so this bug seems to be taken care of.

--
Andy