[FIX]Firefox Deer Park Alpha 1 crashes on specific click sequence with ScrapBook extension [@ 0x00000000][@ nsBoxObject::GetOffsetRect]

RESOLVED FIXED in mozilla1.8beta4

Status

()

Core
XUL
P1
critical
RESOLVED FIXED
13 years ago
7 years ago

People

(Reporter: IU, Assigned: bz)

Tracking

({crash, fixed1.8})

Trunk
mozilla1.8beta4
crash, fixed1.8
Points:
---
Bug Flags:
blocking1.8b5 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

13 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050608 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050608 Firefox/1.0+

If you have the ScrapBook extension installed and you perform a particular click
sequence, Deer Park Alpha 1 will crash.

Note: You will need to follow these instructions *precisely* to be able to
reproduce this. It is reproducibly, but only with certain specific sequences of
actions (right down to the mouse click and location of clicking).

Firefox 1.0.4 is not affected.  Reproduced with ScrapBook versions 0.15.3 or
0.15.4 (latest)

Reproducible: Always

Steps to Reproduce:
1. Install Firefox Deer Park Alpha 1
2. Create a new profile and install ScrapBook - either 0.15.3 or 0.15.4 (latest)
3. After restarting to browser, select Tools --> SrapBook
4. Now is when you need to be precise:
5. In the ScrapBook side panel, single click (and release) the search icon so
that the menu pops up
6. While that menu is still up, move your mouse pointer to a blank region on the
Firefox main menu bar and single click (and release)
7. Select Tools --> ScrapBook
8. At this point, Firefox should have crashed.

Actual Results:  
Firefox crashed

Expected Results:  
The ScrapBook sidebar should have disappeared, and Firefox should not have crashed.



I originally reported this to the ScrapBook extension developer, on June 3;
however, I have received no feedback.  It is difficult for me to tell if this is
a purely ScrapBook issue or if this is a case where a particular combination has
revealed a flaw in Deer Park.

OS version:
Microsoft Windows XP, SP2 + all patches

Reporduced with latest trunk: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8b2) Gecko/20050608 Firefox/1.0+
(Reporter)

Updated

13 years ago
Version: unspecified → Trunk
Can you provide a Talk Back ID please.
(Reporter)

Comment 2

13 years ago
> Can you provide a Talk Back ID please.

Talk Back ID? Where from and how?  I normally don't use Talk Back, but I just
installed it to capture the crash and I cannot find this Talk Back ID you
mention.  I have not sent the crash information; however, if you are unable to
reproduce it and you need such information, please let me know.

Note that I am using Windows XP, SP2; thus, you may need that platform to
reproduce this.
You need to send the crash information when Talk back popups after the crash,
then go to the /components sub direcotry of the firefox program folder and click
on talkback.exe. Then paste the ID number to this bug.
(Reporter)

Comment 4

13 years ago
Done.  Talk Back ID: TB6497692G
can you produce a few talkbacks ?
Summary: Firefox Deer Park Alpha 1 crashes on specific click sequence with ScrapBook extension → Firefox Deer Park Alpha 1 crashes on specific click sequence with ScrapBook extension [@ 0x00000000]
(Reporter)

Comment 6

13 years ago
> can you produce a few talkbacks ?

How many do you need?  Was no one else able to reproduce this?
just to see if the crashes are all the same.
Nope i haven't tried, not using scrapbook
I'm not positive but the talkback looks like this may be due to the changes
introduced by bug 281988.
(Reporter)

Comment 9

13 years ago
I have uploaded two more Talk Backs: TB6508183Y and TB6508212Q

However, I would recommend running through the test scenario.  It is not time
consuming, and it doesn't require that you install ScrapBook in your current
profile, but under a new profile.  At least this way, I would imagine, you
should be better able to eliminate my system from the equation.

Comment 10

13 years ago
reporter: not all developers are willing to trust foreign extensions, as such a
testcase that does not require one is appreciated.

Incident ID: 6508183
Stack Signature	nsBoxObject::GetOffsetRect cbf825fd
Product ID	FirefoxTrunk
Build ID	2005060806
Trigger Time	2005-06-08 16:59:29.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00191128)
URL visited	
User Comments	See Bug 297079 https://bugzilla.mozilla.org/show_bug.cgi?id=297079
Since Last Crash	19457 sec
Total Uptime	20762 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxObject.cpp,
line 196
Stack Trace 	
nsBoxObject::GetOffsetRect 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxObject.cpp,
line 196]
nsBoxObject::GetHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxObject.cpp,
line 326]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2105]
XPC_WN_GetterSetter 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1380]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1178]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1275]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2805]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3295]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1198]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1275]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2891]
JS_SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 2686]
nsXPCWrappedJSClass::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1321]
nsXPCWrappedJS::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsAutoCompleteController::ClosePopup 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp,
line 857]
nsAutoCompleteController::SetInput 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp,
line 115]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2105]
XPC_WN_GetterSetter 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1372]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1178]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1275]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1318]
js_SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2975]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3306]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1198]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1275]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3862]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1396]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsXBLPrototypeHandler::ExecuteHandler 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp,
line 500]
nsXBLEventHandler::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLEventHandler.cpp,
line 85]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1568]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1669]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2193]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2172]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2172]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2068]
nsHTMLInputElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 1382]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 555]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6321]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6167]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2457]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2224]
HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1180]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 6111]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4731]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1472]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0xb4c0 (0x77d4b4c0)
USER32.dll + 0xb50c (0x77d4b50c)
ntdll.dll + 0xeae3 (0x7c90eae3)
nsGlobalWindow::Focus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 2605]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2105]
XPC_WN_CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1348]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1178]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1275]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3862]
Summary: Firefox Deer Park Alpha 1 crashes on specific click sequence with ScrapBook extension [@ 0x00000000] → Firefox Deer Park Alpha 1 crashes on specific click sequence with ScrapBook extension [@ 0x00000000][@ nsBoxObject::GetOffsetRect]

Updated

13 years ago
Component: Extension/Theme Manager → XP Toolkit/Widgets: XUL
Product: Firefox → Core
QA Contact: extension.manager → xptoolkit.xul

Updated

13 years ago
Severity: normal → critical
Keywords: crash
setting New
Status: UNCONFIRMED → NEW
Ever confirmed: true
I managed to reduce the code to this:
<?xml version="1.0" ?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<textbox type="autocomplete"></textbox></window>
This crashes for me, when focusing the textbox and then closing the sidebar.
The type="autocomplete" is necessary to trigger the crash.
It seems to have something to do with this:
http://lxr.mozilla.org/seamonkey/source/toolkit/content/widgets/autocomplete.xml#514
The calling of this.tree.treeBoxObject.height is causing the crash.
Boris, any ideas?
If you ask, I'll try to make a testcase (but it is going to be hard and the
testcase should probably loaded from chrome).
Created attachment 193611 [details] [diff] [review]
Fix
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Attachment #193611 - Flags: superreview?(roc)
Attachment #193611 - Flags: review?(roc)
OS: Windows XP → All
Priority: -- → P1
Hardware: PC → All
Summary: Firefox Deer Park Alpha 1 crashes on specific click sequence with ScrapBook extension [@ 0x00000000][@ nsBoxObject::GetOffsetRect] → [FIX]Firefox Deer Park Alpha 1 crashes on specific click sequence with ScrapBook extension [@ 0x00000000][@ nsBoxObject::GetOffsetRect]
Target Milestone: --- → mozilla1.8beta4
Attachment #193611 - Flags: superreview?(roc)
Attachment #193611 - Flags: superreview+
Attachment #193611 - Flags: review?(roc)
Attachment #193611 - Flags: review+
Comment on attachment 193611 [details] [diff] [review]
Fix

Simple crash fix
Attachment #193611 - Flags: approval1.8b4?
Fixed on trunk.
Status: ASSIGNED → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED

Updated

13 years ago
Attachment #193611 - Flags: approval1.8b4? → approval1.8b4+

Updated

13 years ago
Flags: blocking1.8b4+
Fixed on branch.
Keywords: fixed1.8
(Reporter)

Comment 19

13 years ago
Not resolved.  Can reproduce bug with Branch build: Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050824 Firefox/1.0+ ID:2005082414

I have tested with both Scrapbook 0.15.5 and 0.17.5 alpha and I get the same
crash behavior.  Note: Scrapbook 0.16.0 and 0.17.5 introduce additional problems
like killing the forward/back and refresh toolbar navigation buttons (a bfcache
conflict perchance?).  This is a pretty harsh extension.

I realize, from an earlier comment, that some of you have reservations about
installing extension, but you may very well have to install this one to properly
diagnoze and resolve the issue.

Talkback ID: TB8685675M

Status: RESOLVED → REOPENED
Keywords: fixed1.8
Resolution: FIXED → ---
(In reply to comment #19)
> Not resolved.  Can reproduce bug with Branch build: Mozilla/5.0 (Windows; U;
> Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050824 Firefox/1.0+ ID:2005082414

That build doesn't have the checkin, it was built 2 hours before comment 18 and
bonsai shows the fix is not included in your build. 

Re resolving. Please reopen if you can reproduce with tomorrows nightly build as
that will defently include this fix.
Status: REOPENED → RESOLVED
Last Resolved: 13 years ago13 years ago
Resolution: --- → FIXED
Keywords: fixed1.8

Updated

10 years ago
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
Crash Signature: [@ 0x00000000] [@ nsBoxObject::GetOffsetRect]
You need to log in before you can comment on or make changes to this bug.