304151 - crash when drag&dropping a selected text URL to content view [@ OLE32.DLL - nsNativeDragTarget::ProcessDrag]

Status: RESOLVED WONTFIX

(Core :: Widget: Win32, defect, P4)

Description

[Benoît]

At random, when you drag a text URL (on a page, in a textbox, in the location)
that you selected to the status bar or the content view and drop it there, so
that it takes you to the URL, SeaMonkey crashes.

TB stacks: TB8248619H, TB8088682K, TB7890388X

The first time this bug occurred was as far back as 10 June, but the old stacks
have been deleted from the database, unfortunately.

Comment 1

[Benoît]

Also happens with dragging a hyperlink:

TB8576036G

Comment 2

[timeless]

Incident ID: 8576036
Stack Signature	0x11d2aa7c f1e93b20
Product ID	MozillaTrunk
Build ID	2005081205
Trigger Time	2005-08-21 08:36:20.0
Platform	Win32
Operating System	Windows 95 4.0 build 67306684
Module	
URL visited	http://
User Comments	
Since Last Crash	16742 sec
Total Uptime	244147 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x11d2aa7c
OLE32.DLL + 0x1a477 (0x65f1a477)
OLE32.DLL + 0x1a4d8 (0x65f1a4d8)
OLE32.DLL + 0x2f546 (0x65f2f546)
nsNativeDragTarget::ProcessDrag 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsNativeDragTarget.cpp,
line 227]
nsNativeDragTarget::Drop 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsNativeDragTarget.cpp,
line 360]
OLE32.DLL + 0x9de51 (0x65f9de51)
OLE32.DLL + 0x5390d (0x65f5390d)
OLE32.DLL + 0x53516 (0x65f53516)
OLE32.DLL + 0x52f82 (0x65f52f82)
OLE32.DLL + 0x534c2 (0x65f534c2)
nsDragService::StartInvokingDragSession 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp,
line 188]
nsDragService::InvokeDragSession 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp,
line 149]
nsContentAreaDragDrop::DragGesture 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsContentAreaDragDrop.cpp,
line 806]
DispatchToInterface 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 136]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1691]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2201]
nsXULElement::HandleChromeEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2881]
nsGlobalWindow::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 1269]
nsDocument::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 4143]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2167]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2159]
nsGenericHTMLElement::HandleDOMEventForAnchors 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1490]
nsHTMLAnchorElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLAnchorElement.cpp,
line 293]
nsGenericDOMDataNode::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericDOMDataNode.cpp,
line 802]
nsEventStateManager::GenerateDragGesture 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1612]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 520]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6360]
PresShell::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6199]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2559]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2246]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1250]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5974]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 6225]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1427]
KERNEL32.DLL + 0x35d9 (0xbff735d9)
KERNEL32.DLL + 0x2222f (0xbff9222f)
0x00638bec

Comment 3

[Benoît]

This crash doesn't occur anymore, strangely enough. Instead, it generates an
error displayed in the JavaScript Console:

Error: [Exception... "Component returned failure code: 0x80004005
(NS_ERROR_FAILURE) [nsITransferable.getAnyTransferData]"  nsresult: "0x80004005
(NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://global/content/nsTransferable.js :: anonymous :: line 132"  data: no]
Source File: chrome://global/content/nsTransferable.js
Line: 132

Mozilla/5.0 (Windows; U; Win95; en-US; rv:1.8b4) Gecko/20050918 SeaMonkey/1.0a

Comment 4

[Wayne Mery (:wsmwk)]

SM XP (I don't have a 95 machine to test), no crash, javascript sconsole "Error:
setting a property that has only a getter"
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050810
SeaMonkey/1.0a

I don't understand your steps. I have never known status bar at bottom of
browser window to accept drops - do you mean navigation bar, below "file edit
..." at the top?  

Comment 5

[Benoît]

No, I really mean the status bar.

I did some more testing.

A new profile doesn't show the error, and the status bar doesn't accept drops.
Going back to my regular profile, I discovered that the error only shows up if
you drop on the status bar.

Now, this was pretty odd. So I made a new profile, installed Adblock, and just
as I suspected, the status bar now accepts drops and generates an error message.

Comment 6

[Benoît]

I don't see this anymore, and it's been about a month since the last crash.
-> WORKSFORME

Comment 7

[Benoît]

I just got a crash again because of this bug. I don't have a Talkback since I'm
using one without a TalkBack Agent...

ID: 2005102109

Reworded the summary. I left out the status bar because that's caused by the
Adblock extension.

Comment 8

[Adam Guthrie]

Benoît, a fresh talkback ID would be useful. It might be crashing in a different place now.

Comment 9

[Benoît]

Kind of hard since the crash is random, and I'm using a contributed build. But I'll see what I can do.

Though I wonder if it's worth it, since this bug is largely unnoticed...

Comment 10

[Benoît]

A year later, and I still see it from time to time. But since TalkBack is proprietary, it's not shipped with SeaMonkey on branch, so I can't provide new TalkBack reports. And I can't run trunk.

Comment 11

[Wayne Mery (:wsmwk)]

Still see the problem with latest SM 1.x?

Comment 12

[Benoît]

I don't know if it's still there in SeaMonkey 1.1.8, as I yet have to download and install it. It's still there with 1.1.7, though.

Comment 13

[Wayne Mery (:wsmwk)]

unable to recreate on XP with SM trunk, after 30 various text urls dragged from text in browser to tab bar and url bar.  Didn't try 1.x.  

What is rate of crashing - 1 in 30?  1 in 100?
Does it behave now, in the precisely the same way in terms of timing, etc, as it did 2.5 years ago?

Some examples of text URLs which have crashed might help (however unlikely it might be).

Comment 14

[Benoît]

It still behaves the same, yes. 1 in 30 sounds about accurate. I get this crash most of the time when browsing for adult content, as I tend to paste URLs regularly then so they don't get added to the location bar dropdown list.

I just got a crash with this URL: http://www.x-ladies.net/content/x-ladies-090/1.jpg (warning: adult content)

Since there is no TalkBack, the best I can do is give the info that Windows gives me. It's in Dutch. English: SEAMONKEY has caused an error relating to an invalid page in module <unknown>.

SEAMONKEY heeft een fout met betrekking tot een ongeldige pagina veroorzaakt in
module <onbekend> op0000:11d2aa7c.
Registers:
EAX=0064edd8 CS=0157 EIP=11d2aa7c EFLGS=00010216
EBX=01c1d570 SS=015f ESP=0064ebf0 EBP=0064ec20
ECX=0064ee28 DS=015f ESI=00000000 FS=0e2f
EDX=0042001c ES=015f EDI=605e8114 GS=0000
Bytes in CS:EIP:

Stackdump:
65f3f96e 01c1d570 00000001 0064edd8 00000000 00000000 01c1d570 00000001 c1aa0002 00060000 17272c18 bff714d9 0064ede0 65f38a35 01c1d570 00000001

Comment 15

[Wayne Mery (:wsmwk)]

unfortunately, without some strong link to another bug with similar symptoms [1] or stack based on symbols, and whereas it doesn't seem to be reproducible by others (at least not on systems newer than w9x), I don't see any hope for this bug.  Changing version to most recent where it is seen.

[1] https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&short_desc_type=anywordssubstr&short_desc=drag+drop&product=Core&product=Firefox&product=Mozilla+Application+Suite&product=NSPR&product=Thunderbird&product=Toolkit&long_desc_type=allwordssubstr&long_desc=&bug_file_loc_type=allwordssubstr&bug_file_loc=&status_whiteboard_type=allwordssubstr&status_whiteboard=&keywords_type=allwords&keywords=&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=RESOLVED&bug_status=VERIFIED&bug_status=CLOSED&resolution=FIXED&resolution=---&emailreporter1=1&emailtype1=substring&email1=&emailassigned_to2=1&emailreporter2=1&emailqa_contact2=1&emailtype2=substring&email2=&bugidtype=include&bug_id=&votes=&chfieldfrom=1100d&chfieldto=Now&chfieldvalue=&cmdtype=doit&order=Reuse+same+sort+as+last+time&field0-0-0=short_desc&type0-0-0=substring&value0-0-0=crash&field0-1-0=short_desc&type0-1-0=anywordssubstr&value0-1-0=text+select+URL&field0-2-0=short_desc&type0-2-0=nowordssubstr&value0-2-0=dropdown+&field0-3-0=short_desc&type0-3-0=notsubstring&value0-3-0=drop+down

Comment 16

[Benoît]

I would like an explanation as to why a CRASH BUG is marked as "normal" severity/importance.

Comment 17

[Jim Mathies [:jimm]]

(In reply to comment #16)
> I would like an explanation as to why a CRASH BUG is marked as "normal"
> severity/importance.

Well it's a crash bug in an operating system we no longer officially support. I suppose we could change it back, I was just trying to clean up some bug lists by setting what seemed appropriate priorities.

Comment 18

[Wayne Mery (:wsmwk)]

severity <> priority.
resetting to sev=critical
however, there's not much hope for this bug unless you can reproduce in SM 2.x on something other than w9x