31563 - Crash: right-click while loading pop-up window

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[Jesse Ruderman]

If you right-click inside an angelfire pop-up window as the pop-up window is 
loading, mozilla crashes.

This is pretty reproducible once you figure out the timing.  Right-click 
quickly after the pop-up window is given a white background, and mozilla will 
crash soon after switching to a grey background.

Build 2000 031115 on Windows 98.

Comment 1

[Jesse Ruderman]

MOZILLA caused an invalid page fault in
module GKHTML.DLL at 015f:60218561.
Registers:
EAX=00000000 CS=015f EIP=60218561 EFLGS=00010246
EBX=0068f014 SS=0167 ESP=0068ed74 EBP=0068edec
ECX=00000000 DS=0167 ESI=00000000 FS=3cdf
EDX=0068edf8 ES=0167 EDI=019ca31c GS=0000
Bytes at CS:EIP:
8b 01 ff 50 58 56 8d 4d 1c 89 45 ec 89 75 1c e8 
Stack dump:
00000000 00000000 0130a8f4 60270648 012e1ea4 0068edac 601a55df 012e1ea4 
00000000 0068eddc 601a6d9c 012e1ea4 00000000 60270648 01a00390 00000000 

Comment 2

[Ryan Massie]

I can't get it to reproduce on 2000031306. You have a crash dump though. Anyone 
else want to try?

Comment 3

[Jesse Ruderman]

I'm still getting this with the old build and with a new build, but I'm getting 
lower reproducability (on both builds) today.  Try right-clicking several times 
as it loads.

Comment 4

[Christine Begle]

[e-mail]: what is the build id of the "new" build you are using?
could not reproduce with 20000032011 on win98. 

Comment 5

[Jesse Ruderman]

I can still get this on the same build you gave (20000032011), but it's taking 
more tries to get it to crash.  I don't know if that's because of changes in 
the new build, changes in my reaction time, or what.

Comment 6

[Asa Dotzler [:asa]]

I played with this for a while and was unable to reproduce with 2000032409 build
under NT.  I'll check it out on my win98 system at home.

Comment 7

[Christine Begle]

there were a bunch of pages that crashed with the same stack trace in
nsWindow::Create, including this one.  i was able to easily reproduce this
yesterday, but am unable to reproduce with builds from today 3-24-2000.

would you try downloading (or rebuilding) today's build and see if you can
reproduce this bug?  if so, please reopen this.

Comment 8

[Jesse Ruderman]

Still crahses if I keep right-clicking quickly while the window loads.  
Reproduced on URL given and on http://www.angelfire.com/ne/LYLee/.  2000032708

Comment 9

[Asa Dotzler [:asa]]

[e-mail] (Asa Dotzler) taking ownership of Browser General bugs. 
 New QA Contact is [e-mail] (Joseph Elwell).  Sorry for the spam.

Comment 10

[Gervase Markham [:gerv]]

[e-mail] - are you _still_ seeing this? ;-) This probably belongs in 
Event Handling if you are, seeing as it's the mouse click which causes the crash.

Gerv

Comment 11

[Alan S. Jones]

I am seeing this on the 4-8-00 build on Win95.

I used a talkback build and sent in the results with this bug nubmer and URL.  
So if someone can grab that data it might help.

I am going to send this bug first to Event Handling.

Comment 12

[Alan S. Jones]

I got some nice Netscape people to send me back my talkback stack strace if that 
will help.

31563: 

 Call Stack:    (Signature = nsMenuPopupFrame::AdjustClientXYForNestedDocuments 
351f8848) 
  
  nsMenuPopupFrame::AdjustClientXYForNestedDocuments 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuPopupFrame.cpp, line 282] 
  
  nsMenuPopupFrame::SyncViewWithFrame 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuPopupFrame.cpp, line 526] 
  
  nsPopupSetFrame::LayoutFinished 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsPopupSetFrame.cpp, line 385] 
  
  nsPopupSetFrame::Layout 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsPopupSetFrame.cpp, line 236] 
  
  nsSprocketLayout::Layout 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 367] 
  
  nsContainerBox::Layout 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 491] 
  
  nsBoxFrame::Layout 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 822] 
  
  nsStackLayout::Layout 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsStackLayout.cpp, line 235] 
  
  nsContainerBox::Layout 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 491] 
  
  nsBoxFrame::Layout 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 822] 
  
  nsBoxFrame::Reflow 
                                                    
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 678] 
  
  nsGfxScrollFrame::Reflow 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
553] 
  
  nsContainerFrame::ReflowChild 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
636] 
  
  ViewportFrame::Reflow 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 545] 
  
  nsHTMLReflowCommand::Dispatch 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line 
145] 
  
  PresShell::ProcessReflowCommands 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2292] 
  
  ReflowEvent::HandleEvent 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2192] 
  
  PL_HandleEvent 
                                                    
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 564] 
  
  PL_ProcessPendingEvents 
                                                    
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 527] 
  
  _md_EventReceiverProc 
                                                    
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1020] 
  
  KERNEL32.DLL + 0x3663 (0xbff73663) 
  
  
  KERNEL32.DLL + 0x228e0 (0xbff928e0) 
  
  
  0x00688bdc 
  

Comment 13

[leger]

Adding crash keyword.

Comment 14

[joki (gone)]

Based on the stack trace I'm going to forward this on to the menu people.  
Sending to saari, cc'ing pink

Comment 15

[Mike Pinkerton (not reading bugmail)]

this looks like mine.

Comment 16

[Mike Pinkerton (not reading bugmail)]

i can't get this to crash, no matter how much i click. can anyone reproduce this? 
I'm on NT, but that shouldn't make that much difference. I also can't reproduce 
this on MacOS.

build from 5pm 5/11/00.

Comment 17

[Mike Pinkerton (not reading bugmail)]

For good measure, i added a lot of error checking to 
AdjustClientXYForNestedDocuments() so it should be all happy now even when it 
can't get view managers or the like. I think that's probably what was happening.

If you still see this problem with builds after 5/12/00, then reopen this bug. 
Thanks.

Comment 18

[Alan S. Jones]

original URL no longer exists :(
davidr8, you know of another url with same problem to verify this is fixed?


pinkerton, can we mark verified if oringal crasher site has changed?

Comment 19

[Mike Pinkerton (not reading bugmail)]

while the page doesn't exist, the popup that crashed things still does.

Comment 20

[Mike Pinkerton (not reading bugmail)]

while the page doesn't exist, the popup that crashed things still does.

Comment 21

[Jan Carpenter]

I can't reproduce this.  Marking verified.