323617 - Crash on mouse over on a dynamically added menu item in the tabs context menu [@ nsIFrame::MarkDirtyChildren]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Teune van Steeg]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060115 Firefox/1.5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8) Gecko/20060112 Firefox/1.5

With my Duplicate Tab extension (http://twanno.mozdev.org/duplicatetab/) I dynamically add context menu items to the tabs context menu.
It appears that sometimes hovering such a context menu item will crash Firefox. 

The context menu items are added in this way (through javascript):

  var tabbarContextMenu = getBrowser().mStrip.childNodes[1];
  var newItem = document.getElementById("itemID").cloneNode(true);
  newItem.setAttribute("id", "newID");
  tabbarContextMenu.insertBefore(newItem, tabbarContextMenu.childNodes[5]);

One of the context menu items contains a submenu, and I suspect that that menuitem causes the crash on mouseover.


Reproducible: Sometimes

Steps to Reproduce:
1. Dynamically add context menu item(s) to the tab(bar)s context menu manually or by installing Duplicate Tab extension.
2. hover with your mouse over the context menu items
3. 

Actual Results:  
Firefox crashes sometimes

Expected Results:  
Firefox should not crash, continue hovering the context menu items.


TalkbackID: TB13901237G, crash happend on KDE.

The crash was reported on my extensions bugzilla: http://bugzilla.mozdev.org/show_bug.cgi?id=11957

Comment 1

[Steve England [:stevee]]

Sounds a bit like bug 265897

Comment 2

[Teune van Steeg]

Attachment: Talkback report about the crash

Comment 3

[Adam Guthrie]

Incident ID: 13901237
Stack Signature	0x40000000 8d0ea57c
Product ID	Firefox2
Build ID	2006011214
Trigger Time	2006-01-13 02:02:36.0
Platform	LinuxIntel
Operating System	Linux 2.6.14-kanotix-6
Module	
URL visited	
User Comments	
Since Last Crash	1 sec
Total Uptime	1 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	N/A
Stack Trace 	
0x40000000
nsIFrame::MarkDirtyChildren()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 310]
nsMenuFrame::RemoveFrame()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 811]
nsFrameManager::RemoveFrame()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsFrameManager.cpp, line 706]
nsCSSFrameConstructor::ContentRemoved()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9986]
nsCSSFrameConstructor::RecreateFramesForContent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11889]
nsCSSFrameConstructor::RestyleElement()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10433]
nsCSSFrameConstructor::ProcessOneRestyle()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13846]
nsCSSFrameConstructor::AttributeChanged()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10631]
PresShell::AttributeChanged()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp, line 5442]
nsXULDocument::AttributeChanged()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 1136]
nsXULElement::UnsetAttr()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1705]
nsMenuFrame::UngenerateMenu()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 848]
nsMenuFrame::Destroy()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 346]
nsBoxFrame::RemoveFrame()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1179]
nsFrameManager::RemoveFrame()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsFrameManager.cpp, line 706]
nsCSSFrameConstructor::ContentRemoved()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9986]
nsCSSFrameConstructor::RecreateFramesForContent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11889]
nsCSSFrameConstructor::RestyleElement()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10433]
nsCSSFrameConstructor::ProcessOneRestyle()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13846]
nsCSSFrameConstructor::ProcessPendingRestyles()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13890]
nsCSSFrameConstructor::RestyleEvent::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13957]
HandleRestyleEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13967]
PL_HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/plevent.c, line 689]
PL_ProcessPendingEvents()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/plevent.c, line 623]
nsEventQueueImpl::ProcessPendingEvents()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/xpcom/threads/nsEventQueue.cpp, line 421]
event_processor_callback()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 67]
libglib-2.0.so.0 + 0x4ebf7 (0xb7a10bf7)
libglib-2.0.so.0 + 0x25421 (0xb79e7421)
libglib-2.0.so.0 + 0x28687 (0xb79ea687)
libglib-2.0.so.0 + 0x28bd8 (0xb79eabd8)
libgtk-x11-2.0.so.0 + 0x111629 (0xb7c87629)
nsAppShell::Run()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
XRE_main()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2315]
main()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x14ed0 (0xb74fded0)

Comment 4

[[e-mail]]

Sorry, I can't look into bugs that only have a Firefox test case.

Comment 5

[Dan Black]

I'm not sure if this is the same bug or not, but it sounds similar.

Using Firefox or Mozilla (Moz 1.7.12, I believe the latest nightly build -- hard to tell from the website and Mozilla) in Windows (XP), I have similar crashes.

If I right click anywhere in the normal display window to get the contextual menu, then mouse over an item that creates a (contextual) submenu, then quickly select something else in the first menu without giving it time to hide the new submenu, it tends to crash.

I usually have it happen when I'm in Firefox.  I have installed the "Web Developer" extension, which has a "Web Developer" item in the contextual menu, and when you mouse-over that item, it creates a contextual submenu, which is relatively large, and therefore takes longer to pop up and to go away than most contextual menus.  So I start by right-clicking for the submenu, then I accidently mouse-over the "Web Developer" item, then I choose something else from the top-level submenu, while the submenu is still displayed.  Firefox invariably crashes if I haven't waited for the submenu to go away.

Again, note that I did actually download the latest Mozilla build to duplicate the problem, and I was successful in getting it to crash.  One way you can do it without any extra extensions is to find a page with frames, right-click for the contextual menu, get the "This Frame" submenu to display, and quickly move up and choose "Select All" or "Reload" or something instead.  Because that's a smaller menu, and especially if you have a fast machine, you'll have to be quick  to get it to break, but it does do the same thing, so I don't think it has anything to do with the extensions.

I did notice that on Mozilla with the smaller contextual menu ("This Frame"), even when I was able to click on something else before the submenu disappeared, it didn't always crash.  However, if it didn't crash, it _did_ always refuse to display that submenu again until I restarted Mozilla.  In other words, once I pulled the trick on the "This Frame" submenu, I couldn't get that "This Frame" submenu to display again, even on newly loaded pages -- I'd mouse-over "This Frame", but the submenu wouldn't come up.  Then I'd pull the same trick on a different submenu, and then that submenu would be disabled for the rest of my session.  After quitting and restarting Mozilla, they'd work again until I broke them again.  (And sometimes they'd still crash Mozilla entirely, like Firefox.)

Sorry for the long explanation, but I'm hoping the details will help somebody duplicate the problem in their own testing and then figure out what's actually broken so they can fix it.

Comment 6

[Neil Deakin]

Should now be fixed with bug 279703.