327353 - Crash when dispatching dirty events from setTimeout

Status: RESOLVED WORKSFORME

(Core :: DOM: Events, defect)

Description

[Bjoern Hoehrmann]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9a1) Gecko/20060204 Firefox/1.6a1

Mozilla crashes when clicking the text in the test case. The setTimeout can be increased and the event re-initialized using .initEvent e.g. so it does not bubble anymore and it still crashes. Clicking quickly after (re-)loading is typically necessary though. It seems it's trying to read random memory...

Reproducible: Sometimes

Steps to Reproduce:

Comment 1

[Bjoern Hoehrmann]

Attachment: Test case

Comment 2

[Martijn Wargers (dead)]

Well, I can't reproduce with current trunk build.
Did you get a Talkback ID? If you did, could you post it here?

Comment 3

[Bjoern Hoehrmann]

Might have been fixed somewhere between 20060204 and 20060213 trunk builds, I can't reproduce it either with the latter...

Comment 4

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060214 SeaMonkey/1.5a
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060212 Firefox/1.6a1

There are currently 31438 incidents waiting to be processed by the Talkback server
Seamonkey: TB15254010E Firefox: TB15254189H 

Comment 5

[Martijn Wargers (dead)]

Ok, the 2 talkback ID's look the same:

nsRefPtr<nsGenericHTMLElement>::assign_assuming_AddRef  [../../../../dist/include/xpcom/nsAutoPtr.h, line 944]
nsGenericHTMLElement::HandleDOMEventForAnchors  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1478]
nsHTMLLinkElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLLinkElement.cpp, line 336]
nsEventStateManager::DispatchNewEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 4628]
nsEventListenerManager::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 2120]
nsDOMEventRTTearoff::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 698]
XPTC_InvokeByIndex  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1246]
js_Interpret  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3886]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1270]
js_InternalInvoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1347]
JS_CallFunctionValue  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 4176]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1424]
nsGlobalWindow::RunTimeout  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6195]
nsGlobalWindow::TimerCallback  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6565]
nsAppStartup::Run  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp, line 208]
main  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1748]
WinMain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1772]
KERNEL32.DLL + 0x1b537 (0xbff8b537)
KERNEL32.DLL + 0x1b3e9 (0xbff8b3e9)
KERNEL32.DLL + 0x19dac (0xbff89dac)
0x162f0100

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

afaik, this was fixed as a part of event dispatching rewrite.
(Both TB entries are still using old code)