334966 - Crash when calling context menupopup (without xul namespace) defined in XBL [@ XULPopupListenerImpl::LaunchPopup]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Philip Chee]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060413 SeaMonkey/1.5a Mnenhy/0.7.3.0

Writing an extension that uses a XBL binding. Inside the binding is a context menu. Trying to invoke the context menu using a right click triggers a crash.
Even if my XBL syntax is wrong, I should get an error message and not a crash.

I looked at some recent bugs but this stack trace does not appear to match recent context menu crashes.

Talkback ID: TB17810405Q

Stack Signature	 XULPopupListenerImpl::LaunchPopup 1f92f498
Product ID	MozillaTrunk
Build ID	2006041308
Trigger Time	2006-04-21 08:52:49.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	gklayout.dll + (001b30bb)
URL visited	
User Comments	
Since Last Crash	18383 sec
Total Uptime	159374 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULPopupListener.cpp, line 614
Stack Trace 	
XULPopupListenerImpl::LaunchPopup  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULPopupListener.cpp, line 614]
XULPopupListenerImpl::LaunchPopup  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULPopupListener.cpp, line 435]
XULPopupListenerImpl::PreLaunchPopup  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULPopupListener.cpp, line 300]
XULPopupListenerImpl::ContextMenu  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULPopupListener.cpp, line 201]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1730]
nsEventTargetChainItem::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 335]
nsEventTargetChainItem::HandleEventTargetChain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 478]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 405]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventDispatcher::Dispatch  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 575]
PresShell::HandleEventInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6130]
PresShell::HandlePositionedEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6005]
PresShell::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5833]
nsViewManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1712]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1665]
HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1100]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6095]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6277]
nsWindow::WindowProc  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1289]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0xb368 (0x77d4b368)
USER32.dll + 0xb3b4 (0x77d4b3b4)
ntdll.dll + 0xeae3 (0x7c90eae3)
USER32.dll + 0xb2a1 (0x77d4b2a1)
USER32.dll + 0xb23c (0x77d4b23c)
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0xc00e (0x77d4c00e)
USER32.dll + 0xc034 (0x77d4c034)
nsWindow::WindowProc  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1296]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0x89a5 (0x77d489a5)
USER32.dll + 0x89e8 (0x77d489e8)
nsAppShell::Run  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp, line 208]
main  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1750]
WinMain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1774]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 1

[Philip Chee]

This is the XBL that causes the crash:

<?xml version="1.0"?>

<bindings id="pageInfoBindings"
          xmlns="http://www.mozilla.org/xbl"
          xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
          xmlns:xbl="http://www.mozilla.org/xbl">

  <binding id="tabs-scrollbuttons" display="xul:box"
           extends="chrome://global/content/bindings/tabbox.xml#tabs">
    <content>
      <xul:stack>
        <xul:spacer class="tabs-left"/>
        <xul:hbox class="scroll-widget"
                  contextmenu="_child"
                  flex="1"
                  align="center">
    <menupopup>
      <menuitem id="xsb-item1"
                label="xsb-item1"
                type="radio"
                />
    </menupopup>
          <xul:image xbl:inherits="onclick=ontableft"
                     class="tabs-scrollbutton tabs-scrollbutton-previous"/>
          <xul:image xbl:inherits="onclick=ontabright"
                     class="tabs-scrollbutton tabs-scrollbutton-next"/>
        </xul:hbox>
      </xul:stack>
      <children/>
      <xul:spacer class="tabs-right" flex="1"/>
    </content>
  </binding>

</bindings>

Comment 2

[Neil Deakin]

You have the menupopup without the XUL namespace.

Looks like http://lxr.mozilla.org/mozilla/source/content/xul/content/src/nsXULPopupListener.cpp#613 doesn't check to make the popup really is a XUL element.

Comment 3

[Philip Chee]

Ooops. Too much cut and paste. I guess this bug is invalid then.

Comment 4

[Martijn Wargers (dead)]

No, this is not invalid. Mozilla should not crash.
I guess a minimal testcase that shows the crash might be useful.

Comment 5

[Philip Chee]

> I guess a minimal testcase that shows the crash might be useful.

Bind the xbl in comment 1 to the <tabs> element in pageInfo.xul:

tabs#tabs {
  -moz-binding: url("chrome://xsidebar/content/pageinfo/pageinfo.xml#tabs-scrollbuttons");
}

Invoke the pageinfo window. Right click on the xbl widget. See browser crash.

Comment 6

[Nickolay_Ponomarev]

That's not a minimal testcase though. A minimal testcase would be a single XUL file with required XBL inline.

Comment 7

[Philip Chee]

How do you inline an XBL file? Without using XBL2 I mean.

Comment 8

[Nickolay_Ponomarev]

you can put the <bindings> element right in the XUL file, providede you put it in an appropriate namespace see attachment 169709 [details] (or almost any other testcase for XBL bugs) for an example.

Comment 9

[Neil Deakin]

Don't worry too much about a testcase here, since we already know what the fix is. The correct fix is to change nsXULPopupListener.cpp to null-check before retrieving the boxObject, or to get the box object from the document.

Comment 10

[Ostap Bender]

*** Bug 358476 has been marked as a duplicate of this bug. ***

Comment 11

[Neil Deakin]

Should now be fixed with bug 279703.