336785 - Sunbird crashes when using context menu key after inline editing [@ nsEventListenerManager::PrepareToUseCaretPosition]

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Stefan Sitter [:ssitter]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060505 Mozilla Sunbird/0.3a2 - Build ID: 2006050509

Sunbird crashes when using context menu key after inline editing [@ nsEventListenerManager::PrepareToUseCaretPosition]

Steps to Reproduce:
1. Start Mozilla Sunbird with clean profile
2. Create a test event
3. Click on event to select it
4. Click a second time on event to start inline editing of event title
5. Change title and press Return keyboard key to end inline editing
6. Press the windows context menu keyboard key

Actual Results:
Sunbird crashes immediately

Expected Results:
Views context menu is displayed

Additional Information:
No crash when performing the same steps with Lightning 0.1+ (2006050506) and Mozilla/5.0 (Windows; U; Windows NT 5.0; de; rv:1.8.0.2) Gecko/20060308 Thunderbird/1.5.0.2.

Last message before Sunbird crash in console is:
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file y:\tmp\sb-trunk-dbg\dist\include\xpcom\nsCOMPtr.h, line 849

-----------------------------------------------------------

Stack Backtrace:

gklayout!nsEventListenerManager::PrepareToUseCaretPosition+0x1bd 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventlistenermanager.cpp @ 2055]

gklayout!nsEventListenerManager::FixContextMenuEvent+0x109 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventlistenermanager.cpp @ 1975]

gklayout!nsEventListenerManager::HandleEvent+0xb7 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventlistenermanager.cpp @ 1673]

gklayout!nsEventTargetChainItem::HandleEvent+0x8a 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventdispatcher.cpp @ 335]

gklayout!nsEventTargetChainItem::HandleEventTargetChain+0x99 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventdispatcher.cpp @ 429]

gklayout!nsEventTargetChainItem::CreateChainAndHandleEvent+0x114 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventdispatcher.cpp @ 401]

gklayout!nsEventTargetChainItem::CreateChainAndHandleEvent+0xde 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventdispatcher.cpp @ 392]

gklayout!nsEventTargetChainItem::CreateChainAndHandleEvent+0xde 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventdispatcher.cpp @ 392]

gklayout!nsEventTargetChainItem::CreateChainAndHandleEvent+0xde 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventdispatcher.cpp @ 392]

gklayout!nsEventDispatcher::Dispatch+0x254 
[y:\dev\sb-trunk\mozilla\content\events\src\nseventdispatcher.cpp @ 575]

gklayout!PresShell::HandleEventInternal+0x1de 
[y:\dev\sb-trunk\mozilla\layout\base\nspresshell.cpp @ 6148]

gklayout!PresShell::HandleEvent+0x65b 
[y:\dev\sb-trunk\mozilla\layout\base\nspresshell.cpp @ 5919]

gklayout!nsViewManager::HandleEvent+0x59 
[y:\dev\sb-trunk\mozilla\view\src\nsviewmanager.cpp @ 1712]

gklayout!nsViewManager::DispatchEvent+0xc7d 
[y:\dev\sb-trunk\mozilla\view\src\nsviewmanager.cpp @ 1665]

gklayout!HandleEvent+0x46 
[y:\dev\sb-trunk\mozilla\view\src\nsview.cpp @ 174]

gkwidget!nsWindow::DispatchEvent+0xc1 
[y:\dev\sb-trunk\mozilla\widget\src\windows\nswindow.cpp @ 1103]

gkwidget!nsWindow::DispatchWindowEvent+0x26 
[y:\dev\sb-trunk\mozilla\widget\src\windows\nswindow.cpp @ 1124]

gkwidget!nsWindow::DispatchMouseEvent+0x6b3 
[y:\dev\sb-trunk\mozilla\widget\src\windows\nswindow.cpp @ 5989]

gkwidget!ChildWindow::DispatchMouseEvent+0x93 
[y:\dev\sb-trunk\mozilla\widget\src\windows\nswindow.cpp @ 6172]

gkwidget!nsWindow::ProcessMessage+0xc08 
[y:\dev\sb-trunk\mozilla\widget\src\windows\nswindow.cpp @ 4538]

Comment 1

[Simon Paquet [:sipaq]]

Brett, this crash happens in your code. Any idea what might have caused it?

Comment 2

[Stefan Sitter [:ssitter]]

Retest with different Thunderbird versions:

Lightning + Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.4) Gecko/20060505 Thunderbird/1.5.0.4 - Build ID: 2006050504:
No crash

Lightning + Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8) Gecko/20060505 Thunderbird/2.0a1 - Build ID: 2006050504: 
Crash, Talkback Incident ID: TB18343711E

Lightning + Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060505 Thunderbird/3.0a1 - Build ID: 2006050506: 
Crash, Talkback Incident ID: TB18343864X

Crash also happens in Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20051224 Mozilla Sunbird/0.3a1+. Therefore it does not look like a regression from a recent check in.

Comment 3

[Brett Wilson]

Attachment: Patch for this and a few other cases

Comment 4

[Brett Wilson]

This is a general problem of not checking for NULL for a few functions. I didn't realize they could return NULL but NS_OK.

Comment 5

[Darin Fisher]

Comment on attachment 220974 [details] [diff] [review]
Patch for this and a few other cases

r=darin.  this requires review from a contenet module peer.

Comment 6

[Brett Wilson]

Fixed on trunk and 1.8 branch

Comment 7

[timeless]

i question the value of the comments you're adding (watch out), that should be perfectly clear from the code you leave in the file and the interface. we don't normally include such comments, if we did, there would be millions of them.

Comment 8

[Brett Wilson]

(In reply to comment #7)
> i question the value of the comments you're adding (watch out), that should be
> perfectly clear from the code you leave in the file and the interface. we don't
> normally include such comments, if we did, there would be millions of them.

What on earth are you talking about?

Comment 9

[timeless]

Comment on attachment 220974 [details] [diff] [review]
Patch for this and a few other cases

>Index: nsEventListenerManager.cpp
>+  // caret selection, watch out: GetCaretDOMSelection can return null but NS_OK