339406 - Stack overflow crash mousing over DOM Inspector via nsEventStateManager::NotifyMouseOver

Status: RESOLVED WORKSFORME

(Core :: DOM: Events, defect)

Description

[Alex Vincent [:WeirdAl]]

SeaMonkey trunk, Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060526 SeaMonkey/1.5a

Steps to reproduce:
(1) Load http://www.mozilla.org/projects/seamonkey/start/
(2) Ctrl+Shift+I
(3) Move mouse over DOM Inspector, left hand panel.

Expected results:
Normal behavior.

Actual result:
Stack overflow crash.

At nsEventStateManager::NotifyMouseOver(), I set a breakpoint (line 2695), conditional on aContent == docContent.  When I hit that breakpoint, we're about to enter a death spiral, and the pieces of the stack needed for debugging fall off the map.  Here's the stack from that breakpoint:

>	gklayout.dll!nsEventStateManager::NotifyMouseOver(nsGUIEvent * aEvent=0x0012f7b0, nsIContent * aContent=0x035d3040)  Line 2695	C++
 	gklayout.dll!nsEventStateManager::NotifyMouseOver(nsGUIEvent * aEvent=0x0012f7b0, nsIContent * aContent=0x03681458)  Line 2707	C++
 	gklayout.dll!nsEventStateManager::GenerateMouseEnterExit(nsGUIEvent * aEvent=0x0012f7b0)  Line 2757	C++
 	gklayout.dll!nsEventStateManager::PreHandleEvent(nsPresContext * aPresContext=0x03559cf0, nsEvent * aEvent=0x0012f7b0, nsIFrame * aTargetFrame=0x03672b84, nsEventStatus * aStatus=0x0012f574, nsIView * aView=0x03096bf8)  Line 512	C++
 	gklayout.dll!PresShell::HandleEventInternal(nsEvent * aEvent=0x0012f7b0, nsIView * aView=0x03096bf8, nsEventStatus * aStatus=0x0012f574)  Line 6151 + 0x36 bytes	C++
 	gklayout.dll!PresShell::HandlePositionedEvent(nsIView * aView=0x03096bf8, nsIFrame * aTargetFrame=0x03672b84, nsGUIEvent * aEvent=0x0012f7b0, nsEventStatus * aEventStatus=0x0012f574)  Line 6036 + 0x14 bytes	C++
 	gklayout.dll!PresShell::HandleEvent(nsIView * aView=0x03096bf8, nsGUIEvent * aEvent=0x0012f7b0, nsEventStatus * aEventStatus=0x0012f574)  Line 5864 + 0x1b bytes	C++
 	gklayout.dll!nsViewManager::HandleEvent(nsView * aView=0x03096bf8, nsPoint aPoint={...}, nsGUIEvent * aEvent=0x0012f7b0, int aCaptured=0)  Line 1665	C++
 	gklayout.dll!nsViewManager::DispatchEvent(nsGUIEvent * aEvent=0x0012f7b0, nsEventStatus * aStatus=0x0012f69c)  Line 1618 + 0x22 bytes	C++
 	gklayout.dll!HandleEvent(nsGUIEvent * aEvent=0x0012f7b0)  Line 174	C++
 	gkwidget.dll!nsWindow::DispatchEvent(nsGUIEvent * event=0x0012f7b0, nsEventStatus & aStatus=nsEventStatus_eIgnore)  Line 1102 + 0xc bytes	C++
 	gkwidget.dll!nsWindow::DispatchWindowEvent(nsGUIEvent * event=0x0012f7b0)  Line 1123	C++
 	gkwidget.dll!nsWindow::DispatchMouseEvent(unsigned int aEventType=300, unsigned int wParam=0, long lParam=42992075)  Line 5991 + 0x1a bytes	C++
 	gkwidget.dll!ChildWindow::DispatchMouseEvent(unsigned int aEventType=300, unsigned int wParam=0, long lParam=42992075)  Line 6174	C++
 	gkwidget.dll!nsWindow::ProcessMessage(unsigned int msg=512, unsigned int wParam=0, long lParam=42992075, long * aRetValue=0x0012fc1c)  Line 4465 + 0x20 bytes	C++
 	gkwidget.dll!nsWindow::WindowProc(HWND__ * hWnd=0x00070544, unsigned int msg=512, unsigned int wParam=0, long lParam=42992075)  Line 1291 + 0x1d bytes	C++
 	user32.dll!77d48734() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for user32.dll]	
 	user32.dll!77d48816() 	
 	user32.dll!77d489cd() 	
 	user32.dll!77d49402() 	
 	user32.dll!77d48a10() 	
 	gkwidget.dll!nsAppShell::ProcessNextNativeEvent(int mayWait=1)  Line 145 + 0xa bytes	C++
 	gkwidget.dll!nsBaseAppShell::DoProcessNextNativeEvent(int mayWait=1)  Line 136 + 0x11 bytes	C++
 	gkwidget.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr=0x003d91d0, int mayWait=1, unsigned int recursionDepth=0)  Line 231 + 0xf bytes	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012fe04)  Line 472	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x003d91d0, int mayWait=1)  Line 225 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 153 + 0xc bytes	C++
 	appcomps.dll!nsAppStartup::Run()  Line 219	C++
 	seamonkey.exe!main1(int argc=1, char * * argv=0x003d4dd0, nsISupports * nativeApp=0x0098ef10)  Line 1238 + 0x22 bytes	C++
 	seamonkey.exe!main(int argc=1, char * * argv=0x003d4dd0)  Line 1740 + 0x25 bytes	C++
 	seamonkey.exe!__tmainCRTStartup()  Line 586 + 0x19 bytes	C
 	seamonkey.exe!mainCRTStartup()  Line 403	C
 	kernel32.dll!7c816d4f() 	
 	kernel32.dll!7c8399f3()

Comment 1

[Alex Vincent [:WeirdAl]]

aContent is a DOMDocumentType object.

Comment 2

[Alex Vincent [:WeirdAl]]

:( For reasons I can't explain, I can't reproduce this now in a fresh objdir.