346310 - crash clicking on live bookmarks

Status: RESOLVED WORKSFORME

(Core :: Widget: Cocoa, defect)

Description

[Josh Aas]

Cocoa Firefox sometimes crashes when I open up a live bookmark and click on an entry. It does not always crash when I do this, maybe 10% of the time.

Comment 1

[Josh Aas]

Attachment: crash log

Comment 2

[Josh Aas]

This is pretty nasty. Someone is writing over the mMenuParent pointer in nsMenuDismissalListener. The bad mMenuParent value that makes us crash is always 0xddddde19. There is only one place in nsMenuDismissalListener where we assign a value to mMenuParent, in the SetCurrentMenuParent method. Logging before that assignment shows that we never set mMenuParent to anything like 0xddddde19 before the crash. mMenuParent is always initialized to nsnull in the class's constructor, so the problem isn't that we fail to initialize mMenuParent.

Comment 3

[Mark Mentovai]

Set a watchpoint, if you don't mind waiting a day and a half?

Comment 4

[Josh Aas]

I made some good progress tonight. Somehow gRollupListener is getting freed and then we're calling Rollup() on it. When we call Rollup(), we crash on "mMenuParent->HideChain();" because mMenuParent is a pointer to 0xdddddddd (the pattern written to freed memory in debug builds) and HideChain() is at such an offset that we try to access 0xddddde19.

Normally when you open a live bookmark menu and click on an item, Rollup() does not get called. When we crash with [ChildView mouseDown:] on the stack, it is because this check succeeds (returns true) in [CHildView mouseDown:]:

if (ourNativeWindow != rollupNativeWindow)

When this check succeeds, we call Rollup(). The check is there to avoid calling Rollup() if the click is in the popup. The crash happens when we click in the popup and this check is true - that shouldn't happen.

I'm too tired to continue this tonight (its almost 4 AM), I just wanted to record this info here.

Comment 5

[Josh Aas]

I never see this crash any more, haven't for at least a month or two.