355273 - Crash [@nsMacWindow::WindowEventHandler] when selecting Quit from Dock menu while modal javascript dialog displayed

Status: VERIFIED FIXED

(Core Graveyard :: Widget: Mac, defect)

Description

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1) Gecko/20061003 BonEcho/2.0

STR:

1. Type 'javascript: alert(1)' in the URL bar (without the single quotes).
2. Click and hold the mouse on the BonEcho icon in the dock so that the context menu appears.
3. Select 'Quit'.
4. BonEcho will crash.

This does not happen by selecting the 'Quit' menu item from the menu bar, nor when hitting cmd-Q on the keyboard.

Comment 1

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Stack

The JS here is most likely nsCloseAllWindows.js:76, as that's what I've run into on my XULRunner debug build.

Comment 2

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Requesting blocking to get drivers' assessment.

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

This doesn't happen on Firefox 1.5. Regression.

Comment 4

[Ben Turner (not reading bugmail, use the needinfo flag!)]

In XULRunner I'm crashing here:

http://lxr.mozilla.org/mozilla1.8/source/widget/src/mac/nsMacWindow.cpp#926

dereferencing a null pointer. It's weird, though, because 'self' and 'mMacEventHandler' are both valid.

Comment 5

[Adam Guthrie]

I'll bet self->mMacEventHandler isn't, though. ;)

Comment 6

[Ben Turner (not reading bugmail, use the needinfo flag!)]

(In reply to comment #5)
> I'll bet self->mMacEventHandler isn't, though. ;)

It is. That's why it's weird. ;)

I think this stack may either be wrong or we're looking at some sort of race condition. If I break here I can't reproduce the crash. And I've seen some instances where the app shuts down normally even when I'm not in the debugger.

Comment 7

[Marcia Knous [:marcia]]

Attachment: Apple report

Here is the apple crash data from my PPC crash using RC2 candidate, in case it helps.

Comment 8

[Jesse Ruderman]

I think this is the same as bug 355097.

Comment 9

[Josh Aas]

I did some debugging and when you quit with a sheet open like this we are hiding and destroying the sheet after we hide and destroy its parent window.

One way to stop this crash is to hide any sheet children of the parent before hiding the parent. However, while we may want to do that I don't think that code would ever get used if this was handled correctly - we shouldn't be quitting when we have sheets up.

Comment 10

[Mike Connor [:mconnor]]

Not a topcrash, very corner case STR, not going to block on this, 1.8.1.1 possibly

Comment 11

[Daniel Veditz [:dveditz]]

If we get a fix please ask for branch approval, but not looking hopeful.

Comment 12

[Jesse Ruderman]

WFM on trunk.  Selecting "Quit" from the dock icon while there's a modal alert() dialog open just makes Firefox beep.

Comment 13

[Ben Turner (not reading bugmail, use the needinfo flag!)]

(In reply to comment #12)

Yeah, I don't think I ever saw this on trunk.

Comment 15

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Same happens for Thunderbird when closing the account wizard after opening a compose window while no account was created before. See bug 377350.

Comment 16

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Mark, the line where Thunderbird maybe crashes comes from your patch on bug 345564. There you reimported the code which was removed on bug 340592. Does it have something to do with the crash?

Comment 17

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

We get calls to nsMacWindow::WindowEventHandler() on a destroyed window.
Don't ask me why because that shouldn't happen since we call
::DisposeWindow() in the destructor - there shouldn't be any callbacks
after that, but there is.  Explicitly deregistering the event handlers
fixes it (it also seems to fix bug 355097).
The "mMacEventHandler.reset(nsnull)" isn't needed to fix this bug,
it's just a safe-guard in case we have more use-after-free issues...

Comment 18

[Jesse Ruderman]

Where is DisposeWindow defined and implemented?  lxr can't find it.

Comment 19

[Mats Palmgren (inactive)]

I think it's this one:
http://developer.apple.com/documentation/mac/Toolbox/Toolbox-258.html

Comment 20

[Josh Aas]

Comment on attachment 272505 [details] [diff] [review]
Patch rev. 1

+  , mScrollEventHandler(0)
+  , mWindowEventHandler(0)

For consistency, please set these to NULL (not 0 or nsnull, which we use for gecko object pointers, this distinction being used for readability).

Comment 21

[Mats Palmgren (inactive)]

Comment on attachment 272505 [details] [diff] [review]
Patch rev. 1

sr for branches please.

Comment 22

[Daniel Veditz [:dveditz]]

Comment on attachment 272505 [details] [diff] [review]
Patch rev. 1

Only approving blocking bugs for 1.8.1.6

Comment 23

[Daniel Veditz [:dveditz]]

Comment on attachment 272505 [details] [diff] [review]
Patch rev. 1

approved for 1.8.1.7, a=dveditz for release-drivers

Comment 24

[Mats Palmgren (inactive)]

MOZILLA_1_8_BRANCH
mozilla/widget/src/mac/nsMacWindow.cpp 	1.158.2.29
mozilla/widget/src/mac/nsMacWindow.h 	1.58.2.9 

-> FIXED

Comment 25

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.7 using Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.7pre) Gecko/2007090303 BonEcho/2.0.0.7pre

no crash on steps to reproduce from this bug - adding verified keyword

Comment 26

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Works fine with latest 1.8 branch builds. For Firefox 3 it's not possible anymore to close the application over the dock. I filed bug 410170 to cover this issue.

Comment 27

[Marcia Knous [:marcia]]

https://litmus.mozilla.org/show_test.cgi?id=5202 has been added to the 2.0 test suite, 3.0 pending depending on behavior change.