364718 - Crash [@ nsXULElement::HandleDOMEvent]

Status: VERIFIED FIXED

(Core :: DOM: Events, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 1977]
PresShell::HandleDOMEventWithTarget  [mozilla/layout/base/nsPresShell.cpp, line 6524]
nsButtonBoxFrame::DoMouseClick  [mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp, line 182]
nsButtonBoxFrame::MouseClicked  [mozilla/layout/xul/base/src/nsButtonBoxFrame.h, line 61]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6466]
PresShell::HandleEventWithTarget  [mozilla/layout/base/nsPresShell.cpp, line 6323]
nsEventStateManager::CheckForAndDispatchClick  [mozilla/content/events/src/nsEventStateManager.cpp, line 3207]
nsEventStateManager::PostHandleEvent  [mozilla/content/events/src/nsEventStateManager.cpp, line 2170]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6497]
PresShell::HandleEvent  [mozilla/layout/base/nsPresShell.cpp, line 6261]
nsViewManager::HandleEvent  [mozilla/view/src/nsViewManager.cpp, line 2559]
nsViewManager::DispatchEvent  [mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 1389]
nsWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 6433]
ChildWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 6680]

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

That stack trace was from 1.8 TB

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch

xulcommand event dispatching is strange anyway, so I guess
it is ok to not to allow dispatching it when xul element isn't 
in DOM.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

There is a testcase for this in bug 364720, but that works only with the
patch in bug 364720.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 249432 [details] [diff] [review]
proposed patch

This crash shows up in ff2 crasher list, and may also happen in 1.8.0.x

Comment 5

[Jay Patel [:jay]]

Comment on attachment 249432 [details] [diff] [review]
proposed patch

Approved for both branches, a=jay for drivers.

Comment 6

[Tony Chung [:tchung]]

hi smaug, can you add more details to this bug on how to verify this fix?  I tried launching the attachment in bug 364720 but not much i could do with reproing it to crash. also, your initial comments says the stack trace is in TB, but the crash attachment test case is for firefox?   Which is it?  Thanks

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

On trunk you can use the testcase in bug 364720, and if using debug build, you'll see warning:
WARNING: NS_ENSURE_TRUE(domDoc) failed: file /home/smaug/mozilla/mozilla_cvs/mozilla/content/xul/content/src/nsXULElement.cpp, line 1561
If the testcase doesn't crash this bug is fixed.

Not sure how to test this on branches.

Btw, when I say a stack trace is in TB, I mean talkback, not thunderbird ;) Currently this is #164 in 2.0.0.1 crasher list.
http://talkback-public.mozilla.org/reports/firefox/FF2001/FF2001-topcrashers.html

Comment 8

[Martijn Wargers (dead)]

Verified fixed on trunk, I'm indeed seeing the warning in my debug build when using the testcase in bug 364720 as mentioned in comment 7.

I've verified that the patch went in the branches by looking at the branch logs.