37032 - crash in nsEventStateManager::PreHandleEvent when clicking link (and resize window?)

Status: VERIFIED DUPLICATE of bug 41116

(Core :: Layout, defect, P3)

Description

[hudacko]

build 2000033112
At the above URL, click on "technical details) and it should launch acrobat
reader (I have 4.0);
this is hanging  or giving an app error.

If the above URL does not work, try http://www.ipservices.att.com/ipaccess/gvpns/

Comment 1

[Andreas Franke (gone)]

Confirming bug. I sent some talkback reports, using M15 on PC/Linux.
The following steps seem to work quite reliably:
1. go to http://www.ipservices.att.com/ipaccess/gvpns/
2. while loading, move the window 
3. click on "technical information"
4. move the window again
5. crash

Build 2000042416 crashes, too. It's in libraptorhtml.so.
I will attach the backtrace. 

Comment 2

[Andreas Franke (gone)]

Attachment: backtrace, PC/Linux, build 2000042416.

Comment 3

[Andreas Franke (gone)]

You can leave out step 2. and replace step 4. by window resize. Thus:
1. load http://www.ipservices.att.com/ipaccess/gvpns/
2. click on "technical information"
3. resize window, crash.

This seems similar to the crash on resize after reload (bug 35643), but the
crash location is different if you select reload from the context menu
and then resize the window. I just notice that bug 35643 has been marked
fixed today, so this should be tested again tomorrow to make sure it's 
something different.

Adding crash keyword, setting severity to critical, slightly modifying
summary (replacing "app err" by "crash" and adding "resize window" hint),
setting OS to All, adding myself to CC.

Comment 4

[Andreas Franke (gone)]

Yes, this is still alive with build 2000042518, 
whereas bug 35643 seems to be fixed.

Comment 5

[Asa Dotzler [:asa]]

sending to Layout for evaluation. 

Comment 6

[troy]

Andrei, the link looks like a link to a PDF file

Comment 7

[Andreas Franke (gone)]

Attachment: better stack trace (including function symbols)

Comment 8

[Andreas Franke (gone)]

The above stack trace is from a 4/28 build. The crash (segv) happens in
#0  nsEventStateManager::PreHandleEvent ()
#1  PresShell::HandleEventInternal ()
#2  PresShell::HandleEvent ()

Replacing "gkhtml.dll" with "nsEventStateManager::PreHandleEvent" in summary.

Comment 9

[av (gone)]

Attachment: Stack trace for Windows

Comment 10

[av (gone)]

It gives couple of warnings on Windows. Stack trace is in the attachment above. 
I do not see any plugin stuff involved. To me looks like network stuff 
reassigning for evaluation.

Comment 11

[Gagan]

not networking, layout->nisheeth

Comment 12

[Andreas Franke (gone)]

*** Bug 40543 has been marked as a duplicate of this bug. ***

Comment 13

[Andreas Franke (gone)]

From bug 40543, which has about the same stack trace, we got a new test case:
1) load http://hive.beehive.de/Beehive/www.beehive.de/Zope/order_html
2) Click on "Click _here_ for the NET Order Form" on the fifth line, and crash.

Comment 14

[Andreas Franke (gone)]

Attachment: testcase.pdf

Comment 15

[ekrock's old account (dead)]

Nom. nsbeta2, recc. nsbeta2+. Crash on clicking HTML 3.2 link. Very bad. b.c. 
with HTML 3.2 key part of b2 criteria.

Comment 16

[Michael La Guardia]

Marking nsbeta2+

Comment 17

[Andreas Franke (gone)]

*** Bug 42969 has been marked as a duplicate of this bug. ***

Comment 18

[Nisheeth Ranjan]

I tried all of the test cases mentioned on this bug report using yesterday's 
NT commercial build and could not reproduce the crash.  I ran into some debug 
assertions that I ignored after which things worked fine.

Marking this bug worksforme.

Comment 19

[Andreas Franke (gone)]

Reopening.

This may well be a linux-only bug. As far as I know, this problem has been
reported only on this platform. It still crashes PC/Linux build 2000062020.
I don't have any PDF-plugin installed.

Steps to reproduce:
1.) mozilla 'http://bugzilla.mozilla.org/show_bug.cgi?id=37032'
2.) click on the testcase.pdf attachment link
3.) resize window

Actual Results:

Document: Done (2.296 secs)
Error loading URL http://bugzilla.mozilla.org/showattachment.cgi?attach_id=9256 
Gdk-Message: Got event for unknown window: 0x3c003d9 [...repeated several times]
Gdk-Message: Got event for unknown window: 0x3c003ea [...repeated several times]
Gdk-Message: Got event for unknown window: 0x3c003fb [...repeated several times]
Gdk-Message: Got event for unknown window: 0x3c0040c [...repeated several times]
Gdk-Message: Got event for unknown window: 0x3c0041d [...repeated several times]
Gdk-Message: Got event for unknown window: 0x3c0042e [...repeated several times]
Gdk-Message: Got event for unknown window: 0x3c0043f [...repeated several times]
Gdk-Message: Got event for unknown window: 0x3c00450 [...repeated several times]
Program received signal SIGSEGV, Segmentation fault.

Comment 20

[Nisheeth Ranjan]

Andreas, I still can't reproduce this.  I am running today's optimized build on 
Linux and I just tried accessing the attachment in it.  The pdf doesn't show up 
because I don't have the plugin installed.  But, the chrome remains responsive.  
Can you download build 2000062212 adn try this test on your linux box and see 
you crash?  Please also post the specs of your computer to this bug report.  
Maybe the crash is timing related and will be easier to reproduce on a machine 
with characteristics similar to your machine.

Thanks for your help!

Comment 21

[Tom Mraz]

The build Linux 2000062220 doesn't crash on the URL, but it stops to redraw the
content area of the mozilla's window.

Comment 22

[Andreas Franke (gone)]

Yes, I see the same as Tom.
Mozilla build 2000062020 crashes, but build 2000062220 does not.
I verified that it's the same behaviour in all cases (URL, testcase.pdf,
duplicated bugs). The remaining problems are:

1) There is no error message at all.
2) The main mozilla content frame is not repainted any more. 

I think there is a bug already for the second issue:
Bug 43268 "Need to redraw dead frames.", a duplicate of 
Bug 5569 "[Webshell] A web shell without a document should display something"

You may want to file a new bug for the remaining problem and mark this one
fixed.

Comment 23

[Andreas Franke (gone)]

Seems that this got fixed by the following checkin:
	06/22/2000 18:54 bryner%uiuc.edu nsEventStateManager.cpp 1.177
	Bulletproofing fix for bug 41116. r=saari.
Seems like this bug and bug 41116 have the exact same root. Would it make
sense to unify them into a single bug by marking one of them duplicate?

Comment 24

[Nisheeth Ranjan]

Marking this as a dup of 41116.  I've filed bug 43620 for the error message not 
showing up and assigned it to Andrei Volkov, the plugin owner.

*** This bug has been marked as a duplicate of 41116 ***

Comment 25

[Tom Everingham]

verified DUP