378691 - crash [@ nsMenuBarFrame::ToggleMenuActiveState] because mCurrentMenu was nulled

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[timeless]

this crash is in an opt firefox from mar 6 (not sure about the source tree date,  i just updated my tree apr 24 and managed to lose the old cvsco.log)

steps to reproduce (from memory):
accidentally close a tab
try to use the history>recently closed tabs> menus to get the tab back
for some reason some part of history had two separators adjacent to each other
beyond that, neil (not the assignee neil) suggested the problem related to the menus and dialogs (fwiw, frame 0x46 has the same this as frame 0x00).

All I know is that I'm crashing at mCurrentMenu->SelectMenu(PR_FALSE); because:
0:000> dv
           this = 0x038bcf54
0:000> dt gklayout!nsMenuBarFrame 0x038bcf54 mCurrentMenu
   +0x078 mCurrentMenu : (null) 

nsMenuBarFrame::ToggleMenuActiveState()
{
  if (mIsActive) {
    // Deactivate the menu bar
    SetActive(PR_FALSE);
    if (mCurrentMenu) {
      // Deactivate the menu.
      mCurrentMenu->OpenMenu(PR_FALSE);
      mCurrentMenu->SelectMenu(PR_FALSE);
      mCurrentMenu = nsnull;
    }
  }


gklayout!nsMenuBarFrame::ToggleMenuActiveState+0x53
gklayout!nsMenuBarListener::Blur+0x45
gklayout!DispatchToInterface+0x3e
gklayout!nsEventListenerManager::HandleEvent+0x398
gklayout!nsEventTargetChainItem::HandleEvent+0xae
gklayout!nsEventTargetChainItem::HandleEventTargetChain+0x99
gklayout!nsEventDispatcher::Dispatch+0x2c8
gklayout!nsEventStateManager::SendFocusBlur+0x6c2
gklayout!nsEventStateManager::SetContentState+0x3ec
gklayout!nsXULElement::SetFocus+0x3b
gklayout!nsXULElement::Focus+0x93
xpcom_core!NS_InvokeByIndex+0x27
xpc3250!XPCWrappedNative::CallMethod+0xda8
xpc3250!XPCWrappedNative::CallMethod+0xda8
xpc3250!XPC_WN_CallMethod+0x127
js3250!js_Invoke+0x8cc
js3250!js_Interpret+0x8456
js3250!js_Invoke+0x929
js3250!js_InternalInvoke+0xe4
js3250!JS_CallFunctionValue+0x23
gklayout!nsJSContext::CallEventHandler+0x3c0
gklayout!nsJSEventListener::HandleEvent+0xbba
gklayout!nsEventListenerManager::HandleEventSubType+0x19f
gklayout!nsEventListenerManager::HandleEvent+0x3c6
gklayout!nsEventTargetChainItem::HandleEvent+0xae
gklayout!nsEventTargetChainItem::HandleEventTargetChain+0x142
gklayout!nsEventDispatcher::Dispatch+0x2c8
gklayout!DocumentViewerImpl::LoadComplete+0x15a
docshell!nsDocShell::EndPageLoad+0x7c
docshell!nsWebShell::EndPageLoad+0x11c
docshell!nsDocShell::OnStateChange+0x3a3
docshell!nsDocLoader::FireOnStateChange+0x145
docshell!nsDocLoader::doStopDocumentLoad+0x3a
docshell!nsDocLoader::DocLoaderIsEmpty+0xf2
docshell!nsDocLoader::OnStopRequest+0x28d
necko!nsLoadGroup::RemoveRequest+0x137
jar50!nsJARChannel::OnStopRequest+0xb1
necko!nsInputStreamPump::OnStateStop+0xb7
necko!nsInputStreamPump::OnInputStreamReady+0x6c
xpcom_core!nsInputStreamReadyEvent::Run+0x4a
xpcom_core!nsThread::ProcessNextEvent+0x12a
xpcom_core!NS_ProcessNextEvent_P+0x3f
appshell!nsXULWindow::ShowModal+0x12f
appshell!nsContentTreeOwner::ShowAsModal+0x33
embedcomponents!nsWindowWatcher::OpenWindowJSInternal+0x1931
embedcomponents!nsWindowWatcher::OpenWindow+0x385
embedcomponents!nsPromptService::DoDialog+0x115
embedcomponents!nsPromptService::Alert+0x1c5
xpcom_core!NS_InvokeByIndex+0x27
xpc3250!AutoJSSuspendRequest::SuspendRequest+0x28
xpc3250!XPCWrappedNative::CallMethod+0xda8
xpc3250!XPC_WN_CallMethod+0x127
js3250!js_Invoke+0x8cc
js3250!js_Interpret+0x8456
js3250!js_Invoke+0x929
js3250!js_InternalInvoke+0xe4
js3250!JS_CallFunctionValue+0x23
gklayout!nsJSContext::CallEventHandler+0x3c0
gklayout!nsJSEventListener::HandleEvent+0xbba
gklayout!nsXBLPrototypeHandler::ExecuteHandler+0x1463
gklayout!nsXBLEventHandler::HandleEvent+0xd4
gklayout!nsEventListenerManager::HandleEventSubType+0x19f
gklayout!nsEventListenerManager::HandleEvent+0x3c6
gklayout!nsEventTargetChainItem::HandleEvent+0xae
gklayout!nsEventTargetChainItem::HandleEventTargetChain+0x142
gklayout!nsEventDispatcher::Dispatch+0x2c8
gklayout!PresShell::HandleDOMEventWithTarget+0x54
gklayout!nsMenuFrame::OnDestroyed+0x9a
gklayout!nsMenuFrame::OpenMenuInternal+0x8c8
gklayout!nsMenuFrame::OpenMenu+0x13f
gklayout!nsMenuBarFrame::SetCurrentMenuItem+0xba
gklayout!nsMenuBarFrame::DismissChain+0x2a
gklayout!nsMenuListener::KeyDown+0x13e
gklayout!DispatchToInterface+0x3e
gklayout!nsEventListenerManager::HandleEvent+0x398
gklayout!nsEventTargetChainItem::HandleEvent+0xae
gklayout!nsEventTargetChainItem::HandleEventTargetChain+0x99
gklayout!nsEventDispatcher::Dispatch+0x2c8
gklayout!PresShell::HandleEventInternal+0x197
gklayout!PresShell::HandleEvent+0x732
gklayout!nsViewManager::HandleEvent+0x59
gklayout!nsViewManager::DispatchEvent+0xaa6
gklayout!HandleEvent+0x46
gkwidget!nsWindow::DispatchEvent+0x46
gkwidget!nsWindow::DispatchWindowEvent+0x26
gkwidget!nsWindow::DispatchKeyEvent+0x116
gkwidget!nsWindow::OnKeyDown+0xbf
gkwidget!nsWindow::ProcessMessage+0x886
gkwidget!nsWindow::WindowProc+0x11d
USER32!InternalCallWinProc+0x28
USER32!UserCallWinProcCheckWow+0x150
USER32!DispatchMessageWorker+0x306
USER32!DispatchMessageW+0xf
gkwidget!nsAppShell::ProcessNextNativeEvent+0x85
gkwidget!nsBaseAppShell::DoProcessNextNativeEvent+0x2b
gkwidget!nsBaseAppShell::OnProcessNextEvent+0x53
xpcom_core!nsThread::ProcessNextEvent+0x8b
xpcom_core!NS_ProcessNextEvent_P+0x3f
gkwidget!nsBaseAppShell::Run+0x45
tkitcmps!nsAppStartup::Run+0x41
xul!XRE_main+0x2394
firefox!main+0x16
firefox!WinMain+0x19
firefox!__tmainCRTStartup+0x140
kernel32!BaseProcessStart+0x23

Comment 1

[Adam Guthrie]

This is currently the #8 topcrash on Firefox trunk with > 58 unique users, so it's not just timeless who's hitting this.

Comment 2

[Martijn Wargers (dead)]

I get this crash sometimes.
It happens when I closed down Firefox, but the Firefox.exe process stays alive and eats all cpu. (this happens sporadically)
When I try to start up Firefox again (I see a second Firefox.exe process in the task manager), I don't get to see any bookmarks.
Then, when I try to open the Bookmarks menu, I get the alert assert of bug 380387 and then I crash. Talkback ID: TB32653454H

Comment 3

[Neil Deakin]

Now that the popup reworking is done, we should check to see if this crash still occurs.

Comment 4

[timeless]

the general problem was this:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsMenuBarFrame.cpp&rev=1.160&mark=255,257,256#247
here's a more specific outline:
1. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsMenuBarFrame.cpp&rev=1.160&mark=255#247
1. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsMenuBoxObject.cpp&rev=1.12&mark=104#90
1. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsMenuFrame.cpp&rev=1.350&mark=784#76
2. javascript debugger enters the picture about here and lets things happen again. note that we're firing 253 a second time.
2. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsMenuBarFrame.cpp&rev=1.160&mark=253-257#247
1. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsMenuBarFrame.cpp&rev=1.160&mark=256-257#247

here's the new code path, which seems fine:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsMenuBarFrame.cpp&rev=&cvsroot=/cvsroot&rev=1.161&mark=208,212,125,202,213-215#208

Note that I don't update very often, so it'll take me at least a week before I'm likely to even be using the new code (mxr still doesn't have the new code..)

Comment 5

[Neil Deakin]

This is likely fixed. One of the event listeners called when OpenMenu is called was probably changing the dom is some way. The events are now fired asynchronously so there shouldn't be any dom changes.

Comment 6

[Adam Guthrie]

Yep, it looks like the popup rewrite fixed this. See http://crash-stats.mozilla.com/report/list?range_unit=months&query_search=signature&query_type=contains&branch=1.9&signature=nsMenuBarFrame%3A%3AToggleMenuActiveState()&query=nsMenuBarFrame%3A%3AToggleMenuActiveState&range_value=1.

->FIXED