Closed Bug 38136 Opened 24 years ago Closed 24 years ago

menus are broken and crash Mozilla

Categories

(Core :: XUL, defect, P3)

Product:
Core
Component:
XUL
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: cks+mozilla, Assigned: mikepinkerton)

References

Details

(Keywords: crash, regression, smoketest, Whiteboard: dogfood+) 

Sometime between 3pm Pacific May 3rd and circa 9pm or 10pm Pacific (when
I did the CVS pull that built my test snapshot and when I repulled), menus
on the Linux build have stopped working and started crashing.

 The crash appears to happen when the menu should pop down, as show by:

 Reproduction: start Mozilla. Park your mouse cursor over a menu title
until it goes grey. Move your mouse sideways out of the menu's area.
Boom.

 Stack backtrace from a debugging build (this happens in non-debugging
builds too):
#0  nsPopupSetFrame::OpenPopup (this=0x421acd30, aActivateFlag=0)
    at nsPopupSetFrame.cpp:578
#1  0x410d862e in nsPopupSetFrame::DestroyPopup (this=0x421acd30)
    at nsPopupSetFrame.cpp:507
#2  0x413b8f7d in nsXULPopupElement::ClosePopup (this=0x4238ab30)
    at ../../../dist/include/nsCOMPtr.h:464
#3  0x413aa010 in XULPopupListenerImpl::MouseOut (this=0x41daff00, 
    aMouseEvent=0x423a8ac4) at nsXULPopupListener.cpp:312
#4  0x40e71adc in nsEventListenerManager::HandleEvent (this=0x41daff38, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0xbfffe24c, aFlags=2, 
    aEventStatus=0xbfffe300) at nsEventListenerManager.cpp:784
#5  0x4136fff3 in nsXULElement::HandleDOMEvent (this=0x41f71ca0, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0xbfffe24c, aFlags=2, 
    aEventStatus=0xbfffe300) at nsXULElement.cpp:3300
#6  0x41370139 in nsXULElement::HandleDOMEvent (this=0x41db00e0, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0xbfffe24c, aFlags=2, 
    aEventStatus=0xbfffe300) at nsXULElement.cpp:3330
#7  0x41370139 in nsXULElement::HandleDOMEvent (this=0x41db0170, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0xbfffe24c, aFlags=2, 
    aEventStatus=0xbfffe300) at nsXULElement.cpp:3330
#8  0x41370139 in nsXULElement::HandleDOMEvent (this=0x41f66b40, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0xbfffe24c, aFlags=2, 
    aEventStatus=0xbfffe300) at nsXULElement.cpp:3330
---Type <return> to continue, or q <return> to quit---
#9  0x41370139 in nsXULElement::HandleDOMEvent (this=0x41db0c28, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0xbfffe24c, aFlags=2, 
    aEventStatus=0xbfffe300) at nsXULElement.cpp:3330
#10 0x41370139 in nsXULElement::HandleDOMEvent (this=0x41db0df0, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0xbfffe24c, aFlags=2, 
    aEventStatus=0xbfffe300) at nsXULElement.cpp:3330
#11 0x41370139 in nsXULElement::HandleDOMEvent (this=0x421eabc8, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0xbfffe24c, aFlags=2, 
    aEventStatus=0xbfffe300) at nsXULElement.cpp:3330
#12 0x41119f95 in nsGenericElement::HandleDOMEvent (this=0x421ead20, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0x0, aFlags=1, 
    aEventStatus=0xbfffe300) at nsGenericElement.cpp:1044
#13 0x40f2cbd1 in nsHTMLInputElement::HandleDOMEvent (this=0x421ead00, 
    aPresContext=0x8115490, aEvent=0xbfffe31c, aDOMEvent=0x0, aFlags=1, 
    aEventStatus=0xbfffe300) at nsHTMLInputElement.cpp:729
#14 0x40e798d1 in nsEventStateManager::GenerateMouseEnterExit (
    this=0x421bad58, aPresContext=0x8115490, aEvent=0xbfffe894)
    at nsEventStateManager.cpp:1324
#15 0x40e7482e in nsEventStateManager::PreHandleEvent (this=0x421bad58, 
    aPresContext=0x8115490, aEvent=0xbfffe894, aTargetFrame=0x421e884c, 
    aStatus=0xbfffe7b8, aView=0x8319a58) at nsEventStateManager.cpp:292
#16 0x40ecc0ca in PresShell::HandleEventInternal (this=0x8419ef8, 
    aEvent=0xbfffe894, aView=0x8319a58, aStatus=0xbfffe7b8)
---Type <return> to continue, or q <return> to quit---
    at nsPresShell.cpp:3397
#17 0x40ecbe0f in PresShell::HandleEvent (this=0x8419ef8, aView=0x8319a58, 
    aEvent=0xbfffe894, aEventStatus=0xbfffe7b8, aHandled=@0xbfffe74c)
    at nsPresShell.cpp:3338
#18 0x40c078f2 in nsView::HandleEvent (this=0x8319a58, event=0xbfffe894, 
    aEventFlags=8, aStatus=0xbfffe7b8, aHandled=@0xbfffe74c) at nsView.cpp:761
#19 0x40c0789c in nsView::HandleEvent (this=0x8419a78, event=0xbfffe894, 
    aEventFlags=28, aStatus=0xbfffe7b8, aHandled=@0xbfffe74c) at nsView.cpp:745
#20 0x40c185d8 in nsViewManager2::DispatchEvent (this=0x8419970, 
    aEvent=0xbfffe894, aStatus=0xbfffe7b8) at nsViewManager2.cpp:1370
#21 0x40c05cc2 in HandleEvent (aEvent=0xbfffe894) at nsView.cpp:68
#22 0x41baf61d in nsWidget::DispatchEvent (this=0x8419ae8, aEvent=0xbfffe894, 
    aStatus=@0xbfffe84c) at nsWidget.cpp:1425
#23 0x41baf35d in nsWidget::DispatchWindowEvent (this=0x8419ae8, 
    event=0xbfffe894) at nsWidget.cpp:1316
#24 0x41baf6b1 in nsWidget::DispatchMouseEvent (this=0x8419ae8, 
    aEvent=@0xbfffe894) at nsWidget.cpp:1452
#25 0x41bb031c in nsWidget::OnLeaveNotifySignal (this=0x8419ae8, 
    aGdkCrossingEvent=0x8126e50) at nsWidget.cpp:1985
#26 0x41bb631f in nsWindow::HandleGDKEvent (this=0x8419ae8, event=0x8126e50)
    at nsWindow.cpp:1123
#27 0x41ba8827 in dispatch_superwin_event (event=0x8126e50, window=0x8419ae8)
    at nsGtkEventHandler.cpp:937
---Type <return> to continue, or q <return> to quit---
#28 0x41ba86cc in handle_gdk_event (event=0x8126e50, data=0x0)
    at nsGtkEventHandler.cpp:843
#29 0x406694db in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#30 0x40699186 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#31 0x40699751 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#32 0x406998f1 in g_main_run () from /usr/lib/libglib-1.2.so.0
#33 0x405be5b9 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#34 0x41b9f7f1 in nsAppShell::Run (this=0x81ba4c8) at nsAppShell.cpp:313
#35 0x4159fb30 in ?? ()
   from /scratch/mozilla/dist/bin/components/libnsappshell.so
#36 0x804cda4 in main1 (argc=2, argv=0xbfffec54, splashScreen=0x0)
    at nsAppRunner.cpp:765
#37 0x804d18d in main (argc=2, argv=0xbfffec54) at nsAppRunner.cpp:998

 The component is a guess based on the fact that, well, this is a (Linux)
menu bug.
Some more badness, and hints, perhaps.
This is tested on solaris 2.7, built from CVS with debug and optim.

It not only crashes on menu stuff, but on clicking on links as well, and buttons
It is not 100% reproducable, but when it happens, the fun is pure and simple.

I would guess, it could be connected to the warning:
###!!! ASSERTION: Popup attached to an element that isn't in XUL!: 'Error', file
/tmp/mozilla/rdf/content/src/nsXULPopupListener.cpp, line 357
###!!! Break: at file /tmp/mozilla/rdf/content/src/nsXULPopupListener.cpp, line
357

It's new, and comes up on every click on the page. It segfaults on many actions
(at least all connected to webbrowsing) with a
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().:
'mRawPtr != 0', file ../../../../dist/include/nsCOMPtr.h, line 621
###!!! Break: at file ../../../../dist/include/nsCOMPtr.h, line 621
Segmentation Fault

Axel
New test case, one that works, I have my own little xul app, and that works.
I would consider the new for- and backward buttons good candidates.
mozilla -compose or -edit look good as well.

Axel
adding radha to the cc list.  in #mozilla, someone mentioned that the new back 
forward button menus expose this.
not my doing, but....
Status: NEW → ASSIGNED
Keywords: crash, dogfood, regression, smoketest
in the commercial build for today, this is triggered by just opening the File 
menu.
Severity: critical → blocker
*** Bug 38171 has been marked as a duplicate of this bug. ***
*** Bug 38169 has been marked as a duplicate of this bug. ***
I see this on Macintosh when I open the browser window
OS: Linux → Mac System 8.5
Hardware: PC → Macintosh
Target Milestone: --- → M16
OS: Mac System 8.5 → All
Priority: P3 → P1
Hardware: Macintosh → All
Just to clarify..., the back and forward buttons are now menubuttons with 
class="menubutton-dual" and menuitems are created dynamically when user clicks 
on the menu area. I see no crash in NT debug builds
OS: All → Mac System 8.5
Priority: P1 → P3
Hardware: All → Macintosh
updated platforms/os (linux and windows only).
OS: Mac System 8.5 → Linux
Hardware: Macintosh → PC
Summary: Linux menus are broken and crash Mozilla → menus are broken and crash Mozilla
clarification: it crashes on Macintosh and Linux; not sure why it doesn't show up 
on NT
Priority: P3 → P1
h'm --just saw brade's comment: funny, using the opt comm bits, i can easily get
a crash opening any of the menubar menus, but only on linux and winNT; cannot
get crash on the Mac (even when going to toolbar menus). odd.
Priority: P1 → P3
this is happening on WinNT and Win95 build 2000-05-04-09M16 also/will check Mac 
before changing to all
got this stack on win95, mousing over the back/forward buttons (same crawl as 
linux above)

nsPopupSetFrame::OpenPopup 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsPopupSetFrame.cpp, line 580] 
nsPopupSetFrame::DestroyPopup 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsPopupSetFrame.cpp, line 508] 
nsXULPopupElement::ClosePopup 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULPopupElement.cpp, line 174] 
XULPopupListenerImpl::MouseOut 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULPopupListener.cpp, line 318] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
789] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3301] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3326] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3326] 
nsEventStateManager::GenerateMouseEnterExit 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
1231]

nsEventStateManager::PreHandleEvent 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
290] 
PresShell::HandleEventInternal 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3400] 
PresShell::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3340] 
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 774] 
nsViewManager2::DispatchEvent 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1372] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 69] 
nsWindow::DispatchEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 531] 
nsWindow::DispatchWindowEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 548] 
nsWindow::DispatchMouseEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3360] 
ChildWindow::DispatchMouseEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3565] 
nsWindow::ProcessMessage 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2478] 
nsWindow::WindowProc 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 781] 
KERNEL32.DLL + 0x3663 (0xbff73663) 
KERNEL32.DLL + 0x228e0 (0xbff928e0) 
0x00658bdc
OS: Linux → All
Hardware: PC → All
*** Bug 38153 has been marked as a duplicate of this bug. ***
There is a mac trace from pierre at bug #38153 (but it is the same info really).
reproduced using this morning's verification build on Win98, but seems fine on 
Linux.  
Putting on dogfood+ radar.
Whiteboard: dogfood+
ok fixed.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
*** Bug 38186 has been marked as a duplicate of this bug. ***
verified fixed mac/win32/linux 2000050412 builds.
Status: RESOLVED → VERIFIED
so in todays build we have no forward button and the back button 
doesn't seem to take you back... is that right?
Component: XP Toolkit/Widgets: Menus → XUL
QA Contact: bugzilla → xptoolkit.widgets
You need to log in before you can comment on or make changes to this bug.