40045 - crash when click menus (when using native not gfx scrollbars)

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

DESCRIPTION:  In the past week or so, I crash (segmentation fault) every time I
click on a menu in the menubar.  However, this happens only in:
 * optimized/non-debug builds (ones I build or release builds) -- it does not
happen in the debug/non-optimized build that I build
 * with my profile, as opposed to a fresh one

I've waited to file this bug because I needed to update my optimized tree to get
a stack trace (this is from a tree checked out 2000-05-20):

#0  0x458b10c4 in ?? ()
#1  0x40d99a77 in nsMenuFrame::ActivateMenu ()
#2  0x40d9a473 in nsMenuFrame::OpenMenuInternal ()
#3  0x40d99bc2 in nsMenuFrame::AttributeChanged ()
#4  0x40d0ad7d in nsCSSFrameConstructor::AttributeChanged ()
#5  0x40de8f19 in StyleSetImpl::AttributeChanged ()
#6  0x40c0e5b7 in PresShell::AttributeChanged ()
#7  0x40532844 in nsXULDocument::AttributeChanged ()
#8  0x40523571 in nsXULElement::SetAttribute ()
#9  0x4051fee6 in nsXULElement::SetAttribute ()
#10 0x40d99ce4 in nsMenuFrame::OpenMenu ()
#11 0x40d996fe in nsMenuFrame::ToggleMenuState ()
#12 0x40d992d7 in nsMenuFrame::HandleEvent ()
#13 0x40c0f2c2 in PresShell::HandleEventInternal ()
#14 0x40c0f10e in PresShell::HandleEvent ()
#15 0x410417e5 in nsView::HandleEvent ()
#16 0x4104af2a in nsViewManager::DispatchEvent ()
#17 0x4104044d in HandleEvent ()
#18 0x405e3f3a in nsWidget::DispatchEvent ()
#19 0x405e3e5d in nsWidget::DispatchWindowEvent ()
#20 0x405e3fc0 in nsWidget::DispatchMouseEvent ()
#21 0x405e4ecc in nsWidget::OnButtonPressSignal ()
#22 0x405e889f in nsWindow::HandleGDKEvent ()
#23 0x405de897 in dispatch_superwin_event ()
#24 0x405de74a in handle_gdk_event ()
#25 0x407465cb in gdk_event_dispatch ()
#26 0x40774be6 in g_main_dispatch ()
#27 0x407751a1 in g_main_iterate ()
#28 0x40775341 in g_main_run ()
#29 0x4069a859 in gtk_main ()
#30 0x405d76ea in nsAppShell::Run ()
#31 0x4037c46e in nsAppShellService::Run ()
#32 0x804d167 in main1 ()
#33 0x804d595 in main ()
#34 0x40240cb3 in __libc_start_main (main=0x804d470 <main>, argc=1, 
    argv=0xbffff834, init=0x804a7c0 <_init>, fini=0x8051cb8 <_fini>, 
    rtld_fini=0x4000a350, stack_end=0xbffff82c)
    at ../sysdeps/generic/libc-start.c:78

I wonder if this could be related to bug 38941, which is also specific to some
profiles (but occurs in debug builds too).

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I traced this to the following line in my prefs.js:

user_pref("nglayout.widget.gfxscrollbars", false);

The reason I had that is a long story...

Comment 2

[Mike Pinkerton (not reading bugmail)]

more native scrollbar fun for you eric

Comment 3

[John Morrison]

I was getting this too, and on win95, adding that pref
user_pref("nglayout.widget.gfxscrollbars", false); results in this crash:

nsView::SetBounds [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 1012] 
nsScrollFrame::ScrollTo 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollFrame.cpp, line 214] 
nsMenuFrame::ActivateMenu 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 475] 
nsMenuFrame::OpenMenuInternal 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 661] 
nsMenuFrame::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 507] 
nsCSSFrameConstructor::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 9726] 
StyleSetImpl::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1079] 
PresShell::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3015] 
nsXULDocument::AttributeChanged 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1531] 
nsXULElement::SetAttribute 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3077] 
nsXULElement::SetAttribute 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 1479] 
nsMenuFrame::OpenMenu 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 531] 
nsMenuFrame::ToggleMenuState 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 393] 
nsMenuFrame::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 285] 
PresShell::HandleEventInternal 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3618] 
PresShell::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3536] 
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 774] 
nsViewManager2::DispatchEvent 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1369] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 69] 
nsWindow::DispatchEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 564] 
nsWindow::DispatchWindowEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 581] 
nsWindow::DispatchMouseEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3675] 
ChildWindow::DispatchMouseEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3880] 
nsWindow::ProcessMessage 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2795] 
nsWindow::WindowProc 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 830] 
KERNEL32.DLL + 0x3663 (0xbff73663) 
KERNEL32.DLL + 0x228e0 (0xbff928e0) 
0x00658b4c 

Comment 4

[Barry Pederson]

I've been seeing this for several days now on WinNT 4.0 SP6.  I'd like to turn
off the gfx scrollbars so I can use a wheelmouse, but it's kind of hard to work
without touching those menus..

Comment 5

[John Morrison]

Nominating for nsbeta2 -- this crash is immediate upon clicking on the menubar
when native scrollbars are enabled on either win32 or linux optimized builds.
Obviously PR2 cannot go out with this crasher. (Note: does not happen on mac, 
and does not happen for linux debug. Don't know about win32 debug).

However, the fix may be to remove the native scrollbar option from PR2 
(although it is important to maintain this option for debug and (likely) 
the nightly builds -- in order to test/compare gfx to native functionality).

[By the way, bpederson : mousewheel does work with GFX scrollbars. If you're 
having a problem in getting your mousewheel to work with GFX, please file a 
bug on XPToolkit (if you haven't already done so). Thanks!]

Comment 6

[John Morrison]

*** Bug 40918 has been marked as a duplicate of this bug. ***

Comment 7

[Blake Ross]

*** Bug 41081 has been marked as a duplicate of this bug. ***

Comment 8

[Blake Ross]

putting gfx in summary to help prevent the rush of dups we'll likely soon see 
(already starting to happen...)

Comment 9

[Shiva Thirumazhusai]

Adding keyword topcrash and ccing chofmann.

Comment 10

[Peter Trudelle]

[nsbeta2-]

Comment 11

[John Morrison]

*** Bug 41576 has been marked as a duplicate of this bug. ***

Comment 12

[John Morrison]

This may be fixed (a magic bug fix).  I don't crash when using native 
scrollbars on either win95 or linux rh6.1 [using 060609 win32 and a tip build 
on linux from last night.] Will check later with today's trunk verif. builds.

Comment 13

[Barry Pederson]

John Morrison said: "mousewheel does work with GFX scrollbars"  I've been trying 
that off and on for months, and it's -never- worked for me on 2 WinNT4 SP6 boxes 
I have, one with a Logitech Mouse, one with a Microsoft.  20618 seems to be the 
relevant bug here in Bugzilla.  Until that's all cleared up, I really hope you 
don't remove the native scrollbar option.

Anyhow, the magic bugfix does seem to work - I'm happily wheelmousing away today 
with native scrollbars, and able to click on the menus without crashing.

Comment 14

[Eric Vaughan]

Fixed. Menus no longer have have native/gfx scrollbars in them. That have 
autoscrollers.

Comment 15

[John Morrison]

verified fixed