42259 - Closing and opening toolbars causes crash

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[Jim Berwick]

MOZILLA caused an invalid page fault in
module <unknown> at 0000:00e81c80.
Registers:
EAX=01a80f68 CS=015f EIP=00e81c80 EFLGS=00010202
EBX=00e82f70 SS=0167 ESP=0068e378 EBP=0068e438
ECX=00863050 DS=0167 ESI=01e43a00 FS=137f
EDX=01a80d8c ES=0167 EDI=00e81c80 GS=0000
Bytes at CS:EIP:
80 af 2c 60 70 af 2c 60 43 00 00 00 c0 51 e8 00

It is hard to explain how to reproduce this bug.  Go to View, Toolbars, make
sure the Navigation bar and the Personal Toolbar are both active.  Now click the
little arrows on the left hand side of them (the ones that minimize and restore
the toolbars).  Click them repeatedly.  Sometimes this takes a few clicks,
sometimes it takes a minute of doing it, but eventually you'll cause a crash

Comment 1

[Asa Dotzler [:asa]]

[e-mail] (Jim Berwick) what build did you test this with?  The build ID is
located in the bottom right hand corner of the browser.

Comment 2

[Blake Ross]

I have seen this before, although it is somewhat of an edge case.

Comment 3

[John Morrison]

I could only reproduce this after >1 min of manic clicking. The stack trace
from a talkback crash is :

0x0a79d080 
StyleSetImpl::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1138] 
PresShell::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3011] 
nsXULDocument::AttributeChanged 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1669] 
nsXULElement::SetAttribute 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 2886] 
nsXULElement::SetAttribute 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 2907] 
nsXULElement::AddBroadcastListener 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3520] 
nsXULDocument::CheckBroadcasterHookup 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 6384] 
nsXULDocument::AddSubtreeToDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 3284] 
nsXULDocument::AddSubtreeToDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 3310] 
nsXULDocument::AddSubtreeToDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 3310] 
nsXULDocument::AddSubtreeToDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 3310] 
nsXULDocument::ContentAppended 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1723] 
nsXULElement::AppendChildTo 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 2557] 
nsXULElement::InsertBefore 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 1047] 
nsXULElement::AppendChild 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 1135] 
NodeAppendChild [d:\builds\seamonkey\mozilla\dom\src\coreDOM\nsJSNode.cpp, line 
571] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 687] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2491] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 703] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 776] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2803] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 792] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
755]

nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
904] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3381] 
PresShell::HandleEventInternal 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3607] 
PresShell::HandleEventWithTarget 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3587] 
nsEventStateManager::CheckForAndDispatchClick 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line
1759] 
nsEventStateManager::PostHandleEvent 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
868] 
PresShell::HandleEventInternal 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3628] 
PresShell::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3542] 
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 782] 
nsViewManager2::DispatchEvent 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1369] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 69] 
nsWindow::DispatchEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 564] 
nsWindow::DispatchWindowEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 581] 
nsWindow::DispatchMouseEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3675] 
ChildWindow::DispatchMouseEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3880] 
nsWindow::ProcessMessage 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2795] 
nsWindow::WindowProc 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 830] 
KERNEL32.DLL + 0x3663 (0xbff73663) 
KERNEL32.DLL + 0x228e0 (0xbff928e0) 
0x00688b48 

Comment 4

[Peter Trudelle]

reproduced in today's 61214 NS verification build, also after many clicks.
reassigning to ben.

Comment 5

[don]

So this isn't a ONE-click crasher. :-)

OK, let's deal with this later: M20.

Ben, is this even your bug?

Comment 6

[Ben Goodger (use ben at mozilla dot org for email)]

I intend to revise hyatt's half assed implementation of <toolbar> & friends 
after beta2. 

cc'ing hyatt even though he'll never read this ;) 

Comment 7

[jlarsen]

I know classic skin is buggy, but noticed that using the handle on the file 
menu in the classic skin causes this crash instantly, but takes some work on 
the other toolbars like it does in modern. Might be a good note for narrowing 
down the cause. Using build 2000062020

Comment 8

[Daniel Potter]

I generated this under Windows NT SP4 in just three clicks.  I've got a Dr.
Watson dump I'll attach (it's WAY too long for a comment).  Mozilla build
2000062020.

Comment 9

[Daniel Potter]

Attachment: Dr. Watson dump of crash

Comment 10

[David Hyatt]

Yes, Ben, it is a half-assed implementation.  That's because I'm pawning off the 
rest of the work on you, because you're my hapless unwitting slave.

Comment 11

[Ben Goodger (use ben at mozilla dot org for email)]

you sleazy little bitch. 

nominating for nsbeta3, and hyatt, you WILL implement binding-init for then. 

Comment 12

[Blake Ross]

I can't reproduce this anymore with the personal toolbar, and the taskbar no 
longer has a grippy in either skin (modern or classic).  Fixed?

Comment 13

[Claudius Gayle]

nav triage team: nsbeta3-, since it's NOT a one-clicker.
nav triage team: ben&hyatt - settle down or get bitch-slapped!

Comment 14

[Ben Goodger (use ben at mozilla dot org for email)]

fixed! (probably)

Comment 15

[John Morrison]

I gave it the ">1 min of manic clicking" test and I can't get a crash (even
while doing it concurrent with page loads). Marking verified mac/linux/win32
20000808nn, but reopen if this recurs.