Closing and opening toolbars causes crash

VERIFIED FIXED

Status

()

Core
XUL
P3
critical
VERIFIED FIXED
18 years ago
18 years ago

People

(Reporter: Jim Berwick, Assigned: Ben Goodger (use ben at mozilla dot org for email))

Tracking

({crash})

Trunk
x86
Windows 98
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [nsbeta3-], URL)

Attachments

(1 attachment)

(Reporter)

Description

18 years ago
MOZILLA caused an invalid page fault in
module <unknown> at 0000:00e81c80.
Registers:
EAX=01a80f68 CS=015f EIP=00e81c80 EFLGS=00010202
EBX=00e82f70 SS=0167 ESP=0068e378 EBP=0068e438
ECX=00863050 DS=0167 ESI=01e43a00 FS=137f
EDX=01a80d8c ES=0167 EDI=00e81c80 GS=0000
Bytes at CS:EIP:
80 af 2c 60 70 af 2c 60 43 00 00 00 c0 51 e8 00

It is hard to explain how to reproduce this bug.  Go to View, Toolbars, make
sure the Navigation bar and the Personal Toolbar are both active.  Now click the
little arrows on the left hand side of them (the ones that minimize and restore
the toolbars).  Click them repeatedly.  Sometimes this takes a few clicks,
sometimes it takes a minute of doing it, but eventually you'll cause a crash

Comment 1

18 years ago
jimb@snip.net (Jim Berwick) what build did you test this with?  The build ID is
located in the bottom right hand corner of the browser.

Updated

18 years ago
Assignee: asa → trudelle
Severity: normal → critical
Component: Browser-General → XP Toolkit/Widgets
Keywords: crash
QA Contact: doronr → jrgm

Comment 2

18 years ago
I have seen this before, although it is somewhat of an edge case.

Comment 3

18 years ago
I could only reproduce this after >1 min of manic clicking. The stack trace
from a talkback crash is :

0x0a79d080 
StyleSetImpl::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1138] 
PresShell::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3011] 
nsXULDocument::AttributeChanged 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1669] 
nsXULElement::SetAttribute 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 2886] 
nsXULElement::SetAttribute 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 2907] 
nsXULElement::AddBroadcastListener 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3520] 
nsXULDocument::CheckBroadcasterHookup 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 6384] 
nsXULDocument::AddSubtreeToDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 3284] 
nsXULDocument::AddSubtreeToDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 3310] 
nsXULDocument::AddSubtreeToDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 3310] 
nsXULDocument::AddSubtreeToDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 3310] 
nsXULDocument::ContentAppended 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1723] 
nsXULElement::AppendChildTo 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 2557] 
nsXULElement::InsertBefore 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 1047] 
nsXULElement::AppendChild 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 1135] 
NodeAppendChild [d:\builds\seamonkey\mozilla\dom\src\coreDOM\nsJSNode.cpp, line 
571] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 687] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2491] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 703] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 776] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2803] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 792] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
755]

nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
904] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3381] 
PresShell::HandleEventInternal 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3607] 
PresShell::HandleEventWithTarget 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3587] 
nsEventStateManager::CheckForAndDispatchClick 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line
1759] 
nsEventStateManager::PostHandleEvent 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
868] 
PresShell::HandleEventInternal 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3628] 
PresShell::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3542] 
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 782] 
nsViewManager2::DispatchEvent 
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1369] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 69] 
nsWindow::DispatchEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 564] 
nsWindow::DispatchWindowEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 581] 
nsWindow::DispatchMouseEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3675] 
ChildWindow::DispatchMouseEvent 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3880] 
nsWindow::ProcessMessage 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2795] 
nsWindow::WindowProc 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 830] 
KERNEL32.DLL + 0x3663 (0xbff73663) 
KERNEL32.DLL + 0x228e0 (0xbff928e0) 
0x00688b48 
Status: UNCONFIRMED → NEW
Ever confirmed: true

Comment 4

18 years ago
reproduced in today's 61214 NS verification build, also after many clicks.
reassigning to ben.
Assignee: trudelle → ben

Comment 5

18 years ago
So this isn't a ONE-click crasher. :-)

OK, let's deal with this later: M20.

Ben, is this even your bug?
Target Milestone: --- → M20
I intend to revise hyatt's half assed implementation of <toolbar> & friends 
after beta2. 

cc'ing hyatt even though he'll never read this ;) 

Comment 7

18 years ago
I know classic skin is buggy, but noticed that using the handle on the file 
menu in the classic skin causes this crash instantly, but takes some work on 
the other toolbars like it does in modern. Might be a good note for narrowing 
down the cause. Using build 2000062020

Comment 8

18 years ago
I generated this under Windows NT SP4 in just three clicks.  I've got a Dr.
Watson dump I'll attach (it's WAY too long for a comment).  Mozilla build
2000062020.

Comment 9

18 years ago
Created attachment 10472 [details]
Dr. Watson dump of crash

Comment 10

18 years ago
Yes, Ben, it is a half-assed implementation.  That's because I'm pawning off the 
rest of the work on you, because you're my hapless unwitting slave.
you sleazy little bitch. 

nominating for nsbeta3, and hyatt, you WILL implement binding-init for then. 
Status: NEW → ASSIGNED
Keywords: nsbeta3

Comment 12

18 years ago
I can't reproduce this anymore with the personal toolbar, and the taskbar no 
longer has a grippy in either skin (modern or classic).  Fixed?

Comment 13

18 years ago
nav triage team: nsbeta3-, since it's NOT a one-clicker.
nav triage team: ben&hyatt - settle down or get bitch-slapped!
Whiteboard: [nsbeta3-]
fixed! (probably)
Status: ASSIGNED → RESOLVED
Last Resolved: 18 years ago
Resolution: --- → FIXED

Comment 15

18 years ago
I gave it the ">1 min of manic clicking" test and I can't get a crash (even
while doing it concurrent with page loads). Marking verified mac/linux/win32
20000808nn, but reopen if this recurs.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.