426392 - Crash in nsXULPopupManager::ShowPopupCallback when customizing toolbar using "Icons and Text"

Status: VERIFIED FIXED

(Core :: XUL, defect, P2)

Description

[Marcia Knous [:marcia]]

Seen using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9pre) Gecko/2008040104 Minefield/3.0pre.

1. With a fresh profile, go to Customize Toolbars and select "Icons and Text."
2. Visit a few sites to get the back and forward buttons active.
3. Click on the dropmarker. Crash

Breakpad URLS (currently 404s) 
http://crash-stats.mozilla.com/report/index/02eef340-0015-11dd-a0d3-001a4bd43ef6
http://crash-stats.mozilla.com/report/index/2e3d3c30-0017-11dd-a992-001a4bd43e5c
I have several others as well.

This is easy to reproduce on Leopard. Bug 414445 was checked in last night, which seemed to touch this area.

Comment 1

[Marcia Knous [:marcia]]

I have not been able to reproduce this on Tiger or Win XP yet.

Comment 2

[Phil Ringnalda (:philor)]

Nope, not bug 414445, since I'm seeing it in Thunderbird, trying to test my patch for bug 425015 (which otherwise make it impossible to see anything about customizing in Thunderbird). Confirmed by local backout that's it's because of bug 420499

Comment 3

[Phil Ringnalda (:philor)]

Ah, Tbird's probably an easier crash-test because we have so many menu-buttons - I started out testing my patch by dragging both the Tag and Mark buttons onto the toolbar, and both of them have popups.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Chris, we either need a very fast fix here or backout of bug 420499

Comment 5

[Damon Sicore (:damons)]

+'ing this as it's due to fallout from bug 420499.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Possible patch

I don't have a Leopard machine to test this on, but I think this patch will fix the crash... Can someone test this please?

Comment 7

[Marcia Knous [:marcia]]

Chris: Can you make a tryserver build for us to test: http://wiki.mozilla.org/Build:TryServer?

Comment 8

[Chris Pearce [:cpearce (Not reading bugmail)]]

Ok, you can download a TryServer build here:

https://build.mozilla.org/tryserver-builds/2008-04-02_17:[e-mail]-1207182674/

It's my first time using TryServer, but it looks like it worked.

Comment 9

[Marcia Knous [:marcia]]

Running the build in Comment 8 on Leopard, despite numerous valiant attempts I was not able to crash in the same stack. I followed the same STR in my initial report.

I did crash while testing this build, but it was in libobjc.A.dylib 0x908ab6e8 objc_msgSend which is a different crash (clicking the login link in Bugzilla) and I think it is unrelated. So I think we are good - I will run the build for a bit longer to see if any other crashes materialize.

Comment 10

[Phil Ringnalda (:philor)]

Yep, fixes the crash in Thunderbird, too (where valiant attempts weren't required to crash, so I'm pretty certain those cover what I was hitting).

Comment 11

[Phil Ringnalda (:philor)]

layout/xul/base/src/nsXULPopupManager.cpp 1.58

Comment 12

[Henrik Skupin [:whimboo][⌚️UTC+2]]

My version Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9pre) Gecko/2008040304 Minefield/3.0pre ID:2008040304 crashes each time I try to open the context menu.

Verified with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9pre) Gecko/2008040504 Minefield/3.0pre ID:2008040504