427143 - Crash [@ nsNativeDragTarget::ProcessDrag] with print progress dialog while dragging

Status: VERIFIED FIXED

(Core :: Widget: Win32, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase. You need to download the testcase to your computer because of the use of enhanced privileges.

To reproduce:
- Select the text, then drag it.

Actual result:
Crash (note that the first time you might get a security warning, which might you get stuck in bug 100180)

This regressed between 2008-03-19 and 2008-03-20:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-03-19+04&maxdate=2008-03-20+09&cvsroot=%2Fcvsroot
I guess a regression from bug 329385.

http://crash-stats.mozilla.com/report/index/dcdbb7cc-028c-11dd-9100-001cc4e2bf68
0  	xul.dll  	nsNativeDragTarget::ProcessDrag  	 mozilla/widget/src/windows/nsNativeDragTarget.cpp:237
1 	xul.dll 	nsNativeDragTarget::DragOver 	mozilla/widget/src/windows/nsNativeDragTarget.cpp:324
2 	ole32.dll 	ole32.dll@0x118f1d 	
3 	ole32.dll 	ole32.dll@0x119107 	
4 	ole32.dll 	ole32.dll@0xefc2e 	
5 	ole32.dll 	ole32.dll@0xf0087 	
6 	xul.dll 	nsDragService::StartInvokingDragSession 	mozilla/widget/src/windows/nsDragService.cpp:314
7 	xul.dll 	nsDragService::InvokeDragSession 	mozilla/widget/src/windows/nsDragService.cpp:263
8 	xul.dll 	nsBaseDragService::InvokeDragSessionWithSelection 	mozilla/widget/src/xpwidgets/nsBaseDragService.cpp:282
9 	xul.dll 	nsContentAreaDragDrop::DragGesture 	mozilla/content/base/src/nsContentAreaDragDrop.cpp:815
10 	xul.dll 	nsEventListenerManager::HandleEvent 	mozilla/content/events/src/nsEventListenerManager.cpp:1181

Comment 1

[Arie Paap [:wildmyron]]

see also bug 427643 - very similar stack trace with a crash on drag + alert dialog

Comment 2

[Martijn Wargers (dead)]

And that bug makes it clear that this crash can also occur without the use of enhanced privileges, so marking blocking-1.9?

Comment 3

[Damon Sicore (:damons)]

While this is a regression, it's an edge case that doesn't necessarily keep the user from having a decent experience.  This late in the game, only serious regressions are blockers.  This is something we can take in a dot release.

wanted1.9.0.x+

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

I have a fix for that null pointer crash, and I'm just trying to 
figure out how to fix part 1 of bug 427643.

Comment 5

[Alberto Avila]

On https://bugzilla.mozilla.org/show_bug.cgi?id=100180#c36 David Baron proposes canceling the dragging operation before showing any modal dialog, sounds like a nice way of solving it.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Attachment: fix the crash

This should fix the crash

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 314449 [details] [diff] [review]
fix the crash

a1.9=beltzner

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Checked in. Martijn could you verify?

Comment 9

[Martijn Wargers (dead)]

Yes, thanks, verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008041107 Minefield/3.0pre

However, the dragging still seems to be going on, but dropping the text doesn't do something useful. Shouldn't the drag operation be cancelled completely? But I guess that's what bug 100180 is about.