44606 - Crash [@ nsMenuPopupFrame::GetNearestEnclosingView]

Status: VERIFIED DUPLICATE of bug 51603

(Core :: XUL, defect, P3)

Description

[Ben Goodger (use ben at mozilla dot org for email)]

1) enable personal toolbar drag and drop (Preferences->Debug->check 'Personal 
Toolbar D&D (buggy)') 
2) create a folder in your personal toolbar (you can do this through the 
bookmarks window) and place something in it)
3) attempt to reorder the item by dragging the folder. (due to another bug it'll 
always appear at the end, but that's a different issuse).
4) click the folder to open it. 

Expected:
folder opens
Actual:
crash.

Here's the stack:

nsMenuPopupFrame::GetNearestEnclosingView(nsIPresContext * 0x029cb4c0, nsIFrame 
* 0x0311b720, nsIView * * 0x0012fa74) line 225 + 17 bytes
nsMenuPopupFrame::GetWidget(nsMenuPopupFrame * const 0x0311b79c, nsIWidget * * 
0x0012fad0) line 1205 + 23 bytes
nsMenuDismissalListener::GetSubmenuWidgetChain(nsMenuDismissalListener * const 
0x03482ecc, nsISupportsArray * * 0x0012fb34) line 118 + 47 bytes
nsWindow::DealWithPopups(unsigned int 33, long * 0x0012fb70) line 746 + 47 bytes
nsWindow::WindowProc(HWND__ * 0x001401b8, unsigned int 33, unsigned int 1769896, 
long 33619969) line 805 + 13 bytes
USER32! 77e13eb0()
USER32! 77e1591b()
USER32! 77e1595d()
NTDLL! 77f9fb83()
USER32! 77e191df()
nsAppShell::Run(nsAppShell * const 0x01062060) line 96 + 52 bytes
nsAppShellService::Run(nsAppShellService * const 0x010cfee8) line 387
main1(int 1, char * * 0x00b16eb0, nsISupports * 0x00000000) line 914 + 32 bytes
main(int 1, char * * 0x00b16eb0) line 1100 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87903()

Gramps reproduced on Linux too.

Comment 1

[leger]

Adding crash keyword

Comment 2

[Mike Pinkerton (not reading bugmail)]

pushing out to beta3

Comment 3

[Peter Trudelle]

nsbeta3-, not enabling PT D&D

Comment 4

[Jay Patel [:jay]]

This is a topcrasher [@ nsMenuPopupFrame::GetNearestEnclosingView] according to 
the latest talkback data. Adding topcrash keyword. Most of the stack traces look 
like this:

Incident ID 16989594 
0x00000000 
nsMenuPopupFrame::GetNearestEnclosingView 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuPopupFrame.cpp, line 226] 
nsMenuPopupFrame::GetWidget 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuPopupFrame.cpp, line 
1181] 
nsMenuDismissalListener::GetSubmenuWidgetChain 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuDismissalListener.cpp, 
line 119] 
nsWindow::DealWithPopups 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 801] 
nsWindow::WindowProc 
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 860] 
USER32.dll + 0x19d0 (0x77e719d0) 
USER32.dll + 0x1982 (0x77e71982) 
ntdll.dll + 0x163a3 (0x77f763a3) 
USER32.dll + 0x1bd8 (0x77e71bd8) 
nsAppShell::Run [d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp, 
line 95] 
nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 379] 
netscp6.exe + 0x17a7 (0x004017a7) 
netscp6.exe + 0x1230 (0x00401230) 
netscp6.exe + 0x2918 (0x00402918) 
KERNEL32.dll + 0x1ba06 (0x77f1ba06) 

And here are some talkback entries:

0x00000000 fef5585f
         line 
        Build: 2000090606 CrashDate: 2000-09-06 UptimeMinutes: 1  Total: 46 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=16974327

    0x00000000 1811a69d
         line 
        Build: 2000090508 CrashDate: 2000-09-06 UptimeMinutes: 265  Total: 577 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: entered two addresses into mail client (hitting return after 
each) and it crashed as I began to enter the 3rd
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=16987080

    0x00000000 fef5585f
         line 
        Build: 2000090608 CrashDate: 2000-09-06 UptimeMinutes: 34  Total: 34 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: Crashed when composing a message in Mail
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=16988157

    0x00000000 fef5585f
         line 
        Build: 2000090608 CrashDate: 2000-09-06 UptimeMinutes: 70  Total: 115 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: crashed when login to an aol account
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=16988243

    0x00000000 fef5585f
         line 
        Build: 2000090608 CrashDate: 2000-09-06 UptimeMinutes: 0  Total: 128 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: crash on send msgs from AOL account
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=16989034

0x00000000 fef5585f
         line 
        Build: 2000090506 CrashDate: 2000-09-06 UptimeMinutes: 146  Total: 146 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: Trying to forward several messages at the same time
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=16992869

0x00000000 fef5585f
         line 
        Build: 2000090709 CrashDate: 2000-09-07 UptimeMinutes: 24  Total: 24 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: Crashed when trying to scroll up in addressing widget in Mail 
compose
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=17047072

0x00000000 69becb75
         line 
        Build: 2000090706 CrashDate: 2000-09-08 UptimeMinutes: 1105  Total: 1235 
        OS: Windows NT  4.0 build 1381
        URL: Mail Compose: Select and delete to crash
        Comment: On replyall
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=17097797

Comment 5

[John Morrison]

I assume Jay meant to remove nsbeta3- to have this reconsidered for beta3. At 
any rate, I'm just leaving this as nsbeta3- for this specific bug, since as 
filed, it requires enabling PT D&D, which will not ship with 6.0.

Luckily, though, there is already a '+' bug open, which deals directly with 
this problem (and a number of the talkback reports are caused by people trying
to reproduce this crash). -- bug 51603

Comment 6

[Peter Trudelle]

Do we have a + bug to get rid of the pref (at least the UI part)that enables this?

Comment 7

[John Morrison]

Blake is scary. He filed a bug to remove the Debug panels for RTM a few hours
ago. bug 52215. I have a few questions on that bug (esp. since he asked to have
these disabled for everyone from now until RTM). 

I know this was discussed in n.p.m.somewhere a while ago, and there may be 
another bug on this (or yet to be filed).

Comment 8

[Peter Trudelle]

You guys are both scary. I feel very inadequate.  Mommy, make the over-achievers
stop!

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

bug 51603 is not visible to the general public (e.g., me).

Comment 10

[John Morrison]

I have asked that bug 51603 be made available to anyone. I don't see why it 
was made confidential in the first place.

Comment 11

[Jay Patel [:jay]]

John, dup of bug 51603 then?  When 51603 is made visible to everyone, i guess we 
can mark this a dup, right?

Comment 12

[John Morrison]

Same stack, likely the same failure mode, but different steps to reproduce.
If Mike feels it's a dup, then it can be dup'd when that bug is opened
(but maybe he wants to hang onto this for some other reason ...).

Comment 13

[Blake Ross]

..cc'ing myself because i randomly stumbled across this bug only to find that 
people were calling me, quote, `scary' :-)

Comment 14

[Zach Lipton [:zach]]

That is scary blake, to think that anyone would insult you. Wow!

Comment 15

[John Morrison]

Uh, it's intended in a complimentary sense, like uncanny or remarkable.

Comment 16

[Mike Pinkerton (not reading bugmail)]

*** This bug has been marked as a duplicate of 51603 ***

Comment 17

[John Morrison]

verified dup.