45361 - crash in bookmark manager; doing drag ? drop on a ?flat? bookmark list

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[John Morrison]

Overview Description:
  crash in bookmark manager; doing drag & drop on a "flat" bookmark list

Steps to Reproduce:
1) substitute the bookmarks.html attached to this bug report for the 
   bookmarks.html in a mozilla profile. [This bookmarks.html is simply 
   the default bookmarks.html contents, but with the contents of all
   subfolders moved to the top-level -- i.e., this is just a very flat
   bookmarks file]
   
2) mousedown on a bookmark, and initiate a drag of a single bookmark

3) drop the bookmark further down the list (I don't think "how far" is 
   matters]

Actual Results:   crashes

Expected Results: drops the bookmark into the list at the new location.

Reproducibility: 

  100% on win32 with this bookmarks.html

  [I cannot reproduce this bug with the default bookmarks.html, and it
  seemed that the difference (when I first noticed this crash) was that 
  the bookmark.html that I was using had a very "flat" list in the section
  where I was doing the D&D.]

Build Date & Platform Bug Found:
  2000071215 win95 -- crashes (with same bookmarks.html)
  2000071211 linux -- crashes (with same bookmarks.html)

Additional Builds and Platforms Tested On:
  2000071215 mac -- does not crash (with same bookmarks.html)
     [Although, the drop operation takes ~1min to complete ... perf candidate]
  
Additional Information:

Here's the talkback stack trace win95 (linux is the ~same)

It appears to be in code the Eric wrote so running it by him first; 
cc: pinkerton, slamm, claudius


PresShell::HandlePostedDOMEvents 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3187] 
PresShell::ProcessReflowCommands 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4199] 
PresShell::FlushPendingNotifications 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3223] 
PresShell::AppendReflowCommand 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2448] 
nsFrame::CreateAndPostReflowCommand 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrame.cpp, line 3369] 
nsContainerFrame::ReflowDirtyChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
316] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 468] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::MarkStyleChange 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 325] 
nsCSSFrameConstructor::StyleChangeReflow 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 9717] 
nsCSSFrameConstructor::ProcessRestyledFrames 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 9847] 
nsCSSFrameConstructor::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 10160] 
StyleSetImpl::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1143] 
PresShell::AttributeChanged 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3296] 
nsXULDocument::AttributeChanged 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1674] 
nsXULElement::SetAttribute 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 2855] 
nsXULElement::SetAttribute 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 1246] 
ElementSetAttribute 
[d:\builds\seamonkey\mozilla\dom\src\coreDOM\nsJSElement.cpp, line 240] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 717] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2521] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 733] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2817] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 850] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
773] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
1661] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3350] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 3375] 
PresShell::HandlePostedDOMEvents 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3186] 
PresShell::ProcessReflowCommands 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4199] 
PresShell::FlushPendingNotifications 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3223] 
PresShell::AppendReflowCommand 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2448] 
nsFrame::CreateAndPostReflowCommand 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrame.cpp, line 3369] 
nsContainerFrame::ReflowDirtyChild 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
316] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 468] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::RelayoutDirtyChild 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 457] 
nsBox::MarkDirtyChildren 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 292] 
nsBoxFrame::RemoveFrame 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 995] 
FrameManager::RemoveFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 707] 
nsCSSFrameConstructor::ContentRemoved 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 9463] 
StyleSetImpl::ContentRemoved 
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1114] 
PresShell::ContentRemoved 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3367] 
nsXULDocument::ContentRemoved 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1807] 
nsXULElement::RemoveChildAt 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULElement.cpp, line 2604] 
nsXULTemplateBuilder::RemoveMember 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULTemplateBuilder.cpp, line 
5591]

Comment 1

[John Morrison]

Attachment: bookmarks.html -- Netscape defaults, flattened to one level

Comment 2

[John Morrison]

Nominating for nsbeta3 -- this is not an uncommon use case to have ~60 
bookmarks at the top-level, and to then do some D&D rearrangement of the 
bookmarks. 

(I'm close to saying nsbeta2, but I don't know if this is common enough to 
'pull it off the wire', and if anyone wishes to tip the balance in that 
direction, then please do so). 

Comment 3

[John Morrison]

I should add that I do not get this crash when I do a cut and paste to relocate 
the bookmark in the list; only when doing D&D. 

Comment 4

[Shiva Thirumazhusai]

The following bug looks like related crash.
http://bugzilla.mozilla.org/show_bug.cgi?id=45510

Comment 5

[Marc Attinasi]

bug 45510 has the same stack-top and seems like it might be the same problem. 
There is a patch attached to that bug too, might be worth checking out.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This is another HandlePostedDOMEvents reentry. My patch to bug 45510 should fix 
it.

Comment 7

[John Morrison]

Nominating nsbeta2 : namachi notes (on bug 45510) that this is a current top 
crasher in talkback, and I can trigger this crash fairly easily doing any D&D 
operation in bookmarks with today's build.

evaughan: can you review roc's patch (attached to bug 45510 --  
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=11421)

Comment 8

[Jay Patel [:jay]]

Putting on [nsbeta2+] radar for beta2 fix. 

Comment 9

[Marc Attinasi]

The patch to nsPersShell attached to bug 45510 fixes this crash. It is still 
very slow to move the bookmark, however, taking about 15 seconds to move a 
bookmark item down in the list...

I reproduced the crash without the patch, no crash with the patch. Eric, please 
review the patch so we can check it in and close this beta2 blocker out: 
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=11421

Comment 10

[Eric Vaughan]

Looks good you have my review.

Comment 11

[Eric Vaughan]

reassigning.

Comment 12

[Marc Attinasi]

Thanks. I'll check it in now.

Comment 13

[Marc Attinasi]

Patch checked in - thanks Robert!

Comment 14

[John Morrison]

verified fixed -- 2000071920 linux (rh6.1) -- Thanks a lot, roc!