45439 - Crash when dbl click in urlbar; clipboard problem

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[John Morrison]

Crash when dbl click in urlbar; clipboard problem

Overview Description:

  Linux will crash if you double-click in the urlbar when the 
  most recent item on the clipboard was a bookmark (from the cut
  operation in the bookmarks manager). 

  Starting this off with pavlov, reassign as necessary

Steps to Reproduce:

1) start mozilla, the browser

2) select 'Bookmarks->Manage Bookmarks' from the top-level menu

3) cut a bookmark, then paste it at a different location in the list
   of bookmarks [warning: this is a painfully slow operation; I am 
   told there are already open bugs on this perf issue].

4) close the bookmarks manager

5) now, double click in the urlbar 

Actual Results: crashes 

Expected Results: selects the current url (for copying/deletion/whatever)

Reproducibility: 100% on linux, 0% on win32/mac

Build Date & Platform Bug Found:
  2000071308 linux (rh6.1)

Additional Builds and Platforms Tested On:
  DOES NOT OCCUR ON
    2000071308 win95
    2000071308 mac os9.0

Additional Information:

Here's the stack trace (and last few console messages) from a current
debug build (from this afternoon).

WEBSHELL+ = 5
->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Write Clipboard to memory
clearing CLIPBOARD clipboard
->>>>>>>>>>>>>> Read Clipboard from memory
->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Read Clipboard from memory
->>>>>>>>>>>>>> Write Clipboard to memory

Program received signal SIGSEGV, Segmentation fault.
0x40a6ae5c in nsClipboard::SetNativeClipboardData (this=0x8698440, 
    aWhichClipboard=0) at nsClipboard.cpp:302
302       if (gdk_selection_owner_get(selectionAtom) == sWidget->window)
(gdb) bt
#0  0x40a6ae5c in nsClipboard::SetNativeClipboardData (this=0x8698440, 
    aWhichClipboard=0) at nsClipboard.cpp:302
#1  0x40a6abb6 in nsClipboard::SetData (this=0x8698440, 
    aTransferable=0x8b8efa0, anOwner=0x0, aWhichClipboard=0)
    at nsClipboard.cpp:227
#2  0x41785564 in nsAutoCopyService::NotifySelectionChanged (this=0x81f94d8, 
    aDoc=0x827b574, aSel=0x8684ce8, aReason=4) at nsAutoCopy.cpp:175
#3  0x417ead2e in nsDOMSelection::NotifySelectionListeners (this=0x8684ce8)
    at nsSelection.cpp:5683
#4  0x417ddda1 in nsSelection::NotifySelectionListeners (this=0x86a0578, 
    aType=1) at nsSelection.cpp:2071
#5  0x417dd207 in nsSelection::SetMouseDownState (this=0x86a0578, aState=0)
    at nsSelection.cpp:1777
#6  0x41647128 in nsTextInputSelectionImpl::SetMouseDownState (this=0x86a0878, 
    aState=0) at nsGfxTextControlFrame2.cpp:801
#7  0x414cdd19 in nsFrame::HandleRelease (this=0x86642ec, 
    aPresContext=0x82d7938, aEvent=0xbffff5ac, aEventStatus=0xbffff4a8)
    at nsFrame.cpp:1379
#8  0x414cb1a4 in nsFrame::HandleEvent (this=0x86642ec, 
    aPresContext=0x82d7938, aEvent=0xbffff5ac, aEventStatus=0xbffff4a8)
    at nsFrame.cpp:797
#9  0x414bf971 in nsBlockFrame::HandleEvent (this=0x86642ec, 
    aPresContext=0x82d7938, aEvent=0xbffff5ac, aEventStatus=0xbffff4a8)
    at nsBlockFrame.cpp:6589
#10 0x415069e4 in PresShell::HandleEventInternal (this=0x82d8058, 
    aEvent=0xbffff5ac, aView=0x86adac0, aStatus=0xbffff4a8)
    at nsPresShell.cpp:3921
#11 0x41506539 in PresShell::HandleEvent (this=0x82d8058, aView=0x86adac0, 
    aEvent=0xbffff5ac, aEventStatus=0xbffff4a8, aHandled=@0xbffff44c)
    at nsPresShell.cpp:3841
#12 0x41bcc447 in nsView::HandleEvent (this=0x86adac0, event=0xbffff5ac, 
    aEventFlags=28, aStatus=0xbffff4a8, aHandled=@0xbffff44c) at nsView.cpp:769
#13 0x41bdf623 in nsViewManager2::DispatchEvent (this=0x82d7b50, 
    aEvent=0xbffff5ac, aStatus=0xbffff4a8) at nsViewManager2.cpp:1387
#14 0x41bc9e84 in HandleEvent (aEvent=0xbffff5ac) at nsView.cpp:68
#15 0x40a7ac58 in nsWidget::DispatchEvent (this=0x86ad3d8, aEvent=0xbffff5ac, 
    aStatus=@0xbffff544) at nsWidget.cpp:1456
#16 0x40a7a89c in nsWidget::DispatchWindowEvent (this=0x86ad3d8, 
    event=0xbffff5ac) at nsWidget.cpp:1347
#17 0x40a7ad10 in nsWidget::DispatchMouseEvent (this=0x86ad3d8, 
    aEvent=@0xbffff5ac) at nsWidget.cpp:1483
#18 0x40a7c9c5 in nsWidget::OnButtonReleaseSignal (this=0x86ad3d8, 
    aGdkButtonEvent=0x81fbbe0) at nsWidget.cpp:2269
#19 0x40a83660 in nsWindow::HandleGDKEvent (this=0x86ad3d8, event=0x81fbbe0)
    at nsWindow.cpp:1298
#20 0x40a7288d in dispatch_superwin_event (event=0x81fbbe0, window=0x86ad3d8)
    at nsGtkEventHandler.cpp:935
#21 0x40a724e4 in handle_gdk_event (event=0x81fbbe0, data=0x0)
    at nsGtkEventHandler.cpp:782
#22 0x40c0a00b in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#23 0x40c37be6 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#24 0x40c381a1 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#25 0x40c38341 in g_main_run () from /usr/lib/libglib-1.2.so.0
#26 0x40b5f209 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#27 0x40a6905a in nsAppShell::Run (this=0x80ef668) at nsAppShell.cpp:335
#28 0x40720c64 in nsAppShellService::Run (this=0x8118938)
    at nsAppShellService.cpp:386
#29 0x8053c55 in main1 (argc=1, argv=0xbffffab4, nativeApp=0x0)
    at nsAppRunner.cpp:913
#30 0x805433e in main (argc=1, argv=0xbffffab4) at nsAppRunner.cpp:1094

Comment 1

[Stuart Parmenter]

cvs server: Diffing .
Index: bookmarks.js
===================================================================
RCS file: /cvsroot/mozilla/xpfe/components/bookmarks/resources/bookmarks.js,v
retrieving revision 1.72
diff -u -r1.72 bookmarks.js
--- bookmarks.js        2000/06/20 01:47:15     1.72
+++ bookmarks.js        2000/07/14 00:14:18
@@ -211,7 +211,7 @@
     if (!trans) return false;
 
     var clip_uri = "component://netscape/widget/clipboard";
-    var clip = Components.classes[clip_uri].createInstance();
+    var clip = Components.classes[clip_uri].getService();
     if (clip) clip = clip.QueryInterface(Components.interfaces.nsIClipboard);
     if (!clip) return false;
     clip.emptyClipboard(Components.interfaces.nsIClipboard.kGlobalClipboard);

Comment 2

[don]

Making this "nsbeta2+".  It's a one-line change!  I've reviewed it.  And it
appears that the crash might happen more often than we originally thought.

Comment 3

[Stuart Parmenter]

fixed

Comment 4

[John Morrison]

This is fixed, I know it's fixed, it can't be anything else but fixed given 
what the JS change is. However, I can't follow the original steps to reproduce 
since they crash as described in bug 45786.

Comment 5

[John Morrison]

verified fixed - linux 2000072121 (rh6.1). Thanks.

Comment 6

[Daniel Veditz [:dveditz]]

Adding keyword to bugs which already show a nsbeta2 triage value in the status 
whiteboard so the queries don't get screwed up.