467179 - DragSession causes Firefox crash [@ CarbonCore@0x1058f ]

Status: RESOLVED INVALID

(Core :: Widget: Cocoa, defect)

Description

[tinyspace]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4
Build Identifier: Mozilla/5.0

In our extension. We implement an drag and drop interface.
I call a function named onDrop:
"
onDrop(event, dropData, session) 
"
If the function need a long time to run ( for example: it need read data from network).
When another drag drop start and the first has not finished yet, the firefox will crash.




Reproducible: Always

Steps to Reproduce:
1.you can find the reproduce code in: http://fffocus.cn/test/DragTest.xpi
2.Or use the sample code here:
/*********************************************/
var DragTest = {
  loaded: false,
  onLoad: function() {
    if (!DragTest.loaded) {
      var contentArea = getBrowser().mPanelContainer;
      if (contentArea) {
       contentArea.addEventListener('dragdrop', function(e) {
            nsDragAndDrop.drop(e, DragTestObserver);
          }, false);
        contentArea.addEventListener('drop', function(e) {
            nsDragAndDrop.drop(e, DragTestObserver);
          }, false);
          
         }
      DragTest.loaded = true;
    }
  }
/***some code omit**/
}; 

var DragTestObserver = {

  onDragOver: function(aEvent, aFlavour, aDragSession) {
    aDragSession.canDrop = true;
  },

  onDrop: function(aEvent, aXferData, aDragSession) {
   /*run few seconds. such as read some data from slow network*/
  },

  getSupportedFlavours: function() {
    var flavourSet = new FlavourSet();
    flavourSet.appendFlavour("text/x-moz-url");
    //flavourSet.appendFlavour("text/html");
    flavourSet.appendFlavour("text/unicode");
    return flavourSet;
  }
};

window.addEventListener('load', DragTest.onLoad, false);
Actual Results:  
firefox crash every time

Comment 1

[Dave Garrett]

http://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report

Comment 2

[tinyspace]

Attachment: The reproduce code

Comment 3

[Tyler Downer [He/Him]]

Please read comment #1

Comment 4

[tinyspace]

I have submit a crash report :
http://crash-stats.mozilla.com/report/index/7f8a80aa-cf32-43b8-b04e-d7bd92081130
Hope it is useful for you.

Comment 5

[Dave Garrett]

bp-7f8a80aa-cf32-43b8-b04e-d7bd92081130
0  	CarbonCore  	CarbonCore@0x1058f  	
1 	CarbonCore 	CarbonCore@0x3a380 	
2 	CarbonCore 	CarbonCore@0x3a3f9 	
3 	HIServices 	GetIndexedReceiveHandler 	
4 	HIServices 	DoDropMessage 	
5 	HIServices 	SendDropMessage 	
6 	HIServices 	DragInApplication 	
7 	HIServices 	CoreDragStartDragging 	
8 	AppKit 	AppKit@0x311a78 	
9 	AppKit 	AppKit@0x310999 	
10 	AppKit 	AppKit@0x3103e3 	
11 	XUL 	nsDragService::InvokeDragSession 	mozilla/widget/src/cocoa/nsDragService.mm:313
12 	XUL 	nsContentAreaDragDrop::DragGesture 	mozilla/content/base/src/nsContentAreaDragDrop.cpp:822
13 	XUL 	nsEventListenerManager::HandleEvent 	mozilla/content/events/src/nsEventListenerManager.cpp:184
14 	XUL 	nsEventTargetChainItem::HandleEvent 	mozilla/content/events/src/nsEventDispatcher.cpp:210
15 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	mozilla/content/events/src/nsEventDispatcher.cpp:291
16 	XUL 	nsEventDispatcher::Dispatch 	mozilla/content/events/src/nsEventDispatcher.cpp:483
17 	XUL 	nsEventStateManager::GenerateDragGesture 	mozilla/content/events/src/nsEventStateManager.cpp:2002
18 	XUL 	nsEventStateManager::PreHandleEvent 	mozilla/content/events/src/nsEventStateManager.cpp:857
19 	XUL 	PresShell::HandleEventInternal 	mozilla/layout/base/nsPresShell.cpp:5919
20 	XUL 	PresShell::HandlePositionedEvent 	mozilla/layout/base/nsPresShell.cpp:5817
21 	XUL 	PresShell::HandleEvent 	mozilla/layout/base/nsPresShell.cpp:5677
22 	XUL 	nsViewManager::HandleEvent 	mozilla/view/src/nsViewManager.cpp:1382
23 	XUL 	nsViewManager::DispatchEvent 	mozilla/view/src/nsViewManager.cpp:1337
24 	XUL 	HandleEvent 	mozilla/view/src/nsView.cpp:168
25 	XUL 	nsChildView::DispatchEvent 	mozilla/widget/src/cocoa/nsChildView.mm:1718
26 	XUL 	nsChildView::DispatchWindowEvent 	mozilla/widget/src/cocoa/nsChildView.mm:1731
27 	XUL 	nsChildView::DispatchMouseEvent 	mozilla/widget/src/cocoa/nsChildView.mm:1743
28 	XUL 	-[ChildView mouseDragged:] 	mozilla/widget/src/cocoa/nsChildView.mm:3272
29 	AppKit 	AppKit@0x10f3a4 	
30 	XUL 	-[NSWindow nsCocoaWindow_NSWindow_sendEvent:] 	mozilla/widget/src/cocoa/nsCocoaWindow.mm:2180
31 	XUL 	-[ToolbarWindow sendEvent:] 	mozilla/widget/src/cocoa/nsCocoaWindow.mm:1839
32 	AppKit 	AppKit@0xdb310 	
33 	AppKit 	AppKit@0x38d0e 	
34 	XUL 	nsAppShell::Run 	mozilla/widget/src/cocoa/nsAppShell.mm:591
35 	XUL 	nsAppStartup::Run 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181
36 	XUL 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3174
37 	firefox-bin 	main 	mozilla/browser/app/nsBrowserApp.cpp:158
38 	firefox-bin 	start 	crt.c:272
39 	firefox-bin 	start 	
40 		@0x0

Comment 6

[tinyspace]

By the way, Firefox 3.1beta has the same issue.

Comment 7

[Steven Michaud [:smichaud] (Retired)]

Tinyspace, you don't say how to use the "reproduce code" (attachment
350597) to reproduce your crash.  Please give step-by-step
instructions.

Do you also crash on Windows and/or Linux?

Comment 8

[tinyspace]

To Steven Michaud:
    reproduce the crash steps:install the test xpi file, restart firefox.
    drag something two times in 5 seconds. Firefox will crash now.
    In the test xpi files. I read a network file use io-service, the server will return results after 5 seconds----I just simulate a slowly network.
    On windows and/or Linux, It doesn't crash anymore.

Comment 9

[Wayne Mery (:wsmwk)]

Frankie, can you reproduce this?   (I think tinyspace is gone - mail bounces)

Comment 10

[Frankie]

RIP Carbon

Comment 11

[Stefan [:stefanh]]

JFTR: We're still crashing @ CarbonCore, but those crashes doesn't seem related to any dragging: https://crash-stats.mozilla.com/search/?signature=~CarbonCore&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports