53851 - Crash After selecting over window borders

Status: VERIFIED DUPLICATE of bug 53358

(Core :: DOM: Selection, defect, P3)

Description

[Ben Bucksch (:BenB)]

Reproducible: Intermittend, roughly every 20th relevant action - often enough to
cause a crash every 10-15 mins or so during work.

Reproduce:
1. Open Mailnews HTML composer.
2. Press primary mouse button in text, either in the addessing widget or the
content area.
3. While holding the mouse button, move the mouse pointer out of the composer.
(This will select the text, as intended.)

Actual result:
Crash.

Comment 1

[Jean-Francois Ducarroz]

Can we have a trace of the crash or a talkback report?

Comment 2

[Ben Bucksch (:BenB)]

I'm running my own, optimized build :-/

Comment 3

[Jim Roskind]

Ben: Any chance that your build environment is messed up?  Can you reproduce on
a standard optimized build (delivered from mozilla or Netscape?)  I tried this
repeatedly on the Netscape sweetlou (optimized) build, and couldn't crash at all
(even when my selection caused various auto-scrolling events).
Has anyone else been able to reproduce this?
If I don't hear about any reproducibility, I can't mark this as dogfood-plus.

Comment 4

[Ben Bucksch (:BenB)]

Removing dogfood keyword per jar's comment.

I don't know, if it happens with mozilal.org builds (you don't want me to use
PR2, do you?). Will eat that dogfood to test.

Comment 5

[rubydoo123]

I have been trying this on win98 using the comm build from 2000092208 and have
not been able to reproduce this. I am asking QA to test this on linux to see if
they can reproduce

Comment 6

[rubydoo123]

sw update

Comment 7

[sujay]

yes it does crash on linux at random times..cannot reproduce every time...
Fenella also confirmed this....

Comment 8

[fenella]

Linux (2000-22-08 M18)
I have seen it crash once but cannot reproduce with another try.

Comment 9

[Ben Bucksch (:BenB)]

Readding dogfood nomination, since I'm not the only one seeing this.

Comment 10

[lchiang]

I've been seeing something similar to this on Win32, I believe.  I can crash 
when I click in the addressing field (ie. new message).

Ben - do you crash doing this?
1. New message
2. Click in addressing field and slightly move the mouse. Crash.

Here is my stack trace.

   nsBindingManager::WalkRules 
                                              
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsBindingManager.cpp, line 806]
     
   StyleSetImpl::WalkRuleProcessors 
                                              
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 2012]
     
   StyleSetImpl::HasStateDependentStyle 
                                              
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1109]
     
   nsCSSFrameConstructor::ContentStatesChanged
                                              
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 9777]
     
   StyleSetImpl::ContentStatesChanged 
                                              
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1183]
     
   PresShell::ContentStatesChanged 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3620]
     
   nsXULDocument::ContentStatesChanged 
                                              
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1592]
     
   nsEventStateManager::SetContentState 
                                              
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
2578]
     
   nsEventStateManager::GenerateMouseEnterExit
                                              
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
1523]
     
   nsEventStateManager::PreHandleEvent 
                                              
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
306]
     
   PresShell::HandleEventInternal 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4252]
     
   PresShell::HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4192]
     
   nsView::HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 379]
     
   nsViewManager2::DispatchEvent 
                                              
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1429]
     
   HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68]
     
   nsWindow::DispatchEvent 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 685]
     
   nsWindow::DispatchWindowEvent 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 702]
     
   nsWindow::DispatchMouseEvent 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3892]
     
   ChildWindow::DispatchMouseEvent 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4100]
     
   nsWindow::ProcessMessage 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2985]
     
   nsWindow::WindowProc 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 951]
     
   USER32.dll + 0x1268 (0x77e71268) 
                                               

Comment 11

[Jean-Francois Ducarroz]

See the stack trace, it's a dup of bug 53358

Comment 12

[Ben Bucksch (:BenB)]

Lisa, yes, not hard to reproduce. I just need to click around on an empty
addressing widget 5 or 6 times, and crash :-/.

Comment 13

[Jean-Francois Ducarroz]

*** This bug has been marked as a duplicate of 53358 ***

Comment 14

[[e-mail] (gone - use [e-mail] instead)]

verified dup.