Closed Bug 570774 Opened 10 years ago Closed 10 years ago

Crash in [@ nsClipboard::PasteboardDictFromTransferable(nsITransferable*) ]


(Core :: Widget: Cocoa, defect, critical)

Not set



Tracking Status
blocking2.0 --- final+
status1.9.2 --- unaffected
status1.9.1 --- unaffected


(Reporter: marcia, Assigned: mats)



(Keywords: crash, regression, topcrash, Whiteboard: [sg:dos][ccbr][fixed by bug 565392])

Crash Data

Seen while running Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.3a5pre) Gecko/20100608 Minefield/3.7a5pre

1. Create a folder in the Bookmarks Organizer. I created it under "Unsorted Bookmarks". I created an empty one without an bookmarks.
2. Try to drag and drop that folder.
3. Crash

Frame  	Module  	Signature [Expand]  	Source
0 	XUL 	nsClipboard::PasteboardDictFromTransferable 	widget/src/cocoa/
1 	XUL 	SetUpDragClipboard 	widget/src/cocoa/
2 	XUL 	nsDragService::InvokeDragSession 	widget/src/cocoa/
3 	XUL 	nsBaseDragService::InvokeDragSessionWithImage 	widget/src/xpwidgets/nsBaseDragService.cpp:285
4 	XUL 	nsEventStateManager::DoDefaultDragStart 	content/events/src/nsEventStateManager.cpp:2249
5 	XUL 	nsEventStateManager::GenerateDragGesture 	content/events/src/nsEventStateManager.cpp:2007
6 	XUL 	nsEventStateManager::PreHandleEvent 	content/events/src/nsEventStateManager.cpp:1131
7 	XUL 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6634
8 	XUL 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6490
9 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6355
10 	XUL 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1023
11 	XUL 	HandleEvent 	view/src/nsView.cpp:160
12 	XUL 	nsChildView::DispatchEvent 	widget/src/cocoa/
13 	XUL 	nsChildView::DispatchWindowEvent 	widget/src/cocoa/
14 	XUL 	-[ChildView mouseDragged:] 	widget/src/cocoa/
15 	AppKit 	-[NSWindow sendEvent:] 	
16 	XUL 	-[ToolbarWindow sendEvent:] 	widget/src/cocoa/
17 	AppKit 	-[NSApplication sendEvent:] 	
18 	AppKit 	-[NSApplication run] 	
19 	XUL 	nsAppShell::Run 	widget/src/cocoa/
20 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:192
21 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3628
22 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
23 	firefox-bin 	firefox-bin@0xbf5 	
24 		@0x3

Will check the regression window, but it looks as if crashes started happening using the 20100607 builds.
Regression Window:

Works: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.3a5pre) Gecko/20100605 Minefield/3.7a5pre

Broken:  Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.3a5pre) Gecko/20100607 Minefield/3.7a5pre

The20100606 build crashes on startup so I was not able to see if it worked or did not work in that build. is the changes that were checked in during that time period.
blocking2.0: --- → ?
It's not clear to me which patch triggered these crashes.

But it's quite clear that they all result from dereferencing a NULL
urlObject pointer.
This is the #2 OS X topcrash on the trunk.
Keywords: topcrash
(Following up comment #4)
And this is only after two days.

In another day or two this is likely to be the #1 OS X topcrasher by far.
If no-one else grabs this, I'll take it tomorrow.
Keywords: regression
Whiteboard: regression → [sg:dos][ccbr]
I found out but testing around this that it is not even necessary to drag a folder. Simply placing my cursor on Unsorted Bookmarks and performing a drag operation causes a crash.
There's got to be something other than just dragging the unsorted bookmarks folder causing this crash - no way there's enough people doing that to put it at a #2 topcrash.

Or maybe ... Marcia - any chance you did this 21 times in the past few days? :)
It wouldn't surprise me if it's a regression from bug 565392.
I'll investigate to make sure...
Assignee: nobody → matspal
It's a regression from bug 565392.  The patch there (pending review) fixes it.
Blocks: 565392
I crashed a few times - the other 18 or so were end users. Comment 7 indicates that a simple drag operation will cause the crash. No need to create a folder drag it. Just put your cursor near Unsorted Bookmarks and drag down and you will crash 100%.
Keywords: relnote
Just to update with further information - it is the down drag operation which causes the crash. Dragging something up does not cause a crash.

Will investigate a bit further to make sure this is only confined to the Bookmarks Manager.
Looks like this might be fixed soon in bug 565392
Fixed by bug 565392.
Closed: 10 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Whiteboard: [sg:dos][ccbr] → [sg:dos][ccbr][fixed by bug 565392]
blocking2.0: ? → final+
For the record, the fix for bug 565392 *did* get into alpha 5 on the Mac, which
was based on the 2010-06-10 nightly.

And that patch does seem to have fixed this bug -- none of these crashes are reported in builds after 2010-06-09.
Removing relnote as this made it into beta1
Keywords: relnote
Crash Signature: [@ nsClipboard::PasteboardDictFromTransferable(nsITransferable*) ]
You need to log in before you can comment on or make changes to this bug.