576332 - Crash [@ PresShell::DispatchSynthMouseMove] clicking link "click here to cancel"

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Tracy Walker [:tracy]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:2.0b1) Gecko/20100630 Firefox/4.0b1

Seeing this only on Windows XP, Mac And Win 7 aren't affected.

STR:

1) ensure "Menu Item Usage v2" study. is running (use chrome://testpilot/content/debug.html to set it to 3 if you need to)
2) Open All your studies > current studies and click the "more info" link the "Menu Item Usage v2" study.
3) In the resulting, find If you don't want to submit your data this time, "click here to cancel". and click the link

tested results:
browser crash  - http://crash-stats.mozilla.com/report/index/141a0524-a4ff-4e82-94f1-036632100701

expected results:
Window for You are about to quit the study

Comment 1

[Jono Xia]

This is very worrisome.  I don't understand how this could be happening, since all the "click here to cancel" link does is open another chrome:// html page.  I don't understand how that can be crashing firefox.  Nevertheless, it's happening, so I will make it my top priority to figure it out and fix it.

Comment 2

[Marcia Knous [:marcia]]

Jono: In the QA lab I was able to repro this once on XP, but most of time the window that is spawned is not filled with content (it is missing that link completely). I see the same missing content on Vista and 7. The one time I saw the content on Win XP and clicked the link I crashed.

Comment 3

[Marcia Knous [:marcia]]

I just crashed on Windows Vista following Tracy's STR in Comment 0 - Mozilla/5.0 (Windows; U; Windows NT 6.0; WOW64; en-US; rv:2.0b1) Gecko/20100630 Firefox/4.0b1.

Comment 4

[Matt Evans [:mevans]]

This is still considered somewhat intermittent at this point? It can not yet be repro'ed on at will correct?

Comment 5

[Jono Xia]

If anyone can reproduce the study window being empty of content (or just having the right-side images, no links in the main part) then could they please report what the study status was?  You can check the study status by going to chrome://testpilot/content/debug.html and picking the study (menu item usage v2) from the drop-down menu - it will say something like "Current Status = 3".  Getting that number would help me debug the problem.

Comment 6

[Tracy Walker [:tracy]]

(In reply to comment #4)
> This is still considered somewhat intermittent at this point? It can not yet be
> repro'ed on at will correct?

Yes, at will, following STR's

Comment 7

[Jono Xia]

Marcia: If the study window is empty before the study has started (i.e. in the all-your-studies window it says "Will start on <date>"), then that's a known bug with the particular study, we're fixing it server-side, and it's probably not related to the crash.

Comment 8

[Jono Xia]

I can't reproduce the crash at all on my WinXP VM.  :-(

Comment 9

[Jono Xia]

Marcia: so if you want to try reproducing the bug reliably, you can go to the debug page and click "notify me" to get the notification.  Once you close or click "more info" on that notification, the study will be running, and the link will be present in the study window, and you can then try to repro the crash.  Which I really hope you can do, since I can't.

Comment 10

[Tracy Walker [:tracy]]

It seems I am the only one able to reproduce this reliably.

Comment 11

[Martijn Wargers (dead)]

From the crash report:
http://crash-stats.mozilla.com/report/index/141a0524-a4ff-4e82-94f1-036632100701
0  	xul.dll  	PresShell::DispatchSynthMouseMove  	 layout/base/nsPresShell.cpp:4424
1 	xul.dll 	nsViewManager::ProcessSynthMouseMoveEvent 	view/src/nsViewManager.cpp:1809
2 	xul.dll 	nsSynthMouseMoveEvent::Run 	view/src/nsViewManager.cpp:1669
3 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:547
4 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:118
5 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:216
6 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:199
7 	xul.dll 	xul.dll@0x31c583 	
8 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
9 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:175
10 	xul.dll 	xul.dll@0xa19373 	
11 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:192
12 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3624
13 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
14 	firefox.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591
15 	kernel32.dll 	BaseProcessStart 

It seems to me, the crash is something that should be fixed in the Mozilla code itself.

Comment 12

[Jono Xia]

I can now reproduce it reliably as well, using steps discovered by dchan.  STR:

1) ensure "Menu Item Usage v2" study. is running (use
chrome://testpilot/content/debug.html to set it to 3 if you need to)
2) Open All your studies > current studies and click the "more info" link for the Pilot Background Survey.
3) Leaving the survey window open, go back to the All Your Studies window.
4) Click the "more info" link for the "Menu Item Usage v2" study.
5) In the resulting, find If you don't want to submit your data this time,
"click here to cancel". and click the link

Comment 13

[Dietrich Ayala (:dietrich)]

code: http://hg.mozilla.org/mozilla-central/annotate/65c30e4ee631/layout/base/nsPresShell.cpp#l4424

per Jesus on irc, at targetView = nsIView::GetViewFor(aEvent->widget);

aEvent->widget is 0x000000000

Comment 14

[Martijn Wargers (dead)]

Attachment: testcase

Just load this testcase up from chrome://, then click on the button, a new window comes up (chromeless), then click on the button in that window to get the crash.

Comment 15

[Martijn Wargers (dead)]

Attachment: test extension

This is a simple extension that lets you load up files in chrome:// when you put them under file:///C:/testfiles/ (I know, this is Windows centric, if you have linux/Mac, you'll have to change this in the chrome.manifest file yourself)
So if you put the testcase in there, you can load up chrome://tests/content/[name of the testfile] to load the testfile under chrome.

Comment 16

[Jono Xia]

Since this appears to be a Firefox bug that manifests in Test Pilot, as opposed to a Test Pilot bug, should we change its component?

Comment 17

[Tracy Walker [:tracy]]

Will this block beta1?

Comment 18

[Olli Pettay [:smaug][[e-mail]]]

Is this a regression?

Comment 19

[Olli Pettay [:smaug][[e-mail]]]

View manager shouldn't probably dispatch the synth mousemove if widget is null.

Comment 20

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Smaug, are you willing to write the patch?

Is it sufficient to check for a widget at the top of the function, or are we getting a view with a null widget out of the FindFloatingViewContaining call (in which case maybe we should be changing FindFloatingViewContaining)?

Comment 21

[abittner]

this bug is duplicate of

https://bugzilla.mozilla.org/show_bug.cgi?id=576232

Comment 22

[Martijn Wargers (dead)]

abittner, yes, it is. Thanks for mentioning.
Unfortunately, that one wasn't noticed earlier. And since this bug now contains more information and the actual patch, I have to dupe that bug against this one.

Comment 25

[Carsten Book [:Tomcat]]

just for reference here is the overview from crash-stats for this crash 

http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&date=2010-07-07%2015%3A00%3A00&signature=PresShell%3A%3ADispatchSynthMouseMove%28nsGUIEvent*%2C%20int%29&version=Firefox%3A4.0b1

Comment 26

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

FindFloatingViewContaining already checks for a widget, so it should be enough to check for a widget on mRootView.

Comment 27

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Comment on attachment 458469 [details] [diff] [review]
fix

r=dbaron

Comment 28

[Mike Beltzner [:beltzner, not reading bugmail]]

roc: you landing this?

Comment 29

[Robert O'Callahan (:roc) (email my personal email if necessary)]

http://hg.mozilla.org/mozilla-central/rev/24e7b07abd21