57903 - Selecting Applet when mouseover attribute attached crashes

Status: VERIFIED WORKSFORME

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[Brian Wilson]

From Bugzilla Helper:
User-Agent: Mozilla/4.7 [en] (WinNT; I)
BuildID:    2000102404

The above URL just echos what you will find here - the crashing code and 
behavior is very simple:
Selecting some text adjacent to the applet with an event handler (in this case a 
onmouseover event), drag-select the applet itself.

Reproducible: Always
Steps to Reproduce:
1. Load the indicated URL or this code in the browser:
   before
   <applet height=100 width=100 code="foo.class" onmouseover=""></applet>
   after
2. Select the word "after"
3. While the mouse is still depressed, drag the mouse over the applet


Actual Results:  browser crashes                     

Expected Results:  event should be fired and attached code or function call 
should be executed.

pasting HTML again here for good measure:

before
<applet height=100 width=100 code="foo.class" onmouseover=""></applet>
after
----
Same code also crashes NS6B1 (NT4), and NS6B3 (W2k)

Comment 1

[Loco]

True enough.  Funky.  In the status bar:
"Applet Error: Closing"
VERIFIED on Mac 10-24.  Marking OS and Plat to ALL.

Reporter-How popular is this feature?  Should this be nominated for RTM?  It 
seems like this may be a big deal since there are quite a few applets out there, 
and if you happen to select text next to it and go over, you'll crash the box...
Nominating for RTM anyway, though I realize its late.  Any thoughts?

Comment 2

[lchiang]

I wonder if this is a topcrash in Talkback.  

Comment 3

[selmer (gone)]

Brian, do you have a stack trace from the talkback?  If there is a simple fix
for this, it _may_ be considered for RTM...

Comment 4

[Joseph Elwell]

From talkback report : 19909347.

Call Stack:    (Signature = JS_CompileUCFunctionForPrincipals e6512b99) 
     
   JS_CompileUCFunctionForPrincipals 
                                              
[d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 2967]
     
   nsJSContext::CompileEventHandler 
                                              
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 809]
     
   nsEventListenerManager::HandleEventSubType 
                                              
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
773]
     
   nsEventListenerManager::HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
942]
     
   nsGenericElement::HandleDOMEvent 
                                              
[d:\builds\seamonkey\mozilla\layout\base\src\nsGenericElement.cpp, line 1405]
     
   nsHTMLDivElement::HandleDOMEvent 
                                              
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLDivElement.cpp, line 
222]
     
   nsEventStateManager::GenerateMouseEnterExit
                                              
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
1524]
     
   nsEventStateManager::PreHandleEvent 
                                              
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
306]
     
   PresShell::HandleEventInternal 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4913]
     
   PresShell::HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4853]
     
   nsView::HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 379]
     
   nsView::HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 352]
     
   nsViewManager2::DispatchEvent 
                                              
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1439]
     
   HandleEvent 
                                              
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68]
     
   nsWindow::DispatchEvent 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 686]
     
   nsWindow::DispatchWindowEvent 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 703]
     
   nsWindow::DispatchMouseEvent 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3905]
     
   ChildWindow::DispatchMouseEvent 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4113]
     
   nsWindow::ProcessMessage 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2998]
     
   nsWindow::WindowProc 
                                              
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 959]
     
   USER32.dll + 0x1268 (0x77e71268) 
                                               
     
   0x00660091 

Comment 5

[Nisheeth Ranjan]

Marking [rtm need info]

Comment 6

[Phil Peterson]

PDT marking [rtm-] since apparently no one is looking at this, and it doesn't
seem like end users will encounter this frequently enough to hold for it.

Comment 7

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Changing crasher bug milestone to mozilla0.9.

Comment 8

[Zach Lipton [:zach]]

Can we get someone to look at this and get a quick estimate of time to fix 
and what is causing this?

Comment 9

[Hixie (not reading bugmail)]

Reassigning QA Contact for all open and unverified bugs previously under Lorca's
care to Gerardo as per phone conversation this morning.

Comment 10

[joki (gone)]

Not crashing in my current tree.  I'll check a verification tree to see if its 
my local changes or not but either way it is or soon will be fixed.

Comment 11

[joki (gone)]

Okay, I've pulled and tested on an unchanged verification tree and it works 
fine.  Exactly the same action crashes my old 6.0 tree so I know I'm recreating 
it correctly.  Marking WORKSFORME.

Comment 12

[Madhur Bhatia]

QA contact updated

Comment 13

[luis rincon]

verified on build 2000-08-07 and 2001-07-09