68488 - Invalid page fault in JSDOM.DLL -- related to setTimout/clearTimeout? -N610 & Trunk [@ GlobalWindowImpl::DropTimeout]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Will Martin]

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
BuildID:    2001010901

I've been working on a cross-browser pop-up menu script for this page;  it 
works fine in NS 4.x and IE 4.x and up.  In Mozilla build 2001010901, the menus 
a) vanish too soon, as though the TimerID that governs their scheduled 
disappearance time is not being cleared when the user mouses-over the menu. b) 
Sometimes after you've opened and closed several of the menus in quick 
succession, Mozilla will crash and Windows will display a page fault error 
message about JSDOM.DLL. (See Additional Information for copies of this error).

For the source file of the menu script, go to:

http://www.atuan.com/ship/scripts/menus.js

For the CSS file:

http://www.atuan.com/ship/scripts/ship.css

Both the .js file and the HTML file are heavily commented.

I tried uninstalling and reinstalling Mozilla, but that didn't help.  Oddly, I 
was *not* able to reproduce the crash when I tried it on a neighbor's box under 
Win 2000 using the same build of Mozilla. (I have 98 SE).  This is why I have 
the reproducibility set to "Sometimes, but not always."

In one instance, Mozilla would not start properly after a crash had occurred; 
an instance of "Mozilla" appeared in the list of processes I got using 
CTRL+ALT+DEL, but the splash screen never appeared and the browser did not 
start.  I tried again, and had to instances of "Mozilla" in the processes 
screen.  I killed one of those processes with the End Task button, and then the 
second one suddenly got its act together and continued loading as it might have 
normally.

Reproducible: Sometimes
Steps to Reproduce:
1.  Go to http://www.atuan.com/ship/index-beta4.html

2.  Move your mouse over the links Program, OIE, and Links to bring up sub-
menus; then move your mouse over the sub menu.  It should vanish after a second.

3.  Repeat until the browser crashes.  (Usually takes a minute or two, note 
that sub-menus will disappear without delay if you move your mouse over any 
link in the parent table, for example Current Events, Site Map or SHIP Home).

Actual Results:  Actual results are as stated above.

Expected Results:  The expected behavior is this:

1) User mouses over parent link; sub-menu is made visible.

2) User moves mouse off of parent link; function HideDelay() called, 
which sets a timeout calling the function that hides sub-menus.

3) If user mouses over visible subment, all pending calls to Hide() are 
cancelled, thereby extending the visibility of the sub-menu.

4) If user moves mouse off of sub-menu, HideDelay() is called again so that the 
sub-menu will vanish once it's no longer necessary.

The HTML includes a layer tag for onMouseOver/Out recognition in NS 4.x 
browsers, but that shouldn't affect Mozilla, as it simply ignores the layer 
tag.  For IE and Mozilla, duplicate MouseOver/Out events are put into the table 
tag that defines the sub menu instead, and the whole thing is encapsulated in a 
div tag which defines the sub-menus ID, position information, and visibility.

I've reproduced the crash several times; here are two copies (slightly 
different) of the information Windows provided in the crash notice:

MOZILLA caused an invalid page fault in
module JSDOM.DLL at 0167:60b2b497.
Registers:
EAX=00000000 CS=0167 EIP=60b2b497 EFLGS=00010246
EBX=0068fb6c SS=016f ESP=0068fa94 EBP=0068fab0
ECX=00000000 DS=016f ESI=008e4620 FS=621f
EDX=00000000 ES=016f EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 41 2c 3b c7 74 13 8b 08 50 ff 51 34 50 ff 15 
Stack dump:
00f93ab0 008e4620 00000001 00000000 0117f2f0 008e0580 00000000 0068fb10 
60b2b6e5 008e4620 00000000 008e0580 60a91088 008e0580 008e4620 008e0580 


MOZILLA caused an invalid page fault in
module JSDOM.DLL at 0167:60b2b497.
Registers:
EAX=00000000 CS=0167 EIP=60b2b497 EFLGS=00010246
EBX=bff5580d SS=016f ESP=0068fbdc EBP=0068fbf8
ECX=00000000 DS=016f ESI=0164e6e0 FS=112f
EDX=00000000 ES=016f EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 41 2c 3b c7 74 13 8b 08 50 ff 51 34 50 ff 15 
Stack dump:
00bd0a50 0164e6e0 00000001 00000000 01736d70 0164e650 00000000 0068fc78 
60b2b6e5 0164e6e0 00000000 0164e650 60a91088 0164e650 0164e6e0 0164e650 

The two reports are very similar, but note the different values in the EBX 
field and the stack dump.  I don't know if these cryptic Windows error messages 
will be any help, but thought I'd throw them in anyway.

There are an awful lot of calls to setTimeout and clearTimeout flying around in 
this script;  I suspect that the problem is related to this.

I sure hope that's enough information.

Comment 1

[HJ]

Lucky me, did not see that crash on build 2001020906 (NT4).

note: that timer issue is a dup of another recent bug.

Comment 2

[Keyser Sose]

WORKSFORME
Platform: PC
OS: Linux 2.2.16
Mozilla Build: 2001021408

Reporter try downloading the latest nighties at
http://www.mozillazine.org/build_comments/ and create a new profile. See if that
fixes the problem.

Comment 3

[Will Martin]

Okay, installed the nightly build and created a new profile.  Unfortunately, 
this did not help.  It crashed again for me several times.  Yet another crash 
message, pretty much the same as the ones before:

MOZILLA caused an invalid page fault in
module JSDOM.DLL at 0167:60b571b2.
Registers:
EAX=00000000 CS=0167 EIP=60b571b2 EFLGS=00010246
EBX=0068fb70 SS=016f ESP=0068fa98 EBP=0068fab4
ECX=00000000 DS=016f ESI=01abcd70 FS=121f
EDX=00000000 ES=016f EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 41 2c 3b c7 74 13 8b 08 50 ff 51 34 50 ff 15 
Stack dump:
00898c50 01abcd70 00000001 00000000 0126f770 01abcd00 00000000 0068fb14 
60b59436 01abcd70 00000000 01abcd00 60ab3859 01abcd00 01abcd70 01abcd00 

Interestingly, when I was using the Mozilla 0.8 build (2001021508, NOT the 
nightly build) it crashed and pointed the finger at a different file, 
MSCVRT.DLL.  Unfortunately I failed to make a copy of that crash notice, and it 
hasn't done it again. :-/

Comment 4

[Keyser Sose]

Reporter do you have the talkback ID's for these crashes? Just run the 
talkback.exe and get the numbers out of it.

Comment 5

[Will Martin]

Okay, downloaded a fresh nightly and crashed it again.  I used Talkback and 
sent in the information; or, you can get a copy of all the Talkback info at: 
http://www.atuan.com/Details.txt

Also, here is the crash info that Windows generated for the crash that Talkback 
recorded:

MOZILLA caused an invalid page fault in
module JSDOM.DLL at 0167:60b87f18.
Registers:
EAX=00000000 CS=0167 EIP=60b87f18 EFLGS=00010246
EBX=0068fb70 SS=016f ESP=0068fa98 EBP=0068fab4
ECX=00000000 DS=016f ESI=0252cad0 FS=1267
EDX=00000000 ES=016f EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 41 2c 3b c7 74 13 8b 08 50 ff 51 34 50 ff 15 
Stack dump:
01acd6d0 0252cad0 00000001 00000000 01e05ea0 0252cc90 00000000 0068fb14 
60b8ab07 0252cad0 00000000 0252cc90 60ae38a4 0252cc90 0252cad0 0252cc90

Should I stop posting these Windows crash things?  I don't know whether they're 
of any use or not, but I suspect not.

Comment 6

[Keyser Sose]

Do you have the talkback ID?

Comment 7

[Will Martin]

>Do you have the talkback ID?

I don't understand.  I saw nothing labelled talkbalk ID when talkback ran.  
Where do I retrieve this number?  I'm happy to give it to you, and I'm sure I 
have it someplace -- but where do I look for it?

Comment 8

[Keyser Sose]

Goto <Mozilla Directory>\components\talkback.exe and run the program. Under
incident ID is the number. If you could paste that here it would be a lot of
help. Thanks in advance.

Comment 9

[Will Martin]

Right, got it.  The incident ID number is: TB27687823Y

And I'm the one who should be thanking *you* . . . after all, you're going to 
be doing the *hard* work. ;-)

Comment 10

[Keyser Sose]

Heh dont worry I do it because I love mozilla :)

Comment 11

[Asa Dotzler [:asa]]

 JSDOM.DLL + 0x7f40 (0x60b87f40)
             JSDOM.DLL + 0xab55 (0x60b8ab55)
             GKWIDGET.DLL + 0x3892 (0x60ae3892)
             GKWIDGET.DLL + 0x386e (0x60ae386e)
             KERNEL32.DLL + 0x2317 (0xbff72317)
             GKWIDGET.DLL + 0x37a8 (0x60ae37a8)
             0x37a80003
             0xe99a006a
             0x006c0062  

Comment 12

[Keyser Sose]

Reporter this still a problem in the latest nightlies?

Comment 13

[Will Martin]

Yup, still there.

I just downloaded and installed a fresh nightly and crashed it.

Talkback ID #TB28584710Z

Comment 14

[James Green]

Marking new.

Comment 15

[John Bandhauer]

*** Bug 90831 has been marked as a duplicate of this bug. ***

Comment 16

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There was a comment in most of the talkback reports with the signature
GlobalWindowImpl::DropTimeout pointing to the bug just marked a duplicate of
this one, so making this bug the one for that topcrash.  However, since almost
all of the talkback reports mentioned this bug in the comments, I suspect it's
not really a topcrash, but marking as one so there isn't a separate bug filed
for it.

GlobalWindowImpl::DropTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp line 3566] 
 nsGlobalWindow_RunTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp line 3708] 
 nsTimer::Fire [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp
line 196] 
 nsTimerManager::FireNextReadyTimer
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp line
117] 
 nsAppShell::Run [d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp
line 118] 
 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp line 422] 
 main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp line 1181] 

Comment 17

[Jay Patel [:jay]]

I have personally experienced this crash twice today with the latest N610 branch
build.  This is also a topcrasher on the branch. 
Here are my 2 crashes:

Incident ID 33237801
Stack Signature GlobalWindowImpl::DropTimeout 93df214e
Bug ID
Trigger Time 2001-07-23 10:32:43
User Comments I was trying to play an mpeg animation for the new airlock thingie
on the international spacestation. windows media player opened and started
playing the movie and at some point netscape 6 just bombed out.
Build ID 2001072306
Product ID Netscape6.10
Platform ID Win32
Stack Trace
GlobalWindowImpl::DropTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3568]
nsGlobalWindow_RunTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3717]
nsTimer::Fire [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 196]
FireTimeout [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 78]
USER32.dll + 0x185c (0x77e7185c)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 426]
netscp6.exe + 0x16f0 (0x004016f0)
netscp6.exe + 0x11b8 (0x004011b8)
netscp6.exe + 0x3366 (0x00403366)
KERNEL32.dll + 0x1ba06 (0x77f1ba06) 

Incident ID 33244548
Stack Signature GlobalWindowImpl::DropTimeout 93df214e
Bug ID
Trigger Time 2001-07-23 13:20:43
User Comments i was trying to send an email through a mailto: link at the above
url and as soon as the compose window opened and i started typing my message, boom!
Build ID 2001072306
Product ID Netscape6.10
Platform ID Win32
Stack Trace
GlobalWindowImpl::DropTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3568]
nsGlobalWindow_RunTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3717]
nsTimer::Fire [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 196]
FireTimeout [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 78]
USER32.dll + 0x185c (0x77e7185c)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 426]
netscp6.exe + 0x16f0 (0x004016f0)
netscp6.exe + 0x11b8 (0x004011b8)
netscp6.exe + 0x3366 (0x00403366)
KERNEL32.dll + 0x1ba06 (0x77f1ba06) 

and some info from the N610 branch Talkback topcrash report:

GlobalWindowImpl::DropTimeout   10
			 68488 	 NEW 	  	 [e-mail] mozilla0.9.3 
     First BBID :32903447
     Last BBID  :33212106
     Min Runtime :67
     Max Runtime :68109
     First Appearance Date : 2001-07-14
     Last Appearance Date : 2001-07-22
     First BuildID : 2001071306
     Last BuildID : 2001072206

Stack Trace: 

	 GlobalWindowImpl::DropTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp  line 3568]
	 nsGlobalWindow_RunTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp  line 3717]
	 nsTimer::Fire
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp  line 196]
	 nsTimerManager::FireNextReadyTimer
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp  line 117]
	 nsAppShell::Run
[d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp  line 118]
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 426]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1234]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1534]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1552]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x1b560 (0xbff8b560)
	 KERNEL32.DLL + 0x1b412 (0xbff8b412)
	 KERNEL32.DLL + 0x19dd5 (0xbff89dd5)
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/dom/src/base/nsGlobalWindow.cpp
line : 3568
     (33209471)	Comments: no
     (33209433)	Comments: opening an excel file from mail message (file was sent as an
attachment)
     (33205956)	Comments: Saved an html file to local disk. 
     (33187039)	Comments: saved a microsoft word document...
     (32903492)	Comments: same page - will include URL next time
     (32903447)	Comments: cursor was getting stuck in text input fields

There were also 18 of these crashes in the MozillaTrunk report, but all the
comments mentioned bug 90831, so I'm guessing one person was crashing often there.

Also note that although the N610 branch Talkback data only shows 10 crashes, I
did a query just now, and there are A LOT of these crashes in the last couple of
days with the N610 branch builds that are not reflected in today's topcrash
report...but they sure will be tommorrow! 

Comment 18

[Jay Patel [:jay]]

internal folks can access the talkback query for this crash here:

http://climate/reports/searchstacksignature.cfm?stacksig=GlobalWindowImpl%3A%3ADropTimeout

Comment 19

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I'd have thought jst's fix for bug 55459 might have fixed this, but maybe it
made it worse instead.

Comment 20

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Hopefully fixed with jst's fix for bug 91919?

Comment 21

[selmer (gone)]

Can anyone verify this fixed on today's branch?

Comment 22

[Jay Patel [:jay]]

So far I don't see any of these crashes with today's build in Talkback data, but
it's still too early to verify the fix based just on today's Talkback data.  If
I don't see any show up in the next day or so, I'll mark this resolved.

Comment 23

[Will Martin]

>If I don't see any show up in the next day or so, I'll mark this resolved.

Well, it was a nice thought.  I just downloaded a fresh nightly and crashed it. 
Same URL as the original crash above, same behavior.  I just sat and popped 
menus up and down for about 2 and a half minutes until it crashed on me.

Talkback ID #: TB33299607K.

Mozilla build 2001072403.

Will Martin

Comment 24

[Johnny Stenback (:jst)]

Will, was that a trunk build or a mozilla0.9.2 (i.e. Netscape 6.1 branch) build?
This is not fixed on the mozilla trunk yet, it's only fixed on the branch.

Comment 25

[Jay Patel [:jay]]

Yes, Will's crash was with the MozillaTrunk.  I don't see any crashes with N610
branch builds after 2001072306...so this seems fixed on the branch, but still
needs to be fixed on the MozillaTrunk.  Here is Will's last entry:

Incident ID 33299607
Stack Signature GlobalWindowImpl::DropTimeout 68eacd10
Bug ID
Trigger Time 2001-07-24 17:55:34
User Comments See bug #68488
Build ID 2001072409
Product ID MozillaTrunk
Platform ID Win32
Stack Trace
GlobalWindowImpl::DropTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3554]
nsGlobalWindow_RunTimeout
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 3696]
nsTimer::Fire [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 196]
nsTimerManager::FireNextReadyTimer
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp, line 117]
FireTimeout [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 91]
KERNEL32.DLL + 0x2317 (0xbff72317)
FireTimeout [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp,
line 51]
USER32.DLL + 0x3bb5 (0xbff53bb5)
0x2b120003
0x8bf2468b 

Comment 26

[Jay Patel [:jay]]

*** Bug 91992 has been marked as a duplicate of this bug. ***

Comment 27

[chris hofmann]

jst,  any ideas on why this seems to be fixed on the branch but not on the trunk?

Comment 28

[Johnny Stenback (:jst)]

This should now be fixed on the trunk as well, the fix for bug 55459 should've
fixed this bug too.

Comment 29

[Blake Ross]

*** Bug 92924 has been marked as a duplicate of this bug. ***

Comment 30

[Blake Ross]

*** Bug 94443 has been marked as a duplicate of this bug. ***

Comment 31

[Prashant Desale]

Originally there were two problems discussed in this bug.

A) The menus vanish too soon, as though the TimerID that governs their scheduled 
disappearance time is not being cleared when the user mouses-over the menu. 
B) Sometimes after you've opened and closed several of the menus in quick 
succession, Mozilla will crash and Windows will display a page fault error 
message about JSDOM.DLL.

So the problem "B" [Crash] seems to be fixed, BUT the problem "A" [Vanishing 
menus] is still there.

Re-opening bug.

Comment 32

[Johnny Stenback (:jst)]

Please file the remaining problem as a separate bug if it's still a problem,
marking Fixed again.

Comment 33

[Prashant Desale]

I filed another bug 102792 for menu vainishin problem. This crash was tested on 
trunk as well as branch, so marking verified.