728707 - Crash @ DragDataProducer::Produce

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Scoobidiver (away)]

It's a new crash signature that first appeared in 13.0a1/20120218.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2271cb92cc05&tochange=550779e6bab4
It's likely a regression from bug 499008.

Signature 	DragDataProducer::Produce(nsDOMDataTransfer*, bool*, nsISelection**, nsIContent**) More Reports Search
UUID	403018ea-3c4e-4fb2-a303-e365d2120219
Date Processed	2012-02-19 13:42:39
Uptime	2148
Install Age	11.1 hours since version was first installed.
Install Time	2012-02-19 02:35:33
Product	Firefox
Version	13.0a1
Build ID	20120218031156
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 15 model 6 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x29c2, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.15.10.1930
D3D10 Layers? D3D10 Layers-
D3D9 Layers? D3D9 Layers-
EMCheckCompatibility	True	
Total Virtual Memory	2147352576
Available Virtual Memory	1765216256
System Memory Use Percentage	43
Available Page File	3095023616
Available Physical Memory	1205964800

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	DragDataProducer::Produce 	content/base/src/nsContentAreaDragDrop.cpp:697
1 	xul.dll 	nsContentAreaDragDrop::GetDragData 	content/base/src/nsContentAreaDragDrop.cpp:155
2 	xul.dll 	nsEventStateManager::DetermineDragTarget 	content/events/src/nsEventStateManager.cpp:2191
3 	xul.dll 	nsEventStateManager::GenerateDragGesture 	content/events/src/nsEventStateManager.cpp:2089
4 	xul.dll 	nsEventStateManager::PreHandleEvent 	content/events/src/nsEventStateManager.cpp:1146
5 	xul.dll 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6628
6 	xul.dll 	nsGenericElement::Release 	content/base/src/nsGenericElement.cpp:4949
7 	xul.dll 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6316
8 	xul.dll 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6143
9 	nspr4.dll 	PR_IntervalToMicroseconds 	nsprpub/pr/src/misc/prinrval.c:151
10 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:908
11 	nspr4.dll 	md_UnlockAndPostNotifies 	nsprpub/pr/src/md/windows/w95cv.c:184
12 	nspr4.dll 	md_UnlockAndPostNotifies 	nsprpub/pr/src/md/windows/w95cv.c:193
13 	user32.dll 	SendMessageW 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=DragDataProducer%3A%3AProduce%28nsDOMDataTransfer*%2C%20bool*%2C%20nsISelection**%2C%20nsIContent**%29

Comment 1

[Scoobidiver (away)]

It's #10 top crasher in 13.0a1 over the last day.

Comment 2

[Neil Deakin]

Attachment: patch

Looks like an error result check got lost here.

Comment 3

[Neil Deakin]

Comment on attachment 599132 [details] [diff] [review]
patch

Not sure how to reproduce so I can't create a test.

Comment 4

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/6472583e5523

Comment 5

[Scoobidiver (away)]

I see one crash after the patch landed: bp-d1f610a8-d0be-4f59-b510-880a82120225.

Comment 6

[test_test_testing]

I can consistently reproduce (bp-ecafe7e6-1f27-4549-88bd-f00d32120226).

STR:
go to fanfic reviews page (http://www.fanfiction.net/r/5782108/17/1/)
in the top-right corner there is a drop-down box thing to select the chapter.
click to make the drop-down list appear, and choose some random chapter.
the page will begin loading that page. before the page has loaded, click to drop-down again.
the drop-down list will persist across the page-load, and firefox will crash when you try to scroll the drop-down list.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Comment 6 is not about this bug. Could you please file a new bug and CC Neil and me to it.

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Comment 5 and 6 are about the same bug.

Comment 9

[test_test_testing]

Added comment on bug 574842, which seemed like the issue I encountered.