81779 - Mozilla crashes if you higlight and repeatedly drag text. - M099, N622, Trunk [@ nsDragService::SourceDataGet]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Christopher Curzio]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.4 i686; en-US; rv:0.9+) Gecko/20010518
BuildID:    2001051813

On pretty much every page with text, you can rapidly highlight and drag the text
around and there's a good chance Mozilla will crash. I haven't tried this action
inside a form, but text on a page will do it.

Reproducible: Sometimes
Steps to Reproduce:
1.Highlight some text
2.Drag the text around inside the page
3.Repeat quickly

Actual Results:  Mozilla Crashes

Expected Results:  Not crash?

Comment 1

[Harald Glatt]

worksforme on win2k sp2 2001051820

Comment 2

[Asa Dotzler [:asa]]

updating component.

Comment 3

[Christopher Curzio]

Just attempted to duplicate this bug on Build 2001052308, and I managed to crash
it again. It's hard to explain HOW to duplicate it, but I find the best way to
make it crash is to highlight a paragraph of text, and quickly drag that text
from left to right inside the browser window. Don't deselect the text if
possible, and if you do, just re-highlight it and start quickly dragging again.

I've been able to duplicate this bug every time now.

Comment 4

[Terri Preston]

hmm, works for me linux build 2001052310, reporter, is there something special 
about your setup?  I'm running Redhat and see no issues

Comment 5

[Christopher Curzio]

Terri,

Nope. Nothing special here. I'm probably not verbalizing the process accurately,
but it's the best I can do. 

Try it on a page with a table. Drag the text around inside the table. That might
have something to do with it.

Comment 6

[Gregory McLean]

I Can reproduce this on Linux Build 2001052210.

Steps to reproduce.

1. Highlight a block of text.
2. Drag and Drop the text on itself rapidly multiple times.

I would post some talkback id's but the current nightly talkback's are busted here:


 Hey : You are in QFA Startup 
(QFA)Talkback error: Can't initialize.
Hey : You are in QFA Shutdown 

Comment 7

[Christopher Curzio]

I've discovered the bug isn't HTML dependant. It crashes while dragging inside
plain .txt documents as well. 

I've also verified it on two different boxes running two different Linux
distributions. (RedHat 6.2 and Slackware 7.1)

Comment 8

[Jaime Rodriguez, Jr.]

Jpatel - Per PDT, pls look through stack to see if there is other instances of
this crash in the data base.

Comment 9

[Shiva Thirumazhusai]

Move talkback directory from components directory to one level above.
and try to crash once again.

I will update once I can reproduce the crash.

Comment 10

[Christopher Curzio]

I've managed to Crash Mozilla and pop up the Talkback Agent. I've submitted two
talkback IDs. 

TB30858127G
TB30858006X

Comment 11

[Jay Patel [:jay]]

Here is the Talkback data for Christopher's most recent crash:

Incident ID 30858127 
 Trigger Time 
                2001-05-24 08:23:00  
 User Comments 
                Dragging Highlighted Text 
 Build ID
                2001052308 
 Product ID
                MozillaTrunk 
 Platform ID
                LinuxIntel 
 Stack Trace

nsDragService::SourceDataGet() 
invisibleSourceDragDataGet() 
libgtk-1.2.so.0 + 0x8e371 (0x40266371) 
libgtk-1.2.so.0 + 0xbb9bd (0x402939bd) 
libgtk-1.2.so.0 + 0xbae02 (0x40292e02) 
libgtk-1.2.so.0 + 0xb9229 (0x40291229) 
libgtk-1.2.so.0 + 0x60074 (0x40238074) 
libgtk-1.2.so.0 + 0x8e32d (0x4026632d) 
libgtk-1.2.so.0 + 0xbb9bd (0x402939bd) 
libgtk-1.2.so.0 + 0xbae02 (0x40292e02) 
libgtk-1.2.so.0 + 0xb9229 (0x40291229) 
libgtk-1.2.so.0 + 0xb82c8 (0x402902c8) 
libgtk-1.2.so.0 + 0xb7443 (0x4028f443) 
libgtk-1.2.so.0 + 0x5d226 (0x40235226) 
nsDragService::GetTargetDragData() 
nsDragService::GetData() 
XPTC_InvokeByIndex() 
XPCWrappedNative::CallMethod() 
XPC_WN_CallMethod() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_Interpret() 
js_Invoke() 
js_InternalInvoke() 
JS_CallFunctionValue() 
nsJSContext::CallEventHandler() 
nsJSEventListener::HandleEvent() 
nsEventListenerManager::HandleEventSubType() 
nsEventListenerManager::HandleEvent() 
nsXULElement::HandleDOMEvent() 
nsXULElement::HandleDOMEvent() 
nsXULElement::HandleDOMEvent() 
nsXULElement::HandleChromeEvent() 
GlobalWindowImpl::HandleDOMEvent() 
nsDocument::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericElement::HandleDOMEvent() 
nsGenericDOMDataNode::HandleDOMEvent() 
nsTextNode::HandleDOMEvent() 
PresShell::HandleEventInternal() 
PresShell::HandleEvent() 
nsView::HandleEvent() 
nsView::HandleEvent() 
nsView::HandleEvent() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWidget::DispatchMouseEvent() 
nsWindow::OnDragDropSignal() 
nsWindow::DragDropSignal() 
libgtk-1.2.so.0 + 0x8ded5 (0x40265ed5) 
libgtk-1.2.so.0 + 0xbb9bd (0x402939bd) 
libgtk-1.2.so.0 + 0xbae02 (0x40292e02) 
libgtk-1.2.so.0 + 0xb9229 (0x40291229) 
libgtk-1.2.so.0 + 0x5eb58 (0x40236b58) 
libgtk-1.2.so.0 + 0x5e370 (0x40236370) 
libgtk-1.2.so.0 + 0x5dc6f (0x40235c6f) 
libgtk-1.2.so.0 + 0x8d0ca (0x402650ca) 
handle_gdk_event() 
libgdk-1.2.so.0 + 0x1753b (0x4031053b) 
libglib-1.2.so.0 + 0x10186 (0x40340186) 
libglib-1.2.so.0 + 0x10751 (0x40340751) 
libglib-1.2.so.0 + 0x108f1 (0x403408f1) 
libgtk-1.2.so.0 + 0x8c8e9 (0x402648e9) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x189cb (0x404399cb) 

Talkback data only shows 2 recent crashes (both of Christopher's submissions) 
with build 2001052308.  However, I also found a lot of crashes with Mozilla 0.9 
(Linux build 2001050522)...which indicates that this has potential to be a 
topcrasher with our next major milestone/release.

Comment 12

[Kathleen :Brade]

Is this still a problem in today's builds?  There was a bug in bidi selection 
which *might* have been causing problems when gtk was looking at the selection 
(?).

Comment 13

[Blake Ross]

Christopher, are you still seeing this bug?

I don't have linux.  --> toolkit/pink per stack

Comment 14

[Christopher Curzio]

I just loaded build 2001052721, and it seems to be fixed. I can't get it to
crash any longer. 

I'll let you know if I see it again, and I'll reopen the bug. Otherwise, good work!

Comment 15

[Christopher Curzio]

Oops.

Turns out the Resolution was a bit premature. The bug is still there. It just
crashed on me, so I submitted yet another talkback ID.

TB31007913H

Comment 16

[Mike Pinkerton (not reading bugmail)]

--> blizard

Comment 17

[Christopher Blizzard (:blizzard)]

Neat.  I can reproduce this but I suspect that most people aren't going to
stumble over it.

Comment 18

[Christopher Curzio]

This bug is still present as of build #2001102608

Comment 19

[Jay Patel [:jay]]

Adding M095, N620 [@ nsDragService::SourceDataGet] to summary for tracking. 
Looking at Talkback data, I saw many crashes with Mozilla 0.9.4 and 0.9.5, a few
with recent MozillaTrunk builds and one so far with Netscape 6.20.  This has
potential to be topcrasher, so adding topcrash keyword as well.

Here's the most recent incident reported (with Netscape 6.20 RTM):

Incident ID 37442716
Stack Signature nsDragService::SourceDataGet() c1579b43
Trigger Time 2001-10-31 04:31:00
Email Address
URL Visited Deu pau!
User Comments
Build ID 2001102217
Product ID Netscape6.20
Platform ID LinuxIntel
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
nsDragService::SourceDataGet()
invisibleSourceDragDataGet()
libgtk-1.2.so.0 + 0x8c069 (0x4026d069)
libgtk-1.2.so.0 + 0xb879d (0x4029979d)
libgtk-1.2.so.0 + 0xb7c32 (0x40298c32)
libgtk-1.2.so.0 + 0xb6139 (0x40297139)
libgtk-1.2.so.0 + 0x5ef74 (0x4023ff74)
libgtk-1.2.so.0 + 0x8c02d (0x4026d02d)
libgtk-1.2.so.0 + 0xb879d (0x4029979d)
libgtk-1.2.so.0 + 0xb7c32 (0x40298c32)
libgtk-1.2.so.0 + 0xb6139 (0x40297139)
libgtk-1.2.so.0 + 0xb524b (0x4029624b)
libgtk-1.2.so.0 + 0xb4411 (0x40295411)
libgtk-1.2.so.0 + 0x5c226 (0x4023d226)
nsDragService::GetTargetDragData()
nsDragService::GetData()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
nsXPCWrappedJSClass::CallMethod()
nsXPCWrappedJS::CallMethod()
PrepareAndDispatch()
nsXPTCStubBase::Stub3()
nsXULOutlinerBuilder::CanDropOn()
nsOutlinerBodyFrame::OnDragOver()
nsOutlinerBoxObject::OnDragOver()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
nsJSContext::CallEventHandler()
nsJSEventListener::HandleEvent()
nsXBLPrototypeHandler::ExecuteHandler()
nsXBLDragHandler::DragOver()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWindow::OnDragMotionSignal()
nsWindow::DragMotionSignal()
libgtk-1.2.so.0 + 0x8bc59 (0x4026cc59)
libgtk-1.2.so.0 + 0xb879d (0x4029979d)
libgtk-1.2.so.0 + 0xb7c32 (0x40298c32)
libgtk-1.2.so.0 + 0xb6139 (0x40297139)
libgtk-1.2.so.0 + 0x5d84f (0x4023e84f)
libgtk-1.2.so.0 + 0x5d304 (0x4023e304)
libgtk-1.2.so.0 + 0x5cc1f (0x4023dc1f)
libgtk-1.2.so.0 + 0x8af1a (0x4026bf1a)
handle_gdk_event()
libgdk-1.2.so.0 + 0x16cdb (0x40314cdb)
libglib-1.2.so.0 + 0xf9b6 (0x403419b6)
libglib-1.2.so.0 + 0xff71 (0x40341f71)
libglib-1.2.so.0 + 0x100e9 (0x403420e9)
libgtk-1.2.so.0 + 0x8a74d (0x4026b74d)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1896b (0x4043896b) 

And a few summaries - 

Mozilla 0.9.5:
Incident ID 37090422
Stack Signature nsDragService::SourceDataGet() 465aa998
Trigger Time 2001-10-23 16:53:29
URL Visited freshmeat.net
User Comments I dragged the url to the personal toolbar to see if it would add
it, instead it crashed.
Build ID 2001101202
Product ID MozillaBranch
Platform ID LinuxIntel

Incident ID 36978152
Stack Signature nsDragService::SourceDataGet() 84749dfc
Trigger Time 2001-10-21 08:47:41
User Comments local file browsing (it's slow BTW), somehow the cursor turned
into an corner icon like i was resizing the windows, then clicked one some
chrome to get rid of it. poof.
Build ID 2001101202
Product ID MozillaBranch
Platform ID LinuxIntel

Mozilla 0.9.4:
Incident ID 37304716
Stack Signature nsDragService::SourceDataGet() cb9f74cc
Trigger Time 2001-10-28 09:27:18
User Comments This is the famous drag-and-drop crash bug. There is one in every
version of netscape/unix since about forever (<= 4.x and >= 5.x)
Build ID 2001091311
Product ID Netscape6.20
Platform ID LinuxIntel
Incident ID 36603974
Stack Signature nsDragService::SourceDataGet() 4dd00176
Trigger Time 2001-10-12 06:50:21
User Comments drag and dropping the web page inside the mozilla
Build ID 2001091311
Product ID Netscape6.20
Platform ID LinuxIntel

Comment 20

[iraqispy]

I'm seeing the same problem on all of the Solaris 2.6 nightly builds since
20011216.  I get a segmentation fualt every time I drag any selected text. 
Builds before then (e.g. 20011215) have fairly functional drag & drop, so I
guess something broke on Saturday night.  Since this isn't PC Linux, should I
have started a new bug?

Comment 21

[Jay Patel [:jay]]

Updating summary with M097 and N621, since this crash continues to be a problem
with Mozilla 0.9.7 and Netscape 6.21.

Here are a few incident summaries for M097 (the stack is still the same as
originally reported):

 Incident ID 1522961   
Stack Signature  nsDragService::SourceDataGet() a88a9a6f
Trigger Time 2002-01-11 05:50:55
Email Address 
URL visited http://www.rediff.com/news/2002/jan/11army.htm
User Comments Selecting and deselecting some text repeatedly causes browser to crash
Build ID 2001122108
Product ID MozillaBranch
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
------------------------
 Incident ID 1776952   
Stack Signature  nsDragService::SourceDataGet() 98ce5f43
Trigger Time 2002-01-17 08:50:17
Email Address
URL visited
User Comments Clicked downthe left button and moved the cursor around the screen
left button held down.
Build ID 2001122108
Product ID MozillaBranch
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
-------------------------
 Incident ID 1989200   
Stack Signature  nsDragService::SourceDataGet() dd731ddf
Trigger Time 2002-01-22 16:47:19
Email Address 
URL visited doc.trolltech.com
User Comments blocking text (repeatedly, very quickly, as I was reading it)
Build ID 2001122108
Product ID MozillaBranch
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
------------------------
 Incident ID 2309467   Stack Signature  nsDragService::SourceDataGet() 323c5810
Trigger Time 2002-01-30 15:57:14
Email Address
URL visited
User Comments dragging an image around the screen (i was bored and watched the
trail the cursor made:) when i let the mousebutton go (dropped the image approx.
where i picked it up) mozilla crashed.
Build ID 2001122108
Product ID MozillaBranch
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)


I only found a couple of comments for crashes with N621:
(1727319)
Comments: moving a bookmark around
(1593046)
Comments: managing bookmarks


This is also still crashing with recent MozillaTrunk builds...here is the most
recent incident with helpful user comments:
 Incident ID 1905162   
Stack Signature  nsDragService::SourceDataGet() 9bb2f918
Trigger Time 2002-01-20 17:57:18
Email Address
URL visited
User Comments I was dragging selected text again and again like crazy.
Build ID 2002011108
Product ID MozillaTrunk
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
nsDragService::SourceDataGet()
invisibleSourceDragDataGet()
libgtk-1.2.so.0 + 0xa16e5 (0x402ae6e5) 

Also adding qawanted keyword to see if we can get a solid reproducible testcase.  

Comment 22

[Christopher Curzio]

Still reproducable on build 2002020208. Confirmed with a crash, and Talkback
submission.

Talkback ID: TB3103314Q

Comment 23

[Shiva Thirumazhusai]

Here is the incident submitted by titanic

Stack Signature  nsDragService::SourceDataGet() 31a4a4ae
Trigger Time 2002-02-19 08:41:03
Email Address [e-mail]
URL visited http://bugzilla.mozilla.org/
Build ID 2002020208
Product ID MozillaTrunk
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
User Comments Text Highlight/Drag & Drop. Please see Bugzilla Bug #81779.
Stack Trace
nsDragService::SourceDataGet()
invisibleSourceDragDataGet()
libgtk-1.2.so.0 + 0x8f2a0 (0x4029d2a0)
libgtk-1.2.so.0 + 0xbe9ec (0x402cc9ec)
libgtk-1.2.so.0 + 0xbde55 (0x402cbe55)
libgtk-1.2.so.0 + 0xbc296 (0x402ca296)
libgtk-1.2.so.0 + 0x60a2b (0x4026ea2b)
libgtk-1.2.so.0 + 0x8f269 (0x4029d269)
libgtk-1.2.so.0 + 0xbe9ec (0x402cc9ec)
libgtk-1.2.so.0 + 0xbde55 (0x402cbe55)
libgtk-1.2.so.0 + 0xbc296 (0x402ca296)
libgtk-1.2.so.0 + 0xbb23f (0x402c923f)
libgtk-1.2.so.0 + 0xba39c (0x402c839c)
libgtk-1.2.so.0 + 0x5d7fc (0x4026b7fc)
nsDragService::GetTargetDragData()
nsDragService::GetData()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
nsJSContext::CallEventHandler()
nsJSEventListener::HandleEvent()
nsEventListenerManager::HandleEventSubType()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleChromeEvent()
GlobalWindowImpl::HandleDOMEvent()
nsDocument::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWindow::OnDragDropSignal()
nsWindow::DragDropSignal()
libgtk-1.2.so.0 + 0x8eeec (0x4029ceec)
libgtk-1.2.so.0 + 0xbe9ec (0x402cc9ec)
libgtk-1.2.so.0 + 0xbde55 (0x402cbe55)
libgtk-1.2.so.0 + 0xbc296 (0x402ca296)
libgtk-1.2.so.0 + 0x5f2e8 (0x4026d2e8)
libgtk-1.2.so.0 + 0x5ea67 (0x4026ca67)
libgtk-1.2.so.0 + 0x5e2c6 (0x4026c2c6)
libgtk-1.2.so.0 + 0x8e00d (0x4029c00d)
handle_gdk_event()
libgdk-1.2.so.0 + 0x17127 (0x4034a127)
libglib-1.2.so.0 + 0x10308 (0x40378308)
libglib-1.2.so.0 + 0x10913 (0x40378913)
libglib-1.2.so.0 + 0x10aac (0x40378aac)
libgtk-1.2.so.0 + 0x8d7e7 (0x4029b7e7)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1d2eb (0x404ba2eb)

Comment 24

[Aleksander Adamowski]

Reproducable with method from comment #6, with linux trunk build 2002022306.
I need to drag selected text onto itself 14 times or so.
Talkback reports:
TB3286132E
TB3286173E

Comment 25

[Aleksander Adamowski]

The number of times the text needs to be dragged seems dependent on the
frequency of drags (you do it faster - you need less drags).

Comment 26

[Shiva Thirumazhusai]

nominating topcrash bugs for nsbeta1. 

Comment 27

[Pedro]

I have also encountered this bug while I was bored and repeatedly highlight a
section of text, drag and drop it inside mozilla, repeat without dehighlighting
the text.

Linux 2.4.17
Slackware 8.0
Build ID: 2002031008

Comment 28

[Arthur]

*** Bug 135628 has been marked as a duplicate of this bug. ***

Comment 29

[lchiang]

Is this a topcrash for Windows or Mac or only for Linux?
It looks like there are steps that several people have indicated for reproducing
this bug.  I am removing qawanted.

Comment 30

[Jay Patel [:jay]]

This is a Linux only crash according to Talkback data.  Adding testcase keyword
and making topcrash+ since people have been consistently crashing by simply
dragging text (or even images) rapidly in succession.  Here is a recent incident:

 Incident ID 4849208   
Stack Signature  nsDragService::SourceDataGet() 7e6ac519
Trigger Time 2002-04-05 01:15:58
Email Address
URL visited http://www.blinkenlights.ch/pge/pitschi-sma.png (for example!)
Build ID 2002040410
Product ID MozillaTrunk
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
User Comments drag the image and drop it into the mozilla window.. do this again
and again _very_ fast (you'll sea an animation of the paper returning.. be
faster than that animation!) -> crash
Stack Trace
nsDragService::SourceDataGet()
invisibleSourceDragDataGet()
libgtk-1.2.so.0 + 0x8f2a0 (0x402a02a0)
libgtk-1.2.so.0 + 0xbe9ec (0x402cf9ec)
libgtk-1.2.so.0 + 0xbde55 (0x402cee55)
libgtk-1.2.so.0 + 0xbc296 (0x402cd296)
libgtk-1.2.so.0 + 0x60a2b (0x40271a2b)
libgtk-1.2.so.0 + 0x8f269 (0x402a0269)
libgtk-1.2.so.0 + 0xbe9ec (0x402cf9ec)
libgtk-1.2.so.0 + 0xbde55 (0x402cee55)
libgtk-1.2.so.0 + 0xbc296 (0x402cd296)
libgtk-1.2.so.0 + 0xbb23f (0x402cc23f)
libgtk-1.2.so.0 + 0xba39c (0x402cb39c)
libgtk-1.2.so.0 + 0x5d7fc (0x4026e7fc)
nsDragService::GetTargetDragData()
nsDragService::GetData()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
nsJSContext::CallEventHandler()
nsJSEventListener::HandleEvent()
nsEventListenerManager::HandleEventSubType()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleChromeEvent()
GlobalWindowImpl::HandleDOMEvent()
nsDocument::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsViewManager::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWindow::OnDragDropSignal()
nsWindow::DragDropSignal()
libgtk-1.2.so.0 + 0x8eeec (0x4029feec)
libgtk-1.2.so.0 + 0xbe9ec (0x402cf9ec)
libgtk-1.2.so.0 + 0xbde55 (0x402cee55)
libgtk-1.2.so.0 + 0xbc296 (0x402cd296)
libgtk-1.2.so.0 + 0x5f2e8 (0x402702e8)
libgtk-1.2.so.0 + 0x5ea67 (0x4026fa67)
libgtk-1.2.so.0 + 0x5e2c6 (0x4026f2c6)
libgtk-1.2.so.0 + 0x8e00d (0x4029f00d)
handle_gdk_event()
libgdk-1.2.so.0 + 0x17127 (0x4034d127)
libglib-1.2.so.0 + 0x10308 (0x4037b308)
libglib-1.2.so.0 + 0x10913 (0x4037b913)
libglib-1.2.so.0 + 0x10aac (0x4037baac)
libgtk-1.2.so.0 + 0x8d7e7 (0x4029e7e7)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1d2eb (0x4049e2eb) 

Comment 31

[Pedro]

I have been unable to reproduce the crash on Windows 95.  While I was able to
consistantly reproduce the crash on Linux.

Both are 0.9.9

Comment 32

[Aleksey Nogin]

I just saw this crash when trying to D&D a message from one local folder to
another.  Not sure what made this D&D so special (this never happened to me
before!), but here is what gdb says:

(gdb) bt
#0  0x4104cde8 in nsDragService::SourceDataGet () from
/usr/lib/mozilla/components/libwidget_gtk.so
#1  0x4104d041 in invisibleSourceDragDataGet () from
/usr/lib/mozilla/components/libwidget_gtk.so
#2  0x402afeb4 in gtk_marshal_NONE__POINTER_POINTER_INT_INT () from
/usr/lib/libgtk-1.2.so.0
#3  0x402e3436 in gtk_handlers_run () from /usr/lib/libgtk-1.2.so.0
#4  0x402e276d in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#5  0x402e0909 in gtk_signal_emit_by_name () from /usr/lib/libgtk-1.2.so.0
#6  0x4027ec14 in gtk_drag_selection_get () from /usr/lib/libgtk-1.2.so.0
#7  0x402afe80 in gtk_marshal_NONE__POINTER_INT_INT () from /usr/lib/libgtk-1.2.so.0
#8  0x402e3436 in gtk_handlers_run () from /usr/lib/libgtk-1.2.so.0
#9  0x402e276d in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#10 0x402e0909 in gtk_signal_emit_by_name () from /usr/lib/libgtk-1.2.so.0
#11 0x402df708 in gtk_selection_invoke_handler () from /usr/lib/libgtk-1.2.so.0
#12 0x402de7ba in gtk_selection_convert () from /usr/lib/libgtk-1.2.so.0
#13 0x4027b7aa in gtk_drag_get_data () from /usr/lib/libgtk-1.2.so.0
#14 0x4104c039 in nsDragService::GetTargetDragData () from
/usr/lib/mozilla/components/libwidget_gtk.so
#15 0x4104b56c in nsDragService::GetData () from
/usr/lib/mozilla/components/libwidget_gtk.so
#16 0x40180dc6 in XPTC_InvokeByIndex () from /usr/lib/libxpcom.so
#17 0x40570b90 in XPCWrappedNative::CallMethod () from
/usr/lib/mozilla/components/libxpconnect.so
#18 0x40576ba5 in XPC_WN_CallMethod () from
/usr/lib/mozilla/components/libxpconnect.so
#19 0x4008804c in js_Invoke () from /usr/lib/libmozjs.so
#20 0x4008fef3 in js_Interpret () from /usr/lib/libmozjs.so
#21 0x400880a3 in js_Invoke () from /usr/lib/libmozjs.so
#22 0x4056b9df in nsXPCWrappedJSClass::CallMethod () from
/usr/lib/mozilla/components/libxpconnect.so
#23 0x40567bef in nsXPCWrappedJS::CallMethod () from
/usr/lib/mozilla/components/libxpconnect.so
#24 0x40180f67 in PrepareAndDispatch () from /usr/lib/libxpcom.so
#25 0x40180fca in nsXPTCStubBase::Stub3 () from /usr/lib/libxpcom.so
#26 0x40c9c2d3 in nsXULTreeBuilder::CanDropOn () from
/usr/lib/mozilla/components/libgkcontent.so
#27 0x419278b8 in nsTreeBodyFrame::OnDragOver () from
/usr/lib/mozilla/components/libgklayout.so
#28 0x4192da29 in nsTreeBoxObject::OnDragOver () from
/usr/lib/mozilla/components/libgklayout.so
#29 0x40180dc6 in XPTC_InvokeByIndex () from /usr/lib/libxpcom.so
#30 0x40570b90 in XPCWrappedNative::CallMethod () from
/usr/lib/mozilla/components/libxpconnect.so
#31 0x40576ba5 in XPC_WN_CallMethod () from
/usr/lib/mozilla/components/libxpconnect.so
#32 0x4008804c in js_Invoke () from /usr/lib/libmozjs.so
#33 0x4008fef3 in js_Interpret () from /usr/lib/libmozjs.so
#34 0x400880a3 in js_Invoke () from /usr/lib/libmozjs.so
#35 0x4008829d in js_InternalInvoke () from /usr/lib/libmozjs.so
#36 0x40069d12 in JS_CallFunctionValue () from /usr/lib/libmozjs.so
#37 0x413f758c in nsJSContext::CallEventHandler () from
/usr/lib/mozilla/components/libjsdom.so
#38 0x414258e7 in nsJSEventListener::HandleEvent () from
/usr/lib/mozilla/components/libjsdom.so
#39 0x40cbd8d8 in nsXBLPrototypeHandler::ExecuteHandler () from
/usr/lib/mozilla/components/libgkcontent.so
#40 0x40cbf716 in nsXBLDragHandler::DragOver () from
/usr/lib/mozilla/components/libgkcontent.so
#41 0x40b6b110 in nsEventListenerManager::HandleEvent () from
/usr/lib/mozilla/components/libgkcontent.so
#42 0x40c60a10 in nsXULElement::HandleDOMEvent () from
/usr/lib/mozilla/components/libgkcontent.so
#43 0x40c60b27 in nsXULElement::HandleDOMEvent () from
/usr/lib/mozilla/components/libgkcontent.so
#44 0x40c60b27 in nsXULElement::HandleDOMEvent () from
/usr/lib/mozilla/components/libgkcontent.so
#45 0x40c60b27 in nsXULElement::HandleDOMEvent () from
/usr/lib/mozilla/components/libgkcontent.so
#46 0x4182d9b5 in PresShell::HandleEventInternal () from
/usr/lib/mozilla/components/libgklayout.so
#47 0x4182d7dc in PresShell::HandleEvent () from
/usr/lib/mozilla/components/libgklayout.so
#48 0x419b36a8 in nsViewManager::HandleEvent () from
/usr/lib/mozilla/components/libgkview.so
#49 0x419a8e48 in nsView::HandleEvent () from
/usr/lib/mozilla/components/libgkview.so
#50 0x419b2ce6 in nsViewManager::DispatchEvent () from
/usr/lib/mozilla/components/libgkview.so
#51 0x419a8971 in HandleEvent () from /usr/lib/mozilla/components/libgkview.so
#52 0x41053562 in nsWidget::DispatchEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#53 0x4105345a in nsWidget::DispatchWindowEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#54 0x410535f4 in nsWidget::DispatchMouseEvent () from
/usr/lib/mozilla/components/libwidget_gtk.so
#55 0x4105a453 in nsWindow::OnDragMotionSignal () from
/usr/lib/mozilla/components/libwidget_gtk.so
#56 0x4105a1d7 in nsWindow::DragMotionSignal () from
/usr/lib/mozilla/components/libwidget_gtk.so
#57 0x402afb98 in gtk_marshal_BOOL__POINTER_INT_INT_INT () from
/usr/lib/libgtk-1.2.so.0
#58 0x402e3436 in gtk_handlers_run () from /usr/lib/libgtk-1.2.so.0
#59 0x402e276d in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#60 0x402e0909 in gtk_signal_emit_by_name () from /usr/lib/libgtk-1.2.so.0
#61 0x4027d138 in gtk_drag_dest_motion () from /usr/lib/libgtk-1.2.so.0
#62 0x4027cb0d in gtk_drag_find_widget () from /usr/lib/libgtk-1.2.so.0
#63 0x4027c284 in gtk_drag_dest_handle_event () from /usr/lib/libgtk-1.2.so.0
#64 0x402aeb93 in gtk_main_do_event () from /usr/lib/libgtk-1.2.so.0
#65 0x4104df5b in handle_gdk_event () from
/usr/lib/mozilla/components/libwidget_gtk.so
#66 0x4035fd7f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#67 0x40392773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#68 0x40392d39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#69 0x40392eec in g_main_run () from /usr/lib/libglib-1.2.so.0
#70 0x402ae333 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#71 0x41046bd6 in nsAppShell::Run () from
/usr/lib/mozilla/components/libwidget_gtk.so
#72 0x410269f6 in nsAppShellService::Run () from
/usr/lib/mozilla/components/libnsappshell.so
#73 0x08052781 in getCountry ()
#74 0x08053043 in main ()
#75 0x420174d9 in __libc_start_main () from /lib/i686/libc.so.6

I am running BuildID 2002040219 on RedHat Linux 7.2

Comment 33

[Vadim Berezniker]

*** Bug 137186 has been marked as a duplicate of this bug. ***

Comment 34

[Vadim Berezniker]

Attachment: stack trace from dragging image

this is from bug 137186, 
going to http://www.thekompany.com/projects/aethera/images/Notes.png and
dragging that image seems an easy way to crash.

this is a stack trace from a crash on that site

Comment 35

[Stephane Chauveau]

Next month, this crasher will be one year old.
Will there be a birthday party? :-)

Comment 36

[Christopher Curzio]

I've submitted two more TalkBack IDs regarding this bug:

TB5326184Y
TB5258682K

If there's a party, does the original reporter (Me!) get to cut first piece? ;)

Comment 37

[Jaime Rodriguez, Jr.]

What are the chances this will be fixed by 04/19?

Comment 38

[Christopher Blizzard (:blizzard)]

Attachment: return if there are no source data items

Such a long wait for such a little patch.

(looking for reviews and such)

Comment 39

[Shiva Thirumazhusai]

This crash is also happening in Netscape 6.22 and Mozilla 0.9.9 builds.

Comment 40

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 79824 [details] [diff] [review]
return if there are no source data items

r=[e-mail]

Comment 41

[Shiva Thirumazhusai]

Some users are experiencing crashes on dragging mail too. 

 (5134427)	Comments: I was clicking around in the mail client.
 (4985344)	Comments: I was dragging a mail message across to a folder when the said dialogs
appeared.

Comment 42

[Aleksey Nogin]

> Some users are experiencing crashes on dragging mail too. 

Yes, see also the comment #32.

Comment 43

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 79824 [details] [diff] [review]
return if there are no source data items

sr=shaver.

Comment 44

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 79824 [details] [diff] [review]
return if there are no source data items

a=shaver for the 1.0 branch.

Comment 45

[Christopher Blizzard (:blizzard)]

Checked into the trunk.

Comment 46

[Christopher Blizzard (:blizzard)]

Checked in on the 1.0 branch.

Comment 47

[Torgeir Veimo]

I've just entered bug 140275, which is a freeze by selection bug, still present
in build id 2002042412, with instructions on how to reproduce it. It seems to be
related to dragging between frames / iframes or something. Can someone see if
its a dup of this bug, or a different issue?

Comment 48

[Asa Dotzler [:asa]]

adding branch resolution keyword. 

Comment 49

[R.K.Aa.]

*** Bug 143410 has been marked as a duplicate of this bug. ***