82569 - Trunk/NS610 crash when losing focus to another app. [@ nsFocusController::UpdateCommands]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[greer]

This is a talkback topcrash on Mozilla Trunk. (Please reassign to the proper 
component/owner.)

Here are the relevant comments:
(30752529) Comments: attempted to select a link on the "page info" screen
for a link (right click -> view page info)
[OS: Windows NT  4.0, Build: 2001052115]

(30776580) Comments: Crash bringing Mail/News window to the front.
[OS: Windows NT  5.0, Build: 2001052206]

(30813074) Comments: Closing the Bookmarks window (Ctrl-B) while renaming a
folder
[OS: Windows NT  5.0, Build: 2001052213]

(30779511) Comments: deleted an email in yahoo mail.  clicked delete
[OS: Windows NT  4.0, Build: 2001052115]

(30782010) Comments: Crash when browser window lost focus to another app.
[OS: Windows NT  5.0, Build: 2001052206]
------------------------

nsFocusController::UpdateCommands
[d:\builds\seamonkey\mozilla\dom\src\base\nsFocusController.cpp  line 133]
         nsFocusController::SetSuppressFocus
[d:\builds\seamonkey\mozilla\dom\src\base\nsFocusController.cpp  line 418]
         nsEventStateManager::PreHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line
691]
         PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5509]
         PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5441]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  
line
377]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  
line
350]
         nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 2056]
         HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 
68]
         nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 706]
         nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 723]
         nsWindow::DispatchFocus
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4238]
         nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3163]
         nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 958]
         USER32.DLL + 0x2e98 (0x77e12e98)
         USER32.DLL + 0x39a3 (0x77e139a3)
         USER32.DLL + 0x395f (0x77e1395f)
         ntdll.dll + 0x2032f (0x77fa032f)
         USER32.DLL + 0x569d (0x77e1569d)
         nsAppShell::Run
[d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp  line 113]
         nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 418]
         main1  [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  
line 1100]
         main   [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  
line 1394]
         WinMain        
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line
1412]

Comment 1

[Johnny Stenback (:jst)]

Focus problem, reassigning to saari.

Comment 2

[saari (gone)]

0.9.2

Comment 3

[saari (gone)]

This bug is got patched over so it doesn't crash anymore, but that causes other
reprocussions. We're doing work that we shouldn't be when the content is half
torn down.

Comment 4

[saari (gone)]

Okay, all the issues are resolved now. Fixed.

Comment 5

[Jay Patel [:jay]]

reopening for now... MozillaTrunk Talkback reports are showing this crash is
back as a "topcrasher".  Here is the latest info:

nsFocusController::UpdateCommands   8 
     First BBID :32999491
     Last BBID  :33181810
     Min Runtime :2561
     Max Runtime :66499
     First Appearance Date : 2001-07-17
     Last Appearance Date : 2001-07-21
     First BuildID : 2001071218
     Last BuildID : 2001072005

Stack Trace: 

	 nsFocusController::UpdateCommands
[d:\builds\seamonkey\mozilla\dom\src\base\nsFocusController.cpp  line 136]
	 nsFocusController::SetSuppressFocus
[d:\builds\seamonkey\mozilla\dom\src\base\nsFocusController.cpp  line 422]
	 nsDocShell::SetupNewViewer
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp  line 4122]
	 nsWebShell::SetupNewViewer
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp  line 305]
	 nsDocShell::Embed
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp  line 3579]
	 nsWebShell::Embed
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp  line 325]
	 nsDocShell::CreateContentViewer
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp  line 3872]
	 nsDSURIContentListener::DoContent
[d:\builds\seamonkey\mozilla\docshell\base\nsDSURIContentListener.cpp  line 121]
	 nsDocumentOpenInfo::DispatchContent
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp  line 346]
	 nsDocumentOpenInfo::OnStartRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp  line 218]
	 nsHttpChannel::ProcessNormal
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 471]
	 nsHttpChannel::ProcessResponse
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 441]
	 nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 2075]
	 nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 110]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 0x778b0c24
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/dom/src/base/nsFocusController.cpp
line : 136
     (33181810)	URL: http://liftoff.msfc.nasa.gov/RealTime/JPass/20/
(33181810)
Comments: This site is a tracker for the International Space Station. I had
entered my zip code in successfully
     (33053334)	Comments: The text field wasn't accepting keyboard input
     (32999491)	Comments: clicked on a link which would have started playing a WMF file
(from news.com)

If this is the same crash or similar to the one originally reported, we should
take a look at it.  Otherwise, let me know so I can log a new bug.

Comment 6

[saari (gone)]

If anyone has a reproducable test case, that would be good.

Comment 7

[Blake Ross]

This might not be a topcrash on the branch, but it's certainly crashing on the
branch.  I was able to crash while running chofmann's top100 browser buster.  I
believe I was in the process of switching to another navigator window when it
crashed.  Chris, is it possible that window is null there?  Can we bulletproof
on the branch and hope that it's not some trashed memory?

cc'ing selmer because I was talking to him about this.

Comment 8

[chris hofmann]

blake, can you reproduce this consistently?

Comment 9

[Blake Ross]

Nope.

Comment 10

[greer]

[e-mail] just sent me these steps to reproduce this crash.

Using the 2001072306 build:
- Go to http://java.sun.com/learning
- Fill in a user name in "Log in to Classes" text field
- Switch to another application not associated with N6
- Return to the browser window
- Immediately double click on the previously entered text and hit the delete key
- Crash.

I haven't yet been successful at crashing using his steps.

Comment 11

[selmer (gone)]

7/23 branch win98, used above steps, no crash.

Comment 12

[saari (gone)]

19 people hit this in 6.1 so far, based on talkback
nsFocusController.cpp  line 136

I can add a simple QI success check, although I think the QI shouldn't ever
fail. But an if(!null) check can't hurt.

Comment 13

[Blake Ross]

This largely stopped occuring around 8/2; there was since one crash on 8/6 and
another on 8/11.  Let's checkin the null fix and call this fixed.

Index: nsFocusController.cpp
===================================================================
RCS file: /cvsroot/mozilla/dom/src/base/nsFocusController.cpp,v
retrieving revision 1.10
diff -u -r1.10 nsFocusController.cpp
--- nsFocusController.cpp	2001/07/20 08:14:26	1.10
+++ nsFocusController.cpp	2001/08/16 18:15:21
@@ -132,7 +132,8 @@
       doc->GetScriptGlobalObject(getter_AddRefs(global));
 
       nsCOMPtr<nsIDOMWindowInternal> window(do_QueryInterface(global));
-      window->UpdateCommands(aEventName);
+      if (window)
+        window->UpdateCommands(aEventName);
     }
   }
   return NS_OK;

Comment 14

[saari (gone)]

Attachment: null check patch, looking for quick r/sr

Comment 15

[Blake Ross]

yes, there it is in patch form :) r/sr=me

Comment 16

[Johnny Stenback (:jst)]

r/sr=jst

Comment 17

[saari (gone)]

fix checked in on branch and trunk