90405 - M092 crash [@ nsVoidArray::RemoveElement]

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[greer]

M092 talkback data is showing a handful of crashes at this signature. One of 
the user comments might be helpful if we have access to the Dreamweaver 
software. Try here: http://www.macromedia.com/downloads/ 

Also I believe the correct url is: 
http://home.nexgo.de/light-zone/dwfiles/newdigital.html#
(Needs a trailing #)

Here's the full report with comments following:

sVoidArray::RemoveElement   
     First BBID :
http://climate/reports/stackcommentemail.cfm?dynamicBBID=32539644
     Last BBID  :
http://climate/reports/stackcommentemail.cfm?dynamicBBID=32690611
     Min Runtime :27230
     Max Runtime :71752
     Min seconds since last crash :929
     Max seconds since last crash :57979
     First Appearance Date : 2001-07-05
     Last Appearance Date : 2001-07-09
     First Build ID : 2001062823
     Latest Build ID : 2001062823

Stack Trace: 

         nsVoidArray::RemoveElement()   [nsVoidArray.cpp  line 258]
         nsDeleteObserved::RemoveDeleteObserver()       [nsDeleteObserver.cpp  
line 78]
         nsMacEventDispatchHandler::SetDeactivated()    [nsMacEventHandler.cpp  
line 295]
         nsMacEventHandler::HandleActivateEvent()       [nsMacEventHandler.cpp  
line 1173]
         nsMacEventHandler::HandleOSEvent()     [nsMacEventHandler.cpp  line 
424]
         nsMacWindow::HandleOSEvent()   [nsMacWindow.cpp  line 1121]
         nsMacMessageSink::DispatchOSEvent()    [nsMacMessageSink.cpp  line 44]
         nsMacMessagePump::DispatchOSEventToRaptor()    [nsMacMessagePump.cpp  
line 956]
         nsMacMessagePump::DoActivate() [nsMacMessagePump.cpp  line 920]
         nsMacMessagePump::DispatchEvent()      [nsMacMessagePump.cpp  line 420]
         nsMacMessagePump::DoMessagePump()      [nsMacMessagePump.cpp  line 269]
         nsAppShell::Run()      [nsAppShell.cpp  line 110]
         nsAppShellService::Run()       [nsAppShellService.cpp  line 417]
         main1()        [nsAppRunner.cpp  line 1161]
         main() [nsAppRunner.cpp  line 1464]
         .__start
    nsVoidArray::RemoveElement() 45f8789a
        nsVoidArray.cpp line 258
        Build: 2001062823 CrashDate: 2001-07-09 UptimeMinutes: 966  Total: 1195 
        OS: MacOS version 9.1
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=32690611
         StackTrace: http://climate/reports/stackcommentemail.cfm?
dynamicBBID=32690611

    nsVoidArray::RemoveElement() 45f8789a
        nsVoidArray.cpp line 258
        Build: 2001062823 CrashDate: 2001-07-07 UptimeMinutes: 602  Total: 857 
        OS: MacOS version 9.1
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=32621765
         StackTrace: http://climate/reports/stackcommentemail.cfm?
dynamicBBID=32621765
     (32621765) URL: http://home.nexgo.de/light-zone/dwfiles/newdigital.html
     (32621765) Comments: clicking on a thumbnail brings a larger view in a new
window created using JustSo Picture Window Extension for DreamWeaver 4.0. Window
opens and then causes Mozilla (and Netscape 6.01) to quit. Works fine with
Communicator 4.77 and IE 5 (all browsers are
     (32621765) Comments:  for Mac)

    nsVoidArray::RemoveElement() 45f8789a
        nsVoidArray.cpp line 258
        Build: 2001062823 CrashDate: 2001-07-05 UptimeMinutes: 15  Total: 453 
        OS: MacOS version 9.0.4
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=32539644
         StackTrace: http://climate/reports/stackcommentemail.cfm?
dynamicBBID=32539644
     (32539644) Comments: opening java box type 2 error

Comment 1

[greer]

adding crash and topcrash for tracking

Comment 2

[Simon Fraser [no longer active]]

Mac crash, cc Mac folks.

Comment 3

[Edward Kandrot]

Looking at who called Remove, I would guess that it is not Removes error, but
the caller.  Reassigning to default for that component.

Comment 4

[Paul Chen]

The URL for this bug results in a 404 Not Found error on the server.

Comment 5

[greer]

Sorry, about the url I just tried and got the same problem. But I was able to 
go to the page by first going to:

- http://home.nexgo.de/light-zone/
- click on "Digital"
- click on "Photos" (upper right)
- click on "Click here to see more digital images" (lower right)

That matches the URL.

Comment 6

[Paul Chen]

Ok, I've reproduced the crash.

The problem is in mozilla/widget/src/mac/nsMacEventHandler.cpp, lines 320-326
320 if (mActiveWidget)
321 { 
322 //printf("   nsMacEventDispatchHandler::SetDeactivated sends NS_DEACTIVATE\n");
323 DispatchGuiEvent(mActiveWidget, NS_DEACTIVATE);   
324 mActiveWidget->RemoveDeleteObserver(this);
325 mActiveWidget = nsnull;
326 }

The crash occurs because DispatchGuiEvent causes mActiveWidget to get set to
null. Ouch. Other than putting another check for null which would like a bit
odd, not sure how this should get fixed.

Comment 7

[Mike Pinkerton (not reading bugmail)]

they way to prevent the widget from going null over the dispatch of the event is 
to use a kung-fu deathgrip with a nsCOMPtr. you should talk to saari about why 
the widget is going away on the deactivate though. that worries me a bunch.

ccing saari

Comment 8

[Paul Chen]

I talked to saari this morning, he's been messing around in this code, and he 
says that he's got a patch

Comment 9

[Blake Ross]

In that case, --> saari

Comment 10

[Blake Ross]

saari, still got that patch?

Comment 11

[saari (gone)]

it is part of the patch for 77675

Comment 12

[saari (gone)]

and that patch got checked in, so this should be fixed

Comment 13

[jerone]

verified on build 2001-07-24-branch