98415 - modern, Colors & Message Display: color picker won't come up, then dismissing causes crash

Status: VERIFIED FIXED

(SeaMonkey :: Preferences, defect, P1)

Description

[sairuh (rarely reading bugmail)]

found using 2001.09.04.08-comm bits on mac os 10.0.4, modern theme [doesn't
occur in classic]. occurred with both an older and new profile. not a problem on
linux or winnt, either.

will test mac os 9.1 soon.

do reassign this as needed!

1. go to Colors panel in the preferences dialog.
2. click on one of the color swatches to bring up the color picker --ie, the one
for Text.
observe: the swatch button indents...and the color picker doesn't pop up.
clicking elsewhere doesn't make the swatch button un-indent, so...
3. i click the Cancel button to dismiss the prefs dialog.

result: crash. will attach stack info soon.

Comment 1

[sairuh (rarely reading bugmail)]

Date/Time: 2001-09-05 13:52:48 -0700
PID:       295
Command:   Netscape 6

Exception: EXC_BAD_ACCESS (0x0001)
Codes:     KERN_PROTECTION_FAILURE (0x0002) at 0x0000003c

Thread 0:
 #0   0x00203700 in 0x203700 ()
 #1   0x021ff148 in CaptureRollupEvents__8nsWindowFP17nsIRollupListenerii ()
 #2   0x001514a4 in
assign_from_helper__13nsCOMPtr_baseFRC15nsCOMPtr_helperRC4nsID ()
 #3   0x02cee500 in HideChain__16nsMenuPopupFrameFv ()
 #4   0x02d0f000 in Rollup__23nsMenuDismissalListenerFv ()
 #5   0x021fb2ec in Destroy__8nsWindowFv ()
 #6   0x02eea280 in __dt__6nsViewFv ()
 #7   0x02eea6b8 in Destroy__6nsViewFv ()
 #8   0x02bd81d0 in Destroy__7nsFrameFP14nsIPresContext ()
 #9   0x02bd55fc in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #10  0x02cd6400 in Destroy__10nsBoxFrameFP14nsIPresContext ()
 #11  0x02ceef00 in Destroy__16nsMenuPopupFrameFP14nsIPresContext ()
 #12  0x02d05794 in Destroy__15nsPopupSetFrameFP14nsIPresContext ()
 #13  0x02cd0794 in DestroyFrames__11nsFrameListFP14nsIPresContext ()
 #14  0x02bd55ec in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #15  0x02cd6400 in Destroy__10nsBoxFrameFP14nsIPresContext ()
 #16  0x02cd0794 in DestroyFrames__11nsFrameListFP14nsIPresContext ()
 #17  0x02bd55ec in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #18  0x02cd6400 in Destroy__10nsBoxFrameFP14nsIPresContext ()
 #19  0x02cd0794 in DestroyFrames__11nsFrameListFP14nsIPresContext ()
 #20  0x02bd55ec in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #21  0x02ca7b88 in Destroy__13ViewportFrameFP14nsIPresContext ()
 #22  0x02cfe6b4 in Destroy__12FrameManagerFv ()
 #23  0x02bea7c0 in Destroy__9PresShellFv ()
 #24  0x024dfb48 in Destroy__18DocumentViewerImplFv ()
 #25  0x02809f68 in Destroy__10nsDocShellFv ()
 #26  0x02829f00 in Destroy__10nsWebShellFv ()
 #27  0x02d5fdfc in __dt__21nsHTMLFrameInnerFrameFv ()
 #28  0x02bd81f0 in Destroy__7nsFrameFP14nsIPresContext ()
 #29  0x02cd0794 in DestroyFrames__11nsFrameListFP14nsIPresContext ()
 #30  0x02bd55ec in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #31  0x02cd0794 in DestroyFrames__11nsFrameListFP14nsIPresContext ()
 #32  0x02bd55ec in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #33  0x02cd6400 in Destroy__10nsBoxFrameFP14nsIPresContext ()
 #34  0x02cd0794 in DestroyFrames__11nsFrameListFP14nsIPresContext ()
 #35  0x02bd55ec in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #36  0x02cd6400 in Destroy__10nsBoxFrameFP14nsIPresContext ()
 #37  0x02cd0794 in DestroyFrames__11nsFrameListFP14nsIPresContext ()
 #38  0x02bd55ec in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #39  0x02cd6400 in Destroy__10nsBoxFrameFP14nsIPresContext ()
 #40  0x02cd0794 in DestroyFrames__11nsFrameListFP14nsIPresContext ()
 #41  0x02bd55ec in Destroy__16nsContainerFrameFP14nsIPresContext ()
 #42  0x02ca7b88 in Destroy__13ViewportFrameFP14nsIPresContext ()
 #43  0x02cfe6b4 in Destroy__12FrameManagerFv ()
 #44  0x02bea7c0 in Destroy__9PresShellFv ()
 #45  0x024dfb48 in Destroy__18DocumentViewerImplFv ()
 #46  0x02809f68 in Destroy__10nsDocShellFv ()
 #47  0x02829f00 in Destroy__10nsWebShellFv ()
 #48  0x01eddc34 in Destroy__11nsXULWindowFv ()
 #49  0x01ecc564 in Destroy__16nsWebShellWindowFv ()
 #50  0x01ed8600 in Destroy__17nsChromeTreeOwnerFv ()
 #51  0x0284d7c0 in ReallyCloseWindow__16GlobalWindowImplFv ()
 #52  0x0285155c in CloseWindow__16GlobalWindowImplFP11nsISupports ()
 #53  0x0283fa7c in ScriptEvaluated__11nsJSContextFi ()
 #54  0x0283e7a4 in CallEventHandler__11nsJSContextFPvPvUiPvPii ()
 #55  0x028595e0 in HandleEvent__17nsJSEventListenerFP11nsIDOMEvent ()
 #56  0x023acc40 in
HandleEventSubType__22nsEventListenerManagerFP16nsListenerStru ()
 #57  0x023af12c in
HandleEvent__22nsEventListenerManagerFP14nsIPresContextP7nsEve ()
 #58  0x025cdf5c in
HandleDOMEvent__12nsXULElementFP14nsIPresContextP7nsEventPP11n ()
 #59  0x02bf7810 in
HandleDOMEventWithTarget__9PresShellFP10nsIContentP7nsEventP13 ()
 #60  0x02d1c994 in
MouseClicked__16nsButtonBoxFrameFP14nsIPresContextP10nsGUIEven ()
 #61  0x02d1c648 in
HandleEvent__16nsButtonBoxFrameFP14nsIPresContextP10nsGUIEvent ()
 #62  0x02bf76a4 in
HandleEventInternal__9PresShellFP7nsEventP7nsIViewUiP13nsEvent ()
 #63  0x02bf7440 in
HandleEventWithTarget__9PresShellFP7nsEventP8nsIFrameP10nsICon ()
 #64  0x023b86f8 in
CheckForAndDispatchClick__19nsEventStateManagerFP14nsIPresCont ()
 #65  0x023b66f4 in 0x23b66f4 ()
 #66  0x02bf76e8 in
HandleEventInternal__9PresShellFP7nsEventP7nsIViewUiP13nsEvent ()
 #67  0x02bf7354 in
HandleEvent__9PresShellFP7nsIViewP10nsGUIEventP13nsEventStatus ()
 #68  0x02eeabb0 in HandleEvent__6nsViewFP10nsGUIEventUiP13nsEventStatusiRi ()
 #69  0x02efbb1c in 0x2efbb1c ()
 #70  0x02ee9fa8 in HandleEvent__FP10nsGUIEvent ()
 #71  0x021fdff0 in 0x21fdff0 ()
 #72  0x021fe0c4 in DispatchWindowEvent__8nsWindowFR10nsGUIEvent ()
 #73  0x021fe208 in DispatchMouseEvent__8nsWindowFR12nsMouseEvent ()
 #74  0x0220e1b8 in HandleMouseUpEvent__17nsMacEventHandlerFR11EventRecord ()
 #75  0x0220c70c in HandleOSEvent__17nsMacEventHandlerFR11EventRecord ()
 #76  0x0220b908 in HandleOSEvent__11nsMacWindowFR11EventRecord ()
 #77  0x0221070c in
DispatchOSEvent__16nsMacMessageSinkFR11EventRecordP15OpaqueWin ()
 #78  0x02214dd4 in
DispatchOSEventToRaptor__16nsMacMessagePumpFR11EventRecordP15O ()
 #79  0x02214934 in DoMouseUp__16nsMacMessagePumpFR11EventRecord ()
 #80  0x022140b4 in DispatchEvent__16nsMacMessagePumpFiP11EventRecord ()
 #81  0x02213ad4 in DoMessagePump__16nsMacMessagePumpFv ()
 #82  0x02213364 in Run__10nsAppShellFv ()
 #83  0x01ecf34c in Run__17nsAppShellServiceFv ()
 #84  0x00094e5c in main1__FiPPcP11nsISupports ()
 #85  0x00095b38 in main ()

Thread 1:
 #0   0x7000424c in _syscall ()
 #1   0x706584b8 in _ProcessReadyEvent ()
 #2   0x706582b0 in _CarbonSelectThreadFunc ()
 #3   0x70014f04 in __pthread_body ()

Thread 2:
 #0   0x70059b68 in _semaphore_wait_signal_trap ()
 #1   0x70016110 in _semaphore_wait_signal ()
 #2   0x70015f78 in __pthread_cond_wait ()
 #3   0x70015d18 in _pthread_cond_wait ()
 #4   0x70653be0 in _BSD_pthread_cond_wait ()
 #5   0x70653bc0 in _CarbonConditionWait ()
 #6   0x7065557c in _CarbonOperationThreadFunc ()
 #7   0x70014f04 in __pthread_body ()

Thread 3:
 #0   0x70059b48 in _semaphore_timedwait_signal_trap ()
 #1   0x7003f7f8 in _semaphore_timedwait_signal ()
 #2   0x70015f68 in __pthread_cond_wait ()
 #3   0x7003f7c4 in _pthread_cond_timedwait_relative_np ()
 #4   0x7029b590 in _TSWaitOnConditionTimedRelative ()
 #5   0x7029cdac in _TSWaitOnSemaphoreCommon ()
 #6   0x702e5f98 in _TSWaitOnSemaphoreRelative ()
 #7   0x702e7208 in _TimerThread ()
 #8   0x70014f04 in __pthread_body ()

Thread 4:
 #0   0x70059b68 in _semaphore_wait_signal_trap ()
 #1   0x70016110 in _semaphore_wait_signal ()
 #2   0x70015f78 in __pthread_cond_wait ()
 #3   0x70015d18 in _pthread_cond_wait ()
 #4   0x7029b550 in _TSWaitOnCondition ()
 #5   0x7029cd94 in _TSWaitOnSemaphoreCommon ()
 #6   0x7029cce4 in _TSWaitOnSemaphore ()
 #7   0x7029cba8 in _AsyncFileThread ()
 #8   0x70014f04 in __pthread_body ()

Thread 5:
 #0   0x70059b68 in _semaphore_wait_signal_trap ()
 #1   0x70016110 in _semaphore_wait_signal ()
 #2   0x70015f78 in __pthread_cond_wait ()
 #3   0x70015d18 in _pthread_cond_wait ()
 #4   0x70653be0 in _BSD_pthread_cond_wait ()
 #5   0x70653bc0 in _CarbonConditionWait ()
 #6   0x70653ab4 in _CarbonInetOperThreadFunc ()
 #7   0x70014f04 in __pthread_body ()

Thread 6:
 #0   0x700007b8 in _mach_msg_overwrite_trap ()
 #1   0x700056e4 in _mach_msg_overwrite ()
 #2   0x700277b0 in _thread_suspend ()
 #3   0x70027744 in __pthread_become_available ()
 #4   0x70027468 in _pthread_exit ()
 #5   0x70014f08 in __pthread_body ()

PPC Thread State:
  srr0: 0x00203700 srr1: 0x0000f030                vrsave: 0x00000000
   xer: 0x00000014   lr: 0x001512d0  ctr: 0x001512a4   mq: 0x00000000
    r0: 0x001514a4   r1: 0xbfffc1f0   r2: 0x002b4000   r3: 0x03f5d328
    r4: 0x02e0b414   r5: 0xbfffc26c   r6: 0x03f5d328   r7: 0x000000e1
    r8: 0x83d8947c   r9: 0x03ab1c80  r10: 0x00000000  r11: 0x00000000
   r12: 0x0000003c  r13: 0x00000000  r14: 0x00000000  r15: 0x00000000
   r16: 0x035c3ee0  r17: 0xbfffe770  r18: 0x040ec210  r19: 0x0275a08c
   r20: 0xbfffdd88  r21: 0x02753968  r22: 0x00000001  r23: 0x002bb27c
   r24: 0x02e00b28  r25: 0x002c4c0c  r26: 0x002c4844  r27: 0x002c49d8
   r28: 0x043cde54  r29: 0x0435df80  r30: 0x043cde54  r31: 0xbfffc2e4

Comment 2

[David Hyatt]

Oh crap.  This looks a lot like the autocomplete widget Mac crash that happened
after I changed popups.  pinkerton managed to fix this for the autocomplete
widget.  I'm not sure why the fix isn't handling this case as well.

Comment 3

[sairuh (rarely reading bugmail)]

this also crashes on Mac OS 9.1 [2001.09.04.11-comm], modern theme [not classic].

Comment 4

[Mike Pinkerton (not reading bugmail)]

*whew*. i was gonna cry if this was osx only ;)

Comment 5

[David Hyatt]

It sounds like the color picker is just hosed in some way and not dismissing
(which naturally would lead to a crash if it is stuck in an open state).  Maybe
hewitt can conjure up a skin fix.

Comment 6

[sairuh (rarely reading bugmail)]

nominating. here's the talkback info for the 9.1 crash, fwiw.

Incident ID 34993850
Stack Signature 0xffc030fc 5080f1c0
Bug ID
Trigger Time 2001-09-05 15:10:01
User Comments bug 98415, modern, os9.1 emul over X
Build ID 2001090408
Product ID MozillaTrunk
Platform ID MacOS
Trigger Reason Illegal PowerPC instruction
Stack Trace
0xffc030fc
nsCOMPtr_base::assign_from_helper() [nsCOMPtr.cpp, line 63]
nsMenuPopupFrame::HideChain() [nsMenuPopupFrame.cpp, line 1553]
nsMenuDismissalListener::Rollup() [nsMenuDismissalListener.cpp, line 89]
nsWindow::Destroy() [nsWindow.cpp, line 292]
VIEW_DLL + 0x686c (0x3e40a27c)
VIEW_DLL + 0x6ca4 (0x3e40a6b4)
nsFrame::Destroy() [nsFrame.cpp, line 448]
nsContainerFrame::Destroy() [nsContainerFrame.cpp, line 120]
nsBoxFrame::Destroy() [nsBoxFrame.cpp, line 1128]
nsMenuPopupFrame::Destroy() [nsMenuPopupFrame.cpp, line 1700]
nsPopupSetFrame::Destroy() [nsPopupSetFrame.cpp, line 160]
nsFrameList::DestroyFrames() [nsFrameList.cpp, line 115]
nsContainerFrame::Destroy() [nsContainerFrame.cpp, line 117]
nsBoxFrame::Destroy() [nsBoxFrame.cpp, line 1128]
nsFrameList::DestroyFrames() [nsFrameList.cpp, line 115]
nsContainerFrame::Destroy() [nsContainerFrame.cpp, line 117]
nsBoxFrame::Destroy() [nsBoxFrame.cpp, line 1128]
nsFrameList::DestroyFrames() [nsFrameList.cpp, line 115]
nsContainerFrame::Destroy() [nsContainerFrame.cpp, line 117]
ViewportFrame::Destroy() [nsViewportFrame.cpp, line 141]
FrameManager::Destroy() [nsFrameManager.cpp, line 458]
PresShell::Destroy() [nsPresShell.cpp, line 1699]
DocumentViewerImpl::Destroy() [nsDocumentViewer.cpp, line 1207] 

Comment 7

[Peter Trudelle]

Sounds like a showstopper to me, nsbranch+/0.9.5/P1

Comment 8

[Brad Tiffany]

Fwiw, the "guilty" section of Modern appears to be

colorpicker[type="button"]:focus {
  border-color: #98A5B2;
}

Removing it fixes the problem (Mac Classic doesn't do special decoration for
focused buttons).  I also found a couple of ways to avoid the the crash without
altering Modern.  If one _just_ uses the keyboard--tabbing to the colorpicker
button and opening it with an arrow key--everything is OK.  Also, tabbing so
that the button has focus and then clicking on it opens a properly functioning
popup.  It is also possible to click on an unfocused colorpicker button and then
click where the desired color would be (if the popup were properly displayed). 
The color is then set without a hitch.  Finally, forcing the mousedown handler
to focus the button before opening the popup by doing

Index: mozilla/xpfe/global/resources/content/bindings/colorpicker.xml
===================================================================
RCS file: /cvsroot/mozilla/xpfe/global/resources/content/bindings/colorpicker.xml,v
retrieving revision 1.6
diff -u -2 -r1.6 colorpicker.xml
--- mozilla/xpfe/global/resources/content/bindings/colorpicker.xml	2001/09/18 21:47:27	1.6
+++ mozilla/xpfe/global/resources/content/bindings/colorpicker.xml	2001/09/22 03:32:27
@@ -539,4 +539,5 @@
         // get it to recognize the popupalign and popupanchor attributes that way
         // So, I have to do it manually...
+        this.focus();
         this.openPopup();
       ]]></handler>

seems to cover up the problem in all cases (not a proposed fix--I have no idea
what's going on here--but I hope it points someone in the right direction).

Comment 9

[Cindy Roberts]

Marking this nsbranch+ per Trudelle's comment.  Let us know when a fix is ready
and reviews have been completed for an "ok" to check into the Netscape branch.

Comment 10

[sairuh (rarely reading bugmail)]

*** Bug 101253 has been marked as a duplicate of this bug. ***

Comment 11

[selmer (gone)]

Joe, any comments?  Should we take Brad's hack while we look for a better fix?

Comment 12

[Joe Hewitt (gone)]

I think it would be acceptable to land Brad's one-line js patch on the branch
while we look for a better solution on the trunk.

Comment 13

[Brad Tiffany]

I'd better add a caveat.  As I intended the modification to the mousedown handler to be illustrative, I didn't test it beyond seeing that the colorpicker in the colors pref panel came up and that there wasn't an immediate crash on closing prefs (modern theme on mac only).  I hope "in all cases" didn't give the wrong impression.

Comment 14

[Peter Trudelle]

This needs an ETA date in the status whiteboard today.

Comment 15

[Joe Hewitt (gone)]

sr=hewitt for brad's patch.  

Comment 16

[Joe Hewitt (gone)]

Attachment: whoops, ignore this

Comment 17

[Joe Hewitt (gone)]

Attachment: brad's fix

Comment 18

[Scott MacGregor]

Comment on attachment 51369 [details] [diff] [review]
brad's fix

sr=mscott

Comment 19

[Jaime Rodriguez, Jr.]

pls check this one in - PDT+

Comment 20

[Joe Hewitt (gone)]

fixed on branch.  Resetting milestone for fixing the real problem causing the crash

Comment 21

[sairuh (rarely reading bugmail)]

vrfy'd on the branch on both 10.1 and 9.1 using 2001.10.08.0x-0.9.4 comm bits.
using the modern theme, i was able to bring up and dismiss all four color
pickers in the Colors pref panel.

nominating for moz0.9.6 to be fixed properly in the trunk...

Comment 22

[sairuh (rarely reading bugmail)]

remind to self to check the Message Display panel, which is also affected on the
trunk [but fine in the 0.9.4-branch], as in bug 104272.

Comment 23

[sairuh (rarely reading bugmail)]

*** Bug 104272 has been marked as a duplicate of this bug. ***

Comment 24

[Geo. Anderson]

oops, sorry.  Add to previous note:  NT4.0 SP6a

Comment 25

[Olga]

Mac OSX (modern theme)- recent branch build: 2001-10-12 
From 3 pane window I played with changing colors in Pref. - No problem with the
swatch button indents, no crash.

Comment 26

[Matthew T (active 1999-2002)]

See also bug 84879, a similar crash on Windows.

Comment 27

[Joe Hewitt (gone)]

*** This bug has been marked as a duplicate of 84879 ***

Comment 28

[sairuh (rarely reading bugmail)]

no, i don't think this is a dup. i couldn't repro on winNT using 2001.11.20.09,
and i only see this on mac. ie, still a problem on the trunk, using
2001.11.20.04-comm bits on Mac 10.1, when in modern.

reopening. this blocks me from using the color picker in those two pref panels.

Comment 29

[sairuh (rarely reading bugmail)]

nominating for moz0.9.7. joe, would you be able to get to this any time soon...?

Comment 30

[sairuh (rarely reading bugmail)]

clearing milestone, to reconsider for an earlier time to fix...

Comment 31

[Joe Hewitt (gone)]

This seems to be related to focus oddities that are mac specific, and I'm
certainly not the guy to be delving into the mac focus code.  Perhaps a mac guy
would like to take this on?

Comment 32

[Mike Pinkerton (not reading bugmail)]

joe, then give it to someone you think can help. don't future the bug.

Comment 33

[sairuh (rarely reading bugmail)]

chatted w/trudelle --perhaps andreww could fix this?

Comment 34

[andreww]

ok I at least can try to tease out what's going wrong.

Comment 35

[andreww]

I've looked at this and frankly I'd recommend putting brad's fix into the 
trunk. I've tested it out in various ways and it seems to work fine.  The 
underlying issue is still there but this workaround seems to circumvent it 
for all practical purposes.

If no one objects I'm going to check in brad's fix into the trunk.

Comment 36

[andreww]

Comment on attachment 51369 [details] [diff] [review]
brad's fix

r=andreww

Comment 37

[andreww]

fix checked into trunk.

Comment 38

[sairuh (rarely reading bugmail)]

whew. vrfy fixed on mac 10.1.2 [modern], 2002.01.03.08 comm bits.