User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.3b) Gecko/20030221 Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.3b) Gecko/20030221 with spam filtering enabled, if i attempt to turn on the spam log, mozilla crashes. I have yet to be able to turn on the spam log, it crashed every attempt. Running Mac OS X 10.2.3 Reproducible: Always Steps to Reproduce: 1. launch 2. open mail news 3. open spam dialogue 4. attempt to turn on spam log Actual Results: entire browser crashes. Full circle logging does not start. Expected Results: Enabled logging

chris, since TalkBack doesn't run, please try to record a stack trace using the Console application's crash reporting feature. Also, by "open spam dialog," do you mean Tools/Junk Mail Controls...?

I open the junk mail controls, click on the junk mail log button, and when I click on the enable logging check box, that's when the program crashes. All I get then is and alert box saying the program died. The crash log from the console program is attached.

Confirmed using FizzillaMach/2003022103. Merely dismissing the Junk Mail Log dialog by clicking the OK button is enough to cause the crash.

Better-formatted crash report.

(Do we need a meta-bug about non-TalkBack crashers?)

Possible dup of bug 188974.

*** Bug 195751 has been marked as a duplicate of this bug. ***

I'll investigate.

I'm able to reproduce this with the 1.3 final bits, as well as my own debug build, but I had to create a new profile to do it. (not sure why it wasn't a problem with my existing profile yet.)

this is some sort of infinite loop where nsEventStateManager::ShiftFocus() calls ::ShiftFocusInternal() calls ::TabIntoDocument() calls ::ShiftFocus() ... this could be a dup of #137191

note, I can reproduce this crash in the classic skin, but not modern.

here's the stack, early on in the infinite loop. #0 nsEventStateManager::TabIntoDocument(nsIDocShell*, int) (this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5106 #1 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105 #2 0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246 #3 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971 #4 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218 #5 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971 #6 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int) (this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139 #7 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105 #8 0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246 #9 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971 #10 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218 #11 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971 #12 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int) (this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139 #13 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105 #14 0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246 #15 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971 #16 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218 #17 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971 #18 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int) (this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139 #19 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105 #20 0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246 #21 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971 #22 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218 #23 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971 #24 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int) (this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139 #25 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3105 #26 0x0ef0b850 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:3246 #27 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe557ea0) at nsEventStateManager.cpp:2971 #28 0x0ef0b6b8 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:3218 #29 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe5ad770, aForward=1, aStart=0x0) at nsEventStateManager.cpp:2971 #30 0x0ef15910 in nsEventStateManager::TabIntoDocument(nsIDocShell*, int) (this=0xe556ec0, aDocShell=0xe575640, aForward=1) at nsEventStateManager.cpp:5139 #31 0x0ef0ae00 in nsEventStateManager::ShiftFocusInternal(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe54faf0) at nsEventStateManager.cpp:3105 #32 0x0ef0a424 in nsEventStateManager::ShiftFocus(int, nsIContent*) (this=0xe556ec0, aForward=1, aStart=0xe54faf0) at nsEventStateManager.cpp:2971 #33 0x09ac4230 in nsFocusController::MoveFocus(int, nsIDOMElement*) (this=0xe5494c0, aForward=1, aElt=0xe54faf4) at nsFocusController.cpp:259 #34 0x0f0b555c in nsXULCommandDispatcher::AdvanceFocusIntoSubtree(nsIDOMElement*) (this=0xe52a120, aElt=0xe54faf4) at nsXULCommandDispatcher.cpp:206 #35 0x00e50be8 in _XPTC_InvokeByIndex () #36 0x00e4ff20 in XPTC_InvokeByIndex (that=0xe52a120, methodIndex=14, paramCount=1, params=0xbfffa820) at xptcinvoke_ppc_rhapsody.cpp:144 #37 0x022bf45c in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) (ccx=@0xbfffab10, mode=CALL_METHOD) at xpcwrappednative.cpp:2022 #38 0x022c877c in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*, long*) (cx=0xe549660, obj=0xd727928, argc=1, argv=0xe5b1548, vp=0xbfffac20) at xpcwrappednativejsops.cpp:1292 #39 0x003b8528 in js_Invoke (cx=0xe549660, argc=1, flags=0) at jsinterp.c:843 #40 0x003c9544 in js_Interpret (cx=0xe549660, result=0xbfffb2f0) at jsinterp.c:2811 #41 0x003b85b0 in js_Invoke (cx=0xe549660, argc=1, flags=2) at jsinterp.c:860 #42 0x003b89c4 in js_InternalInvoke (cx=0xe549660, obj=0xd726680, fval=225605816, flags=0, argc=1, argv=0x57ef550, rval=0xbfffb590) at jsinterp.c:935 #43 0x00377140 in JS_CallFunctionValue (cx=0xe549660, obj=0xd726680, fval=225605816, argc=1, argv=0x57ef550, rval=0xbfffb590) at jsapi.c:3432 #44 0x09ac0698 in nsJSContext::CallEventHandler(void*, void*, unsigned, void*, int*, int) (this=0xe549590, aTarget=0xd726680, aHandler=0xd7278b8, argc=1, argv=0x57ef550, aBoolResult=0xbfffb6c4, aReverseReturnResult=0) at nsJSEnvironment.cpp:1039 #45 0x09ada120 in GlobalWindowImpl::RunTimeout(nsTimeoutImpl*) (this=0xe549390, aTimeout=0x57ef500) at nsGlobalWindow.cpp:4745 #46 0x09adafbc in GlobalWindowImpl::TimerCallback(nsITimer*, void*) (aTimer=0x57ef5b0, aClosure=0x57ef500) at nsGlobalWindow.cpp:5104 #47 0x00e28d48 in nsTimerImpl::Fire() (this=0x57ef5b0) at nsTimerImpl.cpp:382 #48 0x00e28ff4 in handleTimerEvent(TimerEventType*) (event=0x57ef5f0) at nsTimerImpl.cpp:447 #49 0x00e1f024 in PL_HandleEvent (self=0x57ef5f0) at plevent.c:663 #50 0x00e1edcc in PL_ProcessPendingEvents (self=0xe547950) at plevent.c:593 #51 0x00e1f740 in _md_EventReceiverProc (nextHandler=0xbfffbb80, inEvent=0x783f1a89, userData=0xe547950) at plevent.c:1540 #52 0x969a2784 in DispatchEventToHandlers () #53 0x969a2aec in SendEventToEventTargetInternal () #54 0x969a5efc in SendEventToEventTargetWithOptions () #55 0x969b2308 in ToolboxEventDispatcherHandler(OpaqueEventHandlerCallRef*, OpaqueEventRef*, void*) () #56 0x969a283c in DispatchEventToHandlers () #57 0x969a2aec in SendEventToEventTargetInternal () #58 0x969b4e5c in SendEventToEventTarget () #59 0x969b6c20 in ToolboxEventDispatcher(OpaqueEventRef*) () #60 0x969c8198 in CallEventDispatchHook () #61 0x969b3658 in TryEventDispatcher () #62 0x969a40a0 in GetOrPeekEvent () #63 0x969a3d4c in GetNextEventMatchingMask () #64 0x969a7b70 in WNEInternal () #65 0x969ada34 in WaitNextEvent () #66 0x067621f4 in nsMacMessagePump::GetEvent(EventRecord&) (this=0xe54ef90, theEvent=@0x67fd490) at nsMacMessagePump.cpp:408 #67 0x0674e630 in nsAppShell::GetNativeEvent(int&, void*&) (this=0xe54ef70, aRealEvent=@0xbfffc238, aEvent=@0xbfffc234) at nsAppShell.cpp:231 #68 0x058317f0 in nsXULWindow::ShowModal() (this=0xe547ac0) at nsXULWindow.cpp:293 #69 0x0584909c in nsWebShellWindow::ShowModal() (this=0xe547ac0) at nsWebShellWindow.cpp:1105 #70 0x0582dad4 in nsContentTreeOwner::ShowAsModal() (this=0xe54dfe0) at nsContentTreeOwner.cpp:446 #71 0x02b44550 in nsWindowWatcher::OpenWindowJS(nsIDOMWindow*, char const*, char const*, char const*, int, unsigned, long*, nsIDOMWindow**) (this=0x2fd490, aParent=0xd5ad2d4, aUrl=0xe5477a0 "chrome://messenger/content/junkLog.xul", aName=0xbfffc930 "junkLog", aFeatures=0xbfffc870 "chrome,modal,titlebar,resizable,centerscreen", aDialog=1, argc=1, argv=0xe5456e8, _retval=0xbfffc8c0) at nsWindowWatcher.cpp:789 #72 0x09ad8e7c in GlobalWindowImpl::OpenInternal(nsAString const&, nsAString const&, nsAString const&, int, long*, unsigned, nsISupports*, nsIDOMWindow**) (this=0xd5ad2d0, aUrl=@0xbfffca80, aName=@0xbfffcb10, aOptions=@0xbfffcba0, aDialog=1, argv=0xe5456dc, argc=4, aExtraArgument=0x0, aReturn=0xbfffcdb0) at nsGlobalWindow.cpp:4385 #73 0x09ad2ec4 in GlobalWindowImpl::OpenDialog(nsIDOMWindow**) (this=0xd5ad2d0, _retval=0xbfffcdb0) at nsGlobalWindow.cpp:3069 #74 0x00e50be8 in _XPTC_InvokeByIndex () #75 0x00e4ff20 in XPTC_InvokeByIndex (that=0xd5ad2d8, methodIndex=16, paramCount=1, params=0xbfffcdb0) at xptcinvoke_ppc_rhapsody.cpp:144 #76 0x022bf45c in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) (ccx=@0xbfffd0a0, mode=CALL_METHOD) at xpcwrappednative.cpp:2022 #77 0x022c877c in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*, long*) (cx=0xd618630, obj=0x88cc08, argc=4, argv=0xe5456dc, vp=0xbfffd1b0) at xpcwrappednativejsops.cpp:1292 #78 0x003b8528 in js_Invoke (cx=0xd618630, argc=4, flags=0) at jsinterp.c:843 #79 0x003c9544 in js_Interpret (cx=0xd618630, result=0xbfffd880) at jsinterp.c:2811 #80 0x003b85b0 in js_Invoke (cx=0xd618630, argc=1, flags=2) at jsinterp.c:860 #81 0x003b89c4 in js_InternalInvoke (cx=0xd618630, obj=0x40dbbf8, fval=225600904, flags=0, argc=1, argv=0xbfffdb94, rval=0xbfffdb20) at jsinterp.c:935 #82 0x00377140 in JS_CallFunctionValue (cx=0xd618630, obj=0x40dbbf8, fval=225600904, argc=1, argv=0xbfffdb94, rval=0xbfffdb20) at jsapi.c:3432 #83 0x09ac0698 in nsJSContext::CallEventHandler(void*, void*, unsigned, void*, int*, int) (this=0xd618560, aTarget=0x40dbbf8, aHandler=0xd726588, argc=1, argv=0xbfffdb94, aBoolResult=0xbfffdd14, aReverseReturnResult=0) at nsJSEnvironment.cpp:1039 #84 0x09b0f2e8 in nsJSEventListener::HandleEvent(nsIDOMEvent*) (this=0xd7251f0, aEvent=0xe53e7c8) at nsJSEventListener.cpp:180 #85 0x0eef899c in nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEvent*, nsIDOMEventTarget*, unsigned, unsigned) (this=0xd7251b0, aListenerStruct=0xd611740, aDOMEvent=0xe53e7c8, aCurrentTarget=0xd5c17e0, aSubType=8, aPhaseFlags=7) at nsEventListenerManager.cpp:1217 #86 0x0eefc2d4 in nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, unsigned, nsEventStatus*) (this=0xd7251b0, aPresContext=0x1e3dbc0, aEvent=0xbfffe7c0, aDOMEvent=0xbfffe2e0, aCurrentTarget=0xd5c17e0, aFlags=7, aEventStatus=0xbfffe7b4) at nsEventListenerManager.cpp:2216 #87 0x0f0a735c in nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEvent**, unsigned, nsEventStatus*) (this=0xd725170, aPresContext=0x1e3dbc0, aEvent=0xbfffe7c0, aDOMEvent=0xbfffe2e0, aFlags=7, aEventStatus=0xbfffe7b4) at nsXULElement.cpp:3315 #88 0x0ed3f844 in PresShell::HandleDOMEventWithTarget(nsIContent*, nsEvent*, nsEventStatus*) (this=0xd60ec10, aTargetContent=0xd725170, aEvent=0xbfffe7c0, aStatus=0xbfffe7b4) at nsPresShell.cpp:6322 #89 0x0ee47d74 in nsButtonBoxFrame::MouseClicked(nsIPresContext*, nsGUIEvent*) (this=0xd73ce58, aPresContext=0x1e3dbc0, aEvent=0xbfffeb00) at nsButtonBoxFrame.cpp:199 #90 0x0ee478bc in nsButtonBoxFrame::HandleEvent(nsIPresContext*, nsGUIEvent*, nsEventStatus*) (this=0xd73ce58, aPresContext=0x1e3dbc0, aEvent=0xbfffeb00, aEventStatus=0xbffff014) at nsButtonBoxFrame.cpp:143 #91 0x0ed3f664 in PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned, nsEventStatus*) (this=0xd60ec10, aEvent=0xbfffeb00, aView=0x0, aFlags=1, aStatus=0xbffff014) at nsPresShell.cpp:6290 #92 0x0ed3f164 in PresShell::HandleEventWithTarget(nsEvent*, nsIFrame*, nsIContent*, unsigned, nsEventStatus*) (this=0xd60ec10, aEvent=0xbfffeb00, aFrame=0xd73ce58, aContent=0xd725170, aFlags=1, aStatus=0xbffff014) at nsPresShell.cpp:6228 #93 0x0ef09ff4 in nsEventStateManager::CheckForAndDispatchClick(nsIPresContext*, nsMouseEvent*, nsEventStatus*) (this=0xd59fb50, aPresContext=0x1e3dbc0, aEvent=0xbffff410, aStatus=0xbffff014) at nsEventStateManager.cpp:2850 #94 0x0ef06ee4 in nsEventStateManager::PostHandleEvent(nsIPresContext*, nsEvent*, nsIFrame*, nsEventStatus*, nsIView*) (this=0xd59fb50, aPresContext=0x1e3dbc0, aEvent=0xbffff410, aTargetFrame=0xd73ce58, aStatus=0xbffff014, aView=0x1e3e260) at nsEventStateManager.cpp:1847 #95 0x0ed3f6d8 in PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned, nsEventStatus*) (this=0xd60ec10, aEvent=0xbffff410, aView=0x1e3e260, aFlags=1, aStatus=0xbffff014) at nsPresShell.cpp:6295 #96 0x0ed3ee44 in PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*, int, int&) (this=0xd60ec10, aView=0x1e3e260, aEvent=0xbffff410, aEventStatus=0xbffff014, aForceHandle=1, aHandled=@0xbffff084) at nsPresShell.cpp:6183 #97 0x0ce8325c in nsViewManager::HandleEvent(nsView*, nsGUIEvent*, int) (this=0x1e3e090, aView=0x1e3e260, aEvent=0xbffff410, aCaptured=1) at nsViewManager.cpp:2206 #98 0x0ce71940 in nsView::HandleEvent(nsViewManager*, nsGUIEvent*, int) (this=0x1e3e260, aVM=0x1e3e090, aEvent=0xbffff410, aCaptured=1) at nsView.cpp:308 #99 0x0ce825c0 in nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) (this=0x1e3e090, aEvent=0xbffff410, aStatus=0xbffff260) at nsViewManager.cpp:1938 #100 0x0ce70d68 in HandleEvent(nsGUIEvent*) (aEvent=0xbffff410) at nsView.cpp:80 #101 0x06788860 in nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&) (this=0x1e3e2d0, event=0xbffff410, aStatus=@0xbffff320) at nsWindow.cpp:1986 #102 0x06788958 in nsWindow::DispatchWindowEvent(nsGUIEvent&) (this=0x1e3e2d0, event=@0xbffff410) at nsWindow.cpp:2001 #103 0x06788aa0 in nsWindow::DispatchMouseEvent(nsMouseEvent&) (this=0x1e3e2d0, aEvent=@0xbffff410) at nsWindow.cpp:2027 #104 0x0675f480 in nsMacEventHandler::HandleMouseUpEvent(EventRecord&) (this=0xd59c970, aOSEvent=@0xbffff6c0) at nsMacEventHandler.cpp:1658 #105 0x0675cb28 in nsMacEventHandler::HandleOSEvent(EventRecord&) (this=0xd59c970, aOSEvent=@0xbffff6c0) at nsMacEventHandler.cpp:534 #106 0x0676a5a8 in nsMacWindow::DispatchEvent(void*, int*) (this=0xd608e00, anEvent=0xbffff6c0, _retval=0xbffff570) at nsMacWindow.cpp:1710 #107 0x0676370c in nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, OpaqueWindowPtr*) (this=0x300d80, anEvent=@0xbffff6c0, aWindow=0xd60ca30) at nsMacMessagePump.cpp:1046 #108 0x06763238 in nsMacMessagePump::DoMouseUp(EventRecord&) (this=0x300d80, anEvent=@0xbffff6c0) at nsMacMessagePump.cpp:824 #109 0x06762330 in nsMacMessagePump::DispatchEvent(int, EventRecord*) (this=0x300d80, aRealEvent=1, anEvent=0xbffff6c0) at nsMacMessagePump.cpp:447 #110 0x0676206c in nsMacMessagePump::DoMessagePump() (this=0x300d80) at nsMacMessagePump.cpp:313 #111 0x0674e124 in nsAppShell::Run() (this=0x2f97b0) at nsAppShell.cpp:120 #112 0x0583de8c in nsAppShellService::Run() (this=0x2f1c10) at nsAppShellService.cpp:479 #113 0x00006ad4 in main1(int, char**, nsISupports*) (argc=1, argv=0xbffffb84, nativeApp=0x725b10) at nsAppRunner.cpp:1269 #114 0x000072cc in main (argc=1, argv=0xbffffb84) at nsAppRunner.cpp:1640 #115 0x000027bc in _start (argc=1, argv=0xbffffb84, envp=0xbffffb8c) at /SourceCache/Csu/Csu-45/crt.c:267 #116 0x0000263c in start ()

we appear to be bouncing back and forth between two event state managers, I think one is for the window and one is for the junk log (a browser xul element)

*** This bug has been marked as a duplicate of 137191 ***

re-opening, not 100% certain this is a dup yet. that other bug is on winnt, but this is mac only. the are definitely related.

see http://bugzilla.mozilla.org/show_bug.cgi?id=137191#c11 "What is the accessibility.tabfocus pref set to? That pref corresponds to this: enum nsTabFocusModel { //eTabFocus_textControlsMask = (1<<0), // unused - textboxes always tabbable eTabFocus_formElementsMask = (1<<1), // non-text form elements eTabFocus_linksMask = (1<<2), // links eTabFocus_any = 1 + (1<<1) + (1<<2), // everything that can be focused }; At minimum, textfields are always focusable. However, if that pref is set to 0 or 1, I could imagine an infinite recursion scenario if there are no textfields." we set this pref to 1 in macprefs.js, which is why this bug is mac only.

setting aas blocker for now. may not last.

on win32, this (or something like it?) might fix bug #137191

I think in both bugs, we the problem is this: on tab, we find nothing, but there is an iframe (the browser element). so we descend into it, but find nothing to focus, so we pop back out. when we pop back out, there is nothing, but there is an iframe (the browser element). and now we are looping. I'll continue to debug.

note, this hack will probably only work when there is only one <browser> elements.

hmm, I need to look into what mTabbedThroughDocument is for, and if it was supposed to prevent this type of thing or not.

mTabbedThroughDocument was for bryner's fix for bug #108791 this bug (and #137191) are different, as they are for a xul document with an iframe (browser element), and no other focusable widgets. I've cleaned up the patch slightly, and I'll attach a new version.

should make it for 1.4 alpha, but would be good for 1.3 final.

Comment on attachment 116913 [details] [diff] [review] updated fix locally, I've fixed the comment: // see bug #95011 and bug #37191 // see bug #195011 and bug #137191

Comment on attachment 116913 [details] [diff] [review] updated fix hoping for review from aaronl and sr (or r) from bryner.

Comment on attachment 116913 [details] [diff] [review] updated fix I don't really understand logic in the method TabIntoDocument here: 5135 PRBool focusDocument; 5136 if (!aForward || (itemType == nsIDocShellTreeItem::typeChrome)) 5137 focusDocument = PR_FALSE; 5138 else { 5139 // Check for a frameset document 5140 focusDocument = !(IsFrameSetDoc(aDocShell)); 5141 } Why do we only focus a document if we're moving forward and we're in content. The part about not being in a frameset doc makes sense. Anyway, why do we only want to set mTabbedDocument if focusDocument is true? Also, were there any crashes or infinite loops when shift+tab, f6 or shift+f6 are used? [shift]+F6 are the shortcuts for move by document. What do you think about renaming mTabbedDocument to something more specific, something like mTabbingFromDocShell? Just a thought.

> Why do we only focus a document if we're moving forward and we're in content. I suppose I can answer my own question, after some thought. We don't want to focus on a XUL document itself, just the things inside of it. Perhaps the moving forward requirement has to do with the tab order. When you shift+tab onto a document you want to focus on the last element. When you tab onto a document you want to focus on the document itself first. Perhaps we want to put this information comments somewhere in that code. I guess I understand the patch now. Let me know if it works with [shift]+F6 and [shift]+Tab, what you think about renaming mTabbingDocument and perhaps commenting up TabIntoDocument() since you're touching that code anyway.

Comment on attachment 116913 [details] [diff] [review] updated fix This is certainly an improvement. To make the fix completely generic, I think we'd actually need to keep track of all of the documents that we've recursed into, and check before we call TabIntoDocument that the document doesn't appear _anywhere_ on the list.

aaronl, it does the right thing with with tab, [shift]+tab, F6, and [shift]+F6. I'll work to modify the fix to work for all sub_shells, as bryner suggests.

should be + if (mTabbedDocuments && NS_SUCCEEDED(mTabbedDocuments->GetIndexOf(sub_shell, &idx)) && idx != -1) new patch coming...

I still think mTabbedDocuments sounds too much like it relates to tabbed browsing, could cause confusion.

Comment on attachment 116913 [details] [diff] [review] updated fix clearing r/sr requests

Comment on attachment 117223 [details] [diff] [review] updated patch seeing r/sr from aaronl and bryner. this patch is more generic (as bryner suggested), and the member variable is named mTabbingThroughDocShells, per aaronl's suggestion in a previous comment.

actually, would mTabbingFromDocShells be better than mTabbingThroughDocShells? I'll wait for aaronl or bryner to comment.

Comment on attachment 117223 [details] [diff] [review] updated patch Yes, I like mTabbingFromDocShells better :-) Would it be good to have any safeguards to make sure the array doesn't ever grow somehow? For example, to clear it out whenever the esm is finished handling a navigation key?

fix member variable name, and make it so the place we add / remove is "fool proof". still need to re-test.

Comment on attachment 117369 [details] [diff] [review] a version that compiles! this is a simpler patch, one where you can see the add and remove are paired up. hmm, when written this way, is a isupports array still needed, or is it overkill?

Comment on attachment 117369 [details] [diff] [review] a version that compiles! r=aaronl

Comment on attachment 117369 [details] [diff] [review] a version that compiles! nsISupportsArray is deprecated; you can use nsCOMArray instead.

Comment on attachment 117454 [details] [diff] [review] version of the patch that uses nsCOMArray a version that uses nsCOMArray.

fixed. asa, if there was going to be another release off the 1.3 branch, we'd want this.

*** Bug 188974 has been marked as a duplicate of this bug. ***

back ported to the 1.3.1 branch.

Using trunk build 20030415 on mac osx and retested on winxp and linux with trunk build 20030415 this does not crash and does work. Verified.