[BUG-134022] [CRASH] Viewer crashes when double clicking on scroll bar arrow in Outfit Gallery tab

[sl-service-account]

Steps to Reproduce

• Open Appearance Panel: Me -> Appearance.

• Go to the Outfit Gallery tab.

• Double click quickly on either the up or down arrow for scroll bar in the Outfit Gallery.

  Observed Behaviour

• Viewer crashes to desktop instantly.

• Crash is 100% reproducible.

• Logs attached.

• Callstack (Symbols: automated-builds-secondlife-com.s3.amazonaws.com/hg/repo/asset-http/rev/326593/index.html)

  
  Operating system: Windows NT
                  10.0.14393 
  CPU: x86
     GenuineIntel family 6 model 94 stepping 3
     8 CPUs
  
  Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
  Crash address: 0x19c
  Assertion: Unknown assertion type 0x00000000
  Process uptime: not available
  
  Thread 0 (crashed)
  0  SecondLifeViewer.exe!LLAccordionCtrlTab::showAndFocusHeader() [llaccordionctrltab.cpp : 826 + 0x0]
    eip = 0x0179db9d   esp = 0x003bed24   ebp = 0x003bed84   ebx = 0x00000000
    esi = 0x1ecba598   edi = 0x1ecbabe8   eax = 0x003bed78   ecx = 0x00000000
    edx = 0x00000000   efl = 0x00210206
    Found by: given as instruction pointer in context
  1  SecondLifeViewer.exe!LLOutfitGallery::handleDoubleClick(int,int,unsigned int) [lloutfitgallery.cpp : 766 + 0xb]
    eip = 0x00e92951   esp = 0x003bed8c   ebp = 0x003bedec
    Found by: call frame info
  2  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003bedf4   ebp = 0x003bee6c
    Found by: call frame info
  3  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003bee74   ebp = 0x003bee90
    Found by: call frame info
  4  SecondLifeViewer.exe!LLUICtrl::handleDoubleClick(int,int,unsigned int) [lluictrl.cpp : 375 + 0x10]
    eip = 0x01709375   esp = 0x003bee98   ebp = 0x003beeac
    Found by: call frame info
  5  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003beeb4   ebp = 0x003bef2c
    Found by: call frame info
  6  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003bef34   ebp = 0x003bef50
    Found by: call frame info
  7  SecondLifeViewer.exe!LLUICtrl::handleDoubleClick(int,int,unsigned int) [lluictrl.cpp : 375 + 0x10]
    eip = 0x01709375   esp = 0x003bef58   ebp = 0x003bef6c
    Found by: call frame info
  8  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003bef74   ebp = 0x003befec
    Found by: call frame info
  9  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003beff4   ebp = 0x003bf010
    Found by: call frame info
  10  SecondLifeViewer.exe!LLUICtrl::handleDoubleClick(int,int,unsigned int) [lluictrl.cpp : 375 + 0x10]
    eip = 0x01709375   esp = 0x003bf018   ebp = 0x003bf02c
    Found by: call frame info
  11  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003bf034   ebp = 0x003bf0ac
    Found by: call frame info
  12  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003bf0b4   ebp = 0x003bf0d0
    Found by: call frame info
  13  SecondLifeViewer.exe!LLUICtrl::handleDoubleClick(int,int,unsigned int) [lluictrl.cpp : 375 + 0x10]
    eip = 0x01709375   esp = 0x003bf0d8   ebp = 0x003bf0ec
    Found by: call frame info
  14  SecondLifeViewer.exe!LLFloater::handleDoubleClick(int,int,unsigned int) [llfloater.cpp : 1605 + 0x14]
    eip = 0x016b9b4b   esp = 0x003bf0f4   ebp = 0x003bf108
    Found by: call frame info
  15  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003bf110   ebp = 0x003bf188
    Found by: call frame info
  16  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003bf190   ebp = 0x003bf1ac
    Found by: call frame info
  17  SecondLifeViewer.exe!LLUICtrl::handleDoubleClick(int,int,unsigned int) [lluictrl.cpp : 375 + 0x10]
    eip = 0x01709375   esp = 0x003bf1b4   ebp = 0x003bf1c8
    Found by: call frame info
  18  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003bf1d0   ebp = 0x003bf248
    Found by: call frame info
  19  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003bf250   ebp = 0x003bf26c
    Found by: call frame info
  20  SecondLifeViewer.exe!LLUICtrl::handleDoubleClick(int,int,unsigned int) [lluictrl.cpp : 375 + 0x10]
    eip = 0x01709375   esp = 0x003bf274   ebp = 0x003bf288
    Found by: call frame info
  21  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003bf290   ebp = 0x003bf308
    Found by: call frame info
  22  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003bf310   ebp = 0x003bf32c
    Found by: call frame info
  23  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003bf334   ebp = 0x003bf3ac
    Found by: call frame info
  24  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003bf3b4   ebp = 0x003bf3d0
    Found by: call frame info
  25  SecondLifeViewer.exe!LLUICtrl::handleDoubleClick(int,int,unsigned int) [lluictrl.cpp : 375 + 0x10]
    eip = 0x01709375   esp = 0x003bf3d8   ebp = 0x003bf3ec
    Found by: call frame info
  26  SecondLifeViewer.exe!LLView::childrenHandleMouseEvent<int ( LLView::*)(int,int,unsigned int),unsigned int>(int ( LLView::*const &)(int,int,unsigned int),int,int,unsigned int,bool) [llview.cpp : 733 + 0x15]
    eip = 0x016f5119   esp = 0x003bf3f4   ebp = 0x003bf46c
    Found by: call frame info
  27  SecondLifeViewer.exe!LLView::handleDoubleClick(int,int,unsigned int) [llview.cpp : 1049 + 0x22]
    eip = 0x016fe798   esp = 0x003bf474   ebp = 0x003bf490
    Found by: call frame info
  28  SecondLifeViewer.exe!LLMouseHandler::handleAnyMouseClick(int,int,unsigned int,LLMouseHandler::EClickType,int) [llmousehandler.cpp : 52 + 0xe]
    eip = 0x0183821f   esp = 0x003bf498   ebp = 0x003bf4bc
    Found by: call frame info
  29  SecondLifeViewer.exe!LLViewerWindow::handleAnyMouseClick(LLWindow *,LLCoord<LL_COORD_TYPE_GL>,unsigned int,LLMouseHandler::EClickType,int) [llviewerwindow.cpp : 1000 + 0x14]
    eip = 0x01270259   esp = 0x003bf4c4   ebp = 0x003bf52c
    Found by: call frame info
  30  SecondLifeViewer.exe!LLViewerWindow::handleDoubleClick(LLWindow *,LLCoord<LL_COORD_TYPE_GL>,unsigned int) [llviewerwindow.cpp : 1064 + 0x17]
    eip = 0x0127097b   esp = 0x003bf534   ebp = 0x003bf550
    Found by: call frame info
  31  SecondLifeViewer.exe!LLWindowWin32::mainWindowProc(HWND__ *,unsigned int,unsigned int,long) [llwindowwin32.cpp : 2314 + 0x10]
    eip = 0x0183d9c0   esp = 0x003bf558   ebp = 0x003bf660
    Found by: call frame info
  32  user32.dll + 0x2d2b3
    eip = 0x76cad2b3   esp = 0x003bf668   ebp = 0x003bf68c
    Found by: call frame info
  33  user32.dll + 0xe88a
    eip = 0x76c8e88a   esp = 0x003bf694   ebp = 0x003bf774
    Found by: previous frame's frame pointer
  34  user32.dll + 0xdf17
    eip = 0x76c8df17   esp = 0x003bf77c   ebp = 0x003bf7b0
    Found by: previous frame's frame pointer
  35  opengl32.dll + 0x2ce43
    eip = 0x5a6ace43   esp = 0x003bf7b8   ebp = 0x003bf7f0
    Found by: previous frame's frame pointer
  36  user32.dll + 0x2d2b3
    eip = 0x76cad2b3   esp = 0x003bf7f8   ebp = 0x003bf81c
    Found by: previous frame's frame pointer
  37  user32.dll + 0xe88a
    eip = 0x76c8e88a   esp = 0x003bf824   ebp = 0x003bf904
    Found by: previous frame's frame pointer
  38  user32.dll + 0xe1e4
    eip = 0x76c8e1e4   esp = 0x003bf90c   ebp = 0x003bf978
    Found by: previous frame's frame pointer
  39  user32.dll + 0xdfa0
    eip = 0x76c8dfa0   esp = 0x003bf980   ebp = 0x003bf984
    Found by: previous frame's frame pointer
  40  SecondLifeViewer.exe!LLWindowWin32::gatherInput() [llwindowwin32.cpp : 1822 + 0xa]
    eip = 0x0183a806   esp = 0x003bf98c   ebp = 0x003bf9b8
    Found by: previous frame's frame pointer
  41  SecondLifeViewer.exe!LLAppViewer::frame() [llappviewer.cpp : 1371 + 0x10]
    eip = 0x009a541d   esp = 0x003bf9c0   ebp = 0x003bfa9c
    Found by: call frame info
  42  SecondLifeViewer.exe!WinMain [llappviewerwin32.cpp : 322 + 0x9]
    eip = 0x0137e579   esp = 0x003bfaa4   ebp = 0x003bfacc
    Found by: call frame info
  43  SecondLifeViewer.exe!__tmainCRTStartup [crtexe.c : 618 + 0xe]
    eip = 0x01c6337f   esp = 0x003bfad4   ebp = 0x003bfb18
    Found by: call frame info
  44  kernel32.dll + 0x162c4
    eip = 0x773062c4   esp = 0x003bfb20   ebp = 0x003bfb2c
    Found by: call frame info
  45  ntdll.dll + 0x60fd9
    eip = 0x77930fd9   esp = 0x003bfb34   ebp = 0x003bfb74
    Found by: previous frame's frame pointer
  46  ntdll.dll + 0x60fa4
    eip = 0x77930fa4   esp = 0x003bfb7c   ebp = 0x003bfb84
    Found by: previous frame's frame pointer

  Expected Behaviour

  No crash

Attachments

• dump-5f746b50-c31b-de42-4594-22905bbdf049.zip 2017-07-17 17:17:50

Original Jira Fields

| Field | Value | | ------------- | ------------- | | Issue | BUG-134022 | | Summary | [CRASH] Viewer crashes when double clicking on scroll bar arrow in Outfit Gallery tab | | Type | Bug | | Priority | Unset | | Status | Accepted | | Resolution | Accepted | | Reporter | Whirly Fizzle (whirly.fizzle) | | Created at | 2017-07-17T21:13:04Z | | Updated at | 2017-08-02T15:39:36Z | ``` { 'Business Unit': ['Platform'], 'Date of First Response': '2017-08-02T10:39:36.537-0500', 'ReOpened Count': 0.0, 'Regression?': ['Issue is a Regression'], 'Severity': 'Unset', 'System': 'SL Viewer', 'Target Viewer Version': 'viewer-development', 'What just happened?': 'Filling in...', 'What were you doing when it happened?': '...', 'What were you expecting to happen instead?': '....', } ```

[sl-service-account]

AnnaT ProductEngine commented at 2017-08-02T15:39:37Z

Reproduce on Second Life 5.0.6.326593 (Second Life Release)