14885 - default dialog button causing window close also crashes

Status: VERIFIED FIXED

(SeaMonkey :: General, defect, P3)

Description

[Dan M]

Open the File / Open Web Location dialog.  Type a character or more in the edit field.  Hit "return". Crash.
It looks like the handler for the key event is trying to do some post-processing using as its target a deleted frame
from the recently dismissed dialog.
  I'm looking at this one at the moment.  All rights to reassign reserved.

Comment 1

[Dan M]

The mFrame in nsEnderKeyListener is deleted in the HandleDOMEvent call within KeyUp,
thanks to a JavaScript event handler in the window.  Subsequent use in PostHandleEvent crashes.
The window's deletion could be survived by simply handling the bad mFrame within KeyUp.
Attempts to do this have disappointed.

Comment 2

[Dan M]

Event handler now holds a weak reference to the ephemeral frame. It knows when the frame is deleted,
and recovers. Fix checked in to trunk and M10 branch.

Comment 3

[Paul MacQuiddy]

This is still crashing on a windows M10 candidate build. Will have to
release-note. Re-opening so I'll remember to check it on the tip builds.
To reproduce just use File / Open Web Location and type in a url and press
return.

Comment 4

[Paul MacQuiddy]

changing QA contact to cpratt

Comment 5

[leger]

Moving to M11.  paulmac, please Release Note for M10 at:
http://bugzilla.mozilla.org/show_bug.cgi?id=14872

Comment 6

[Dan M]

Damn.  Checking source, I see I goofed hand-merging my changes into M10.
Good news is, it's still fixed in M11.  Marking fixed M11.

Comment 7

[Paul MacQuiddy]

the crash does not happen with M11 builds. There is still a problem, however,
that Open Web Location goes into some type of endless loop where the URL never
gets loaded. A new bug will be opened on that. Marking this bug verified.