288587 - crash while viewing Real videos

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Josh Aas]

While viewing videos in real content, Camino crashes for me. I'm using a build
from CVS about 3 hours ago (see filing time for this bug).

This is almost certainly caused by a problem with the patch by Aaron Leventhal
for bug 245349.

"I bet the issue is that nsObjectFrame::IsFocusable writes to *aTabIndex without
checking whether aTabIndex is its default value (null)." - bz

Comment 1

[Josh Aas]

Relevant stack trace info...

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   libgklayout.dylib              	0x02e8bc68 nsObjectFrame::IsFocusable(int*,
int) + 0x14
1   libgklayout.dylib              	0x02fc97d4
nsGenericElement::SetFocus(nsPresContext*) + 0x64
2   libgklayout.dylib              	0x02ff62f4
nsEventStateManager::ChangeFocusWith(nsIContent*,
nsIEventStateManager::EFocusedWithType) + 0x58
3   libgklayout.dylib              	0x02ff446c
nsEventStateManager::PostHandleEvent(nsPresContext*, nsEvent*, nsIFrame*,
nsEventStatus*, nsIView*) + 0x30c
4   libgklayout.dylib              	0x02e4475c
PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned int, nsEventStatus*)
+ 0x4a0
5   libgklayout.dylib              	0x02e4419c PresShell::HandleEvent(nsIView*,
nsGUIEvent*, nsEventStatus*, int, int&) + 0x44c
6   libgklayout.dylib              	0x030ae1d0
nsViewManager::HandleEvent(nsView*, nsGUIEvent*, int) + 0x318
7   libgklayout.dylib              	0x030ad370
nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) + 0xc9c
8   libgklayout.dylib              	0x030a4db0 HandleEvent(nsGUIEvent*) + 0x48
9   libwidget_mac.dylib            	0x02cceb18
nsChildView::DispatchEvent(nsGUIEvent*, nsEventStatus&) + 0x98
10  libwidget_mac.dylib            	0x02cceba0
nsChildView::DispatchWindowEvent(nsGUIEvent&) + 0x20
11  libwidget_mac.dylib            	0x02ccec5c
nsChildView::DispatchMouseEvent(nsMouseEvent&) + 0x64
12  libwidget_mac.dylib            	0x02cd095c -[ChildView mouseDown:] + 0x1a0

Comment 2

[timeless]

Attachment: null check

Comment 3

[Simon Fraser [no longer active]]

Why did this change? Who's calling it with null?

Comment 4

[Boris Zbarsky [:bzbarsky]]

> Why did this change?

nsObjectFrame::IsFocusable was added just a few days ago.

> Who's calling it with null?

See at least http://lxr.mozilla.org/seamonkey/search?string=isfocusable%28%29
(and note that null is the default value for that arg).

Comment 5

[Simon Fraser [no longer active]]

Looks like timeless checked in the patch.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

*** Bug 288684 has been marked as a duplicate of this bug. ***

Comment 7

[timeless]

*** Bug 241984 has been marked as a duplicate of this bug. ***