37301 - crash after invoking a dynamically created menu item

Status: RESOLVED FIXED

(Core :: XUL, defect, P1)

Description

[Radha on family leave (not reading bugmail)]

Steps to  reproduce:

1) create a menu whose items are populated in a oncreate() handler.
2) Provide a ondestroy handler to destroy the items when the menu goes away
3) Provide a oncommand handler for the menu
4) Invoke one of the menu items
5) The oncommand handler is called. The ondestroy handler is called.
6) Crash after destroying all the dynamic menu items


Workaround tried:
-----------------
If the ondestroy handler is removed and items are deleted at a later time, the 
crash goes away

It may not be necessary to create the menu items dynamically. But I haven't 
tried it. I've seen this crash consistently in all my dynamic menu requirements.


Stack trace is:

nsMenuFrame::SelectMenu(nsMenuFrame * const 0x0215bf70, int 0) line 397 + 23 
bytes
nsMenuPopupFrame::SetCurrentMenuItem(nsMenuPopupFrame * const 0x020de1e8, 
nsIMenuFrame * 0x00000000) line 870
nsMenuFrame::OpenMenuInternal(int 0) line 622
nsMenuFrame::AttributeChanged(nsMenuFrame * const 0x020b30e0, nsIPresContext * 
0x025ef220, nsIContent * 0x02abf740, int 0, nsIAtom * 0x01063590, int 2) line 
479
nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const 
0x025bd1d0, nsIPresContext * 0x025ef220, nsIContent * 0x02abf740, int 0, nsIAtom 
* 0x01063590, int 2) line 9430 + 35 bytes
StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x025bd290, nsIPresContext * 
0x025ef220, nsIContent * 0x02abf740, int 0, nsIAtom * 0x01063590, int -1) line 
1076
PresShell::AttributeChanged(PresShell * const 0x025d7198, nsIDocument * 
0x01ebb4a0, nsIContent * 0x02abf740, int 0, nsIAtom * 0x01063590, int -1) line 
2732 + 57 bytes
nsXULDocument::AttributeChanged(nsXULDocument * const 0x01ebb4a0, nsIContent * 
0x02abf740, int 0, nsIAtom * 0x01063590, int -1) line 1483
nsXULElement::UnsetAttribute(nsXULElement * const 0x02abf740, int 0, nsIAtom * 
0x01063590, int 1) line 3036
nsXULElement::RemoveAttribute(nsXULElement * const 0x02abf750, const nsString & 
{...}) line 1487 + 31 bytes
nsMenuFrame::OpenMenu(nsMenuFrame * const 0x020b3140, int 0) line 499 + 52 bytes
nsMenuPopupFrame::DismissChain(nsMenuPopupFrame * const 0x020de1e8) line 1174
nsMenuFrame::Execute() line 1291
nsMenuFrame::HandleEvent(nsMenuFrame * const 0x0215bf10, nsIPresContext * 
0x025ef220, nsGUIEvent * 0x0012fa2c, nsEventStatus * 0x0012f938) line 314
PresShell::HandleEventInternal(nsEvent * 0x0012fa2c, nsIView * 0x0326df00, 
nsEventStatus * 0x0012f938) line 3333 + 38 bytes
PresShell::HandleEvent(PresShell * const 0x025d7194, nsIView * 0x0326df00, 
nsGUIEvent * 0x0012fa2c, nsEventStatus * 0x0012f938, int & 1) line 3253 + 23 
bytes
nsView::HandleEvent(nsView * const 0x0326df00, nsGUIEvent * 0x0012fa2c, unsigned 
int 8, nsEventStatus * 0x0012f938, int & 1) line 774
nsView::HandleEvent(nsView * const 0x025bb400, nsGUIEvent * 0x0012fa2c, unsigned 
int 28, nsEventStatus * 0x0012f938, int & 1) line 747
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x025bb5e0, nsGUIEvent * 
0x0012fa2c, nsEventStatus * 0x0012f938) line 1372
HandleEvent(nsGUIEvent * 0x0012fa2c) line 69
nsWindow::DispatchEvent(nsWindow * const 0x0326ddd4, nsGUIEvent * 0x0012fa2c, 
nsEventStatus & nsEventStatus_eIgnore) line 511 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fa2c) line 532
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3236 + 
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 
3443
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 10092635, long * 
0x0012fd90) line 2386 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00c80bd8, unsigned int 514, unsigned int 0, long 
10092635) line 740 + 27 bytes
USER32! 77e71820()

Comment 1

[leger]

Adding crash keyword.

Comment 2

[saari (gone)]

CC'ing hyatt and pinkerton

Comment 3

[Peter Trudelle]

Moving all bugs that are not dogfood+, nsbeta2+,features, or nsbeta2- to M21

Comment 4

[David Hyatt]

This is fundamental XUL functionality.  Needs to be fixed. Nominating for 
nsbeta3.

Comment 5

[saari (gone)]

Fix in hand, if someone ever decides to plus this bug.

Comment 6

[Peter Trudelle]

setting nsbeta3+

Comment 7

[Blake Ross]

Please check it in asap; this is blocking work on bug 41345.

Comment 8

[saari (gone)]

Fixed

Comment 9

[Blake Ross]

Thanks, Saari.  marking fixed