61179 - Deleting menuitem causes crash

Status: RESOLVED FIXED

(SeaMonkey :: UI Design, defect, P3)

Description

[Stephen P. Morse]

1. Load up the following content.
2. Click on the menu and select the "b" entry.
   This will cause the "b" entry to be deleted.
3. Click on menu again.
4. Move the mouse.

Program crashes with stack trace shown below.  mContent is 0 at the time of the 
crash.


<?xml version="1.0"?> 
<?xml-stylesheet href="chrome://communicator/skin/" type="text/css"?>
<?xul-overlay href="chrome://global/content/dialogOverlay.xul"?>
<?xul-overlay href="chrome://communicator/content/communicatorOverlay.xul"?>
<!DOCTYPE window SYSTEM "chrome://communicator/locale/pref/pref-navigator.dtd" >

<window debug="false" xmlns:html="http://www.w3.org/1999/xhtml"
    xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

  <script language="JavaScript">
  function Remove(thisMenuItem) {
    var thisMenuPopup = thisMenuItem.parentNode;
    thisMenuPopup.removeChild(thisMenuItem);
  }
  </script>

  <box autostretch="never">
          <menulist oncommand="Remove(this.selectedItem)">
            <menupopup>
              <menuitem value="a" len="0"/>
              <menuitem value="b" len="0"/>
              <menuitem value="c" len="0"/>
            </menupopup>
          </menulist>
  </box>
</window>



nsMenuFrame::SelectMenu(nsMenuFrame * const 0x00de5974, int 0) line 462 + 23 
bytes
nsMenuPopupFrame::SetCurrentMenuItem(nsMenuPopupFrame * const 0x00de5558, 
nsIMenuFrame * 0x00de561c) line 887
nsMenuFrame::OpenMenuInternal(int 1) line 660
nsMenuFrame::AttributeChanged(nsMenuFrame * const 0x00de4fd0, nsIPresContext * 
0x043e46c0, nsIContent * 0x043f73b0, int 0, nsIAtom * 0x01623ad0, int 2) line 
564
nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const 
0x0366eec0, nsIPresContext * 0x043e46c0, nsIContent * 0x043f73b0, int 0, nsIAtom 
* 0x01623ad0, int 2) line 10184 + 35 bytes
StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x0366eb00, nsIPresContext * 
0x043e46c0, nsIContent * 0x043f73b0, int 0, nsIAtom * 0x01623ad0, int -1) line 
1212
PresShell::AttributeChanged(PresShell * const 0x036720b8, nsIDocument * 
0x03acf740, nsIContent * 0x043f73b0, int 0, nsIAtom * 0x01623ad0, int -1) line 
4255 + 57 bytes
nsXULDocument::AttributeChanged(nsXULDocument * const 0x03acf740, nsIContent * 
0x043f73b0, int 0, nsIAtom * 0x01623ad0, int -1) line 1644
nsXULElement::SetAttribute(nsXULElement * const 0x043f73b0, nsINodeInfo * 
0x04465630, const basic_nsAReadableString<unsigned short> & {...}, int 1) line 
2778
nsXULElement::SetAttribute(nsXULElement * const 0x043f73b4, const 
basic_nsAReadableString<unsigned short> & {...}, const 
basic_nsAReadableString<unsigned short> & {...}) line 1252 + 31 bytes
nsMenuFrame::OpenMenu(nsMenuFrame * const 0x00de504c, int 1) line 586 + 55 bytes
nsMenuFrame::ToggleMenuState(nsMenuFrame * const 0x00de4fd0) line 450
nsMenuFrame::HandleEvent(nsMenuFrame * const 0x00de4fd0, nsIPresContext * 
0x043e46c0, nsGUIEvent * 0x0012f8c4, nsEventStatus * 0x0012f7b4) line 332
PresShell::HandleEventInternal(nsEvent * 0x0012f8c4, nsIView * 0x0366ef80, 
unsigned int 1, nsEventStatus * 0x0012f7b4) line 4891 + 38 bytes
PresShell::HandleEvent(PresShell * const 0x036720b4, nsIView * 0x0366ef80, 
nsGUIEvent * 0x0012f8c4, nsEventStatus * 0x0012f7b4, int 1, int & 1) line 4811 + 
25 bytes
nsView::HandleEvent(nsView * const 0x0366ef80, nsGUIEvent * 0x0012f8c4, unsigned 
int 28, nsEventStatus * 0x0012f7b4, int 1, int & 1) line 379
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x0368e8d0, nsGUIEvent * 
0x0012f8c4, nsEventStatus * 0x0012f7b4) line 1439
HandleEvent(nsGUIEvent * 0x0012f8c4) line 68
nsWindow::DispatchEvent(nsWindow * const 0x0366e184, nsGUIEvent * 0x0012f8c4, 
nsEventStatus & nsEventStatus_eIgnore) line 686 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f8c4) line 707
nsWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 3938 + 
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 
4148
nsWindow::ProcessMessage(unsigned int 513, unsigned int 1, long 19988513, long * 
0x0012fc44) line 2969 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00ec044a, unsigned int 513, unsigned int 1, long 
19988513) line 962 + 27 bytes
USER32! 77e71268()
nsXULDocument::ApplyPersistentAttributes() line 4658 + 30 bytes

Comment 1

[Stephen P. Morse]

The crash can be eliminated by doing a check for a null pointer.  Attaching a 
patch to accomplish that.  However there may be a more fundamental problem here 
that is causing the pointer to become null in the first place.

Comment 2

[Stephen P. Morse]

Attachment: patch to fix the null-pointer dereferencing

Comment 3

[David Hyatt]

Weird.  I never thought anyone would do this, so I didn't check for it.

a=hyatt

Comment 4

[Sean Su]

r=ssu

Comment 5

[Stephen P. Morse]

Fix checked in.