Closed Bug 268384 Opened 20 years ago Closed 17 years ago

onblur="window.close()" crashes after right click on bookmark in BTF [@nsPopupSetFrame::ShowPopup]

Categories

(Core :: General, defect)

1.7 Branch
x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: bugzilla, Unassigned)

References

()

Details

(Keywords: crash)

Crash Data

User-Agent:       Opera/7.54 (Windows NT 5.1; U)  [en]
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

This combination causes a crash:
If you set the preference to prevent scripts from hiding your personal bar
A page opens a popup that contains onblur="window.close()" or onblur="self.
close()"
you right click on a bookmark on the personal bar of that popup

Reproducible: Always
Steps to Reproduce:
1. Popups must be set to open in their own window (default), not as a tab
2. Use about:config to set dom.disable_window_open_feature.personalbar to true
3. Ensure you have at least one bookmark on your personal (bookmarks) bar
4. Open a popup window with onblur="window.close()" or onblur="self.close()" in 
the body tag
5. on the popup window, right click on a bookmark on the personal bar
Actual Results:  
Firefox crashes

Expected Results:  
window should close (nasty UI effect, but that is what the page author demanded)
, or context menu for the bookmark should appear

default theme. tested on multiple computers, all XP

talkback ID is TB1800786M (c/o irc://irc.mozilla.org/developers /aebrahim)

Bug may be dup of https://bugzilla.mozilla.org/show_bug.cgi?id=264873 but 
trigger is different, and talkback sigs are different (c/o irc://irc.mozilla.
org/developers /IanN)
I see this in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5)
Gecko/20041107 Firefox/1.0 .

Confirming. It might be a dupe of bug 264873 as comment 0 says, but comment 0
also says that stacks are non-identical, so I'm marking this as NEW.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: talkbackid
Whiteboard: TalkbackID: TB1800786M
*** Bug 268385 has been marked as a duplicate of this bug. ***
Tweaking summary.

Also, to see this bug, you need to have popups set to open in a new window (the
default). If they open in the current window or tab, you won't see this. If you
open in a new tab, for some reason, the popup tab closes when following the
instructions, but no crash.
Summary: onblur="window.close()" causes crash when right clicking on personal bar bookmark → onblur="window.close()" crashes after right click on bookmark in BTF [@nsPopupSetFrame::ShowPopup]
According to talkback the crash is happening in:
mPresContext->PresShell()->GetPrimaryFrameFor(aPopupContent,
                                              &entry->mPopupFrame);

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp&mark=366&rev=AVIARY_1_0_20040515_BRANCH#366
Keywords: crash
Another variation on this is to have a close a tab that has onBlur="self.close()". 

No bookmarks showing, just having the popup window forced to open in a new tab -
then hitting Control-W.  I'm guessing the window is trying to close itself after
it is already closed...

I've tested this with 1.0 on XP.

Easy to test on model pics from:  http://www.amis-angels.com/amit.htm
Tested in Firefox 1.0 release and Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.8b) Gecko/20050118 Firefox/1.0+, I found another way to reproduce
crashing related to window.close() (but not onBlur)

1. A pop up is still required.
--
<script>
 window.open('test1.htm');
</script>
--

2. Before going into test1.htm, prepare a file test2.htm that contains a line:
--
window.close();
--

3. In test1.htm, use some way to create an instance of XMLHttpRequest,
grab the content from test2.htm, then use eval() to execute the content.
--
<HTML>
<SCRIPT>
function go()
{
  xmlhttp = new XMLHttpRequest();
  xmlhttp.open("GET", 'test2.htm', true);
  xmlhttp.onreadystatechange=function()
  {
    if (xmlhttp.readyState==4)
    {
       eval(xmlhttp.responseText);
    }
  }
  xmlhttp.send(null);
}
</SCRIPT>
<BODY>
 <input type="button" onClick="go()" value="go">
</BODY>
</HTML>
--

In this case, I expect the popup window automatically close when the "go" button
if pressed. However,
1. The popup window doesn't close when I press the "go" button. It only closes
after I click again to the other area of that window.
2. If I change the active window (using Alt+TAB in Windows) after pressing the
"go" button, then change back the active window to the popup, Mozilla crashes.

I decided to descibe the step to reproduce such problem more clearly, sorry 
for any inconvenience caused.

Also I would like to add that I only tested this on Windows platform.

[A] Unexpected behaviour
1. Click the "go" button
2. The popup should close itself, but it doesn't.
3. The "go" button should be focused. Click on some area in the popup, causing 
the "go" button not focused anymore
4. The popup now closes.

[B] Unexpected crashes
1. Click the "go" button
2. The popup should close itself, but it doesn't.
3. Now the active window is the popup. Do nothing to the popup, but change the 
active window to other window, by pressing Alt+TAB or clicking on the taskbar.
4. Change the active window back to the popup.
5. Mozilla Firefox crashes


(In reply to comment #6)
> Tested in Firefox 1.0 release and Mozilla/5.0 (Windows; U; Windows NT 5.1;
> en-US; rv:1.8b) Gecko/20050118 Firefox/1.0+, I found another way to reproduce
> crashing related to window.close() (but not onBlur)
> 1. A pop up is still required.
> --
> <script>
>  window.open('test1.htm');
> </script>
> --
> 2. Before going into test1.htm, prepare a file test2.htm that contains a 
line:
> --
> window.close();
> --
> 3. In test1.htm, use some way to create an instance of XMLHttpRequest,
> grab the content from test2.htm, then use eval() to execute the content.
> --
> <HTML>
> <SCRIPT>
> function go()
> {
>   xmlhttp = new XMLHttpRequest();
>   xmlhttp.open("GET", 'test2.htm', true);
>   xmlhttp.onreadystatechange=function()
>   {
>     if (xmlhttp.readyState==4)
>     {
>        eval(xmlhttp.responseText);
>     }
>   }
>   xmlhttp.send(null);
> }
> </SCRIPT>
> <BODY>
>  <input type="button" onClick="go()" value="go">
> </BODY>
> </HTML>
> --
> In this case, I expect the popup window automatically close when the "go" 
button
> if pressed. However,
> 1. The popup window doesn't close when I press the "go" button. It only 
closes
> after I click again to the other area of that window.
> 2. If I change the active window (using Alt+TAB in Windows) after pressing 
the
> "go" button, then change back the active window to the popup, Mozilla 
crashes.

Keywords: talkbackid
Whiteboard: TalkbackID: TB1800786M
Assignee: bugs → nobody
QA Contact: bugzilla → toolbars
(In reply to comment #7)
I am in the same boat as Tammy with the xmlhttprequests and a pop-up. This is
going to be a serious bug with the popularity of Ajax.  I am not sure if there
is any voting involved, but I give a big vote for this one.  It currently has me
blocked.
Guys, i'm having the same problem as tamcy2003 described .. page1.html calls page2.html in a window popup and in this page i work with XMLHttpRequest, after that the method "window.close()" or "self.close()" is called .. if I alt+tab the window it crashes Firefox (only) .. 

It was tested in Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4
WFM in Firefox 2, Windows. Can anybody reproduce this with a recent release?
Status: NEW → RESOLVED
Closed: 17 years ago
Component: Toolbars → General
Product: Firefox → Core
QA Contact: toolbars → general
Resolution: --- → WORKSFORME
Version: unspecified → 1.7 Branch
Crash Signature: [@nsPopupSetFrame::ShowPopup]
You need to log in before you can comment on or make changes to this bug.