Closed Bug 730694 Opened 12 years ago Closed 12 years ago

Crash when combobox dropdown persists across page load

Categories

(Core :: DOM: UI Events & Focus Handling, defect)

13 Branch
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla15
Tracking Status
firefox13 + verified
firefox14 + verified

People

(Reporter: test_test_testing, Assigned: enndeakin)

References

()

Details

(4 keywords, Whiteboard: [qa+])

Crash Data

Attachments

(1 file)

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120226 Firefox/13.0a1
Build ID: 20120226031015

Steps to reproduce:

Go to fanfic reviews page (http://www.fanfiction.net/r/5782108/17/1/)
In the top-right corner there is a drop-down box thing to select the chapter.
Click to make the drop-down list appear, and choose some random chapter.
The page will begin loading that page. before the page has loaded, click to drop-down again.
The drop-down list will persist across the page-load, and Firefox will crash when you try to scroll the drop-down list.


Actual results:

Crash


Expected results:

No crash. The drop-down shouldn't have persisted across the page load.
Reproduced:
Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120226 Firefox/13.0a1

bp-8ef3fad8-751e-45ec-9f1d-8229f2120226
Severity: normal → critical
Crash Signature: [@ DragDataProducer::Produce ]
Keywords: crash
Status: UNCONFIRMED → NEW
Component: Untriaged → Event Handling
Ever confirmed: true
Keywords: reproducible
Product: Firefox → Core
QA Contact: untriaged → events
It's #39 top browser crasher in 13.0a2 and #32 in 14.0a1.
Crash Signature: [@ DragDataProducer::Produce ] → [@ DragDataProducer::Produce(nsDOMDataTransfer*, bool*, nsISelection**, nsIContent**)] [@ DragDataProducer::Produce ]
OS: Linux → All
Hardware: x86_64 → All
STR
> Go to fanfic reviews page (http://www.fanfiction.net/r/5782108/17/1/)
> In the top-right corner there is a drop-down box thing to select the chapter.
> Click to make the drop-down list appear, and choose some random chapter.
> The page will begin loading that page. before the page has loaded, click to drop-down again.
> The drop-down list will persist across the page-load, and Firefox will crash when you try to scroll the drop-down list.

Crash when you try to scroll the drop-down list by dragging of thumb.


Regression window(m-c),
Not crash:
http://hg.mozilla.org/mozilla-central/rev/a3b93f3949fe
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/20120217 Firefox/13.0a1 ID:20120217155649
Crash:
http://hg.mozilla.org/mozilla-central/rev/e001b5eda618
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217162149
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a3b93f3949fe&tochange=e001b5eda618

Regression window(m-i),
Not crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/174ce0df7cdd
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217061753
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/51d333edddfd
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217062249
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=174ce0df7cdd&tochange=51d333edddfd

Triggered by: Bug 499008
Blocks: 499008
Keywords: regression
Attached patch fixes crashSplinter Review
There's a bug somewhere on select elements not closing when the page changes that really is the main cause of the problem here. A drag event is firing at the window despite it having gone away.

This patch just adds a null check to prevent the crash but it doesn't really fix the problem.
Assignee: nobody → enndeakin
Attachment #608699 - Flags: review?(bugs)
Comment on attachment 608699 [details] [diff] [review]
fixes crash

if (expr) {
  stmt;
}
Attachment #608699 - Flags: review?(bugs) → review+
See Also: → 738781
It's #24 top browser crasher in 13.0a2 and #25 in 14.0a1.
Keywords: topcrash
(In reply to Neil Deakin from comment #5)
> Created attachment 608699 [details] [diff] [review]
> fixes crash
> 
> There's a bug somewhere on select elements not closing when the page changes
> that really is the main cause of the problem here. A drag event is firing at
> the window despite it having gone away.
> 
> This patch just adds a null check to prevent the crash but it doesn't really
> fix the problem.

Neil/Olli - can we land this fix on m-c now in preparation for uplift to FF13 (currently on beta)? This bug is a top crasher in our most recent releases.
https://hg.mozilla.org/mozilla-central/rev/722e163ecc1e
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
Adding qawanted - can someone verify this crash is fixed so we can go forward with beta/aurora uplift?
Keywords: qawanted
Appears to be fixed...

Firefox 15.0a1 Nightly 2012-05-13 crashes
Firefox 15.0a1 Nightly 2012-05-18 does not crash
No longer blocks: 499008
Keywords: qawanted
Sorry, not sure why the "blocker" field got cleared on my edit. Adding back bug 499008.

Marking this bug VERIFIED FIXED for Firefox 15 based on my testing in comment 11.
Blocks: 499008
Status: RESOLVED → VERIFIED
(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #12)
> Sorry, not sure why the "blocker" field got cleared on my edit. Adding back
> bug 499008.
It's a bug in Bugzilla or the Mozilla's server (appeared yesterday). Each time, a bug is changed the Blocks and Depends On fields are cleared.
Thanks Anthony for verifying the fix - please nominate for aurora/beta approval so we can get this into tomorrow's beta.
Comment on attachment 608699 [details] [diff] [review]
fixes crash

Applies to other branches too

[Approval Request Comment]
Bug caused by (feature/regressing bug #): NA
User impact if declined: Crash
Testing completed (on m-c, etc.): m-c since 2012-05-17
Risk to taking this patch (and alternatives if risky): simple null-check
String or UUID changes made by this patch: NA
Attachment #608699 - Flags: approval-mozilla-beta?
Attachment #608699 - Flags: approval-mozilla-aurora?
Comment on attachment 608699 [details] [diff] [review]
fixes crash

simple, low-risk fix (verified on trunk) - approved.
Attachment #608699 - Flags: approval-mozilla-beta?
Attachment #608699 - Flags: approval-mozilla-beta+
Attachment #608699 - Flags: approval-mozilla-aurora?
Attachment #608699 - Flags: approval-mozilla-aurora+
Whiteboard: [qa+]
No crashes reproducing the steps in comment 0. Verified fixed on FF 13b5:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20100101 Firefox/13.0
Status: VERIFIED → RESOLVED
Closed: 12 years ago12 years ago
I'm assuming the status change of VERIFIED -> RESOLVED was a mistake in comment 18.
Status: RESOLVED → VERIFIED
I set it on resolved because it wasn't yet verified on all tracking versions of FF. I was going to set it back when will be verified on FF 14 too.
(In reply to Paul Silaghi [QA] from comment #20)
> I set it on resolved because it wasn't yet verified on all tracking versions
> of FF.
The VERIFIED flag is not a global one as I also thought before but it's a trunk one like the FIXED flag.
Verified fixed on FF 14b6:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:14.0) Gecko/20100101 Firefox/14.0

I was able to see the crash on Nightly 2012-05-13.
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: