100270 - evaluating "window.close();" in the javascript console crashes mozilla

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Johnny Stenback (:jst)]

The subject says it all, patch coming up.

Comment 1

[Johnny Stenback (:jst)]

Attachment: Proposed fix.

Comment 2

[Johnny Stenback (:jst)]

The problem is that the CSS frame constructor is deleted while it's on the
stack, and the pres shell tries to reference its view manager after it has been
destroyed, the bandage fix is trivial. dbaron, waterson, hyatt, r/sr=?

Comment 3

[Chris Waterson]

What method are you modifying in nsCSSFrameConstructor.cpp? AttributeChanged()?

Comment 4

[Johnny Stenback (:jst)]

Yes, AttributeChanged(). From within attribute changed we end up tearing down
iframes n' who knows what that causes a bunch of pres shells to be destroyed and
also at least this one CSSFrameConstructor. The deathgrip keeps it alive and I
did verify that the refcount of the CSSFrameConstructor is 1 when we unroll from
the place where we used to crash and when the kungFuDeathGrip goes out of scope
the frame constructor is deleted.

Comment 5

[Chris Waterson]

Comment on attachment 49742 [details] [diff] [review]
Proposed fix.

r=waterson

Comment 6

[David Hyatt]

sr=hyatt

Comment 7

[Johnny Stenback (:jst)]

Fix checked in.