Closed Bug 121279 Opened 23 years ago Closed 23 years ago

TestGtkEmbed crash on javascript window.close()

Categories

(Core Graveyard :: Embedding: GTK Widget, defect)

x86
Linux
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: yaneti, Assigned: blizzard)

References

()

Details

(Keywords: crash, Whiteboard: [driver:blizzard] has patch)

Attachments

(1 file, 1 obsolete file)

from galeon bug http://bugzilla.gnome.org/show_bug.cgi?id=68029
going to the above url , clicking the "example One" link and then pressing the
close button the the popup  crashes TestGtkEmbed but not mozilla

the stacktrace (probably useles):

destroy_brsr_cb
(this called many times)


Program received signal SIGSEGV, Segmentation fault.
0x406d6b01 in ?? ()
(gdb) bt
#0  0x406d6b01 in ?? ()
#1  0x406d5ed3 in ?? ()
#2  0x406d612c in ?? ()
#3  0x406b4f1b in ?? ()
#4  0x40d86be4 in nsJSContext::CallEventHandler (this=0x8216388,
    aTarget=0x82bb1b0, aHandler=0x82bb2e0, argc=1, argv=0xbfe0269c,    
    aBoolResult=0xbfe02678, aReverseReturnResult=0) at nsJSEnvironment.cpp:1010
#5  0x40ddf13e in nsJSEventListener::HandleEvent (this=0x82e55e0,
    aEvent=0x83111c0) at nsJSEventListener.cpp:180
#6  0x40ff3221 in nsEventListenerManager::HandleEventSubType (this=0x82e5010, 
    aListenerStruct=0x82e5640, aDOMEvent=0x83111c0, aCurrentTarget=0x82161f0,
    aSubType=2, aPhaseFlags=2) at nsEventListenerManager.cpp:1205  
#7  0x40ff5862 in nsEventListenerManager::HandleEvent (this=0x82e5010, 
    aPresContext=0x82cd4b0, aEvent=0xbfe03684, aDOMEvent=0xbfe032ec,
    aCurrentTarget=0x82161f0, aFlags=2, aEventStatus=0xbfe035ac)
    at nsEventListenerManager.cpp:1722
#8  0x40d8fb09 in GlobalWindowImpl::HandleDOMEvent (this=0x82161e0,
    aPresContext=0x82cd4b0, aEvent=0xbfe03684, aDOMEvent=0xbfe032ec, aFlags=2,
    aEventStatus=0xbfe035ac) at nsGlobalWindow.cpp:638

.....

tested with moz cvs from today

this is most likely a duplicate of the numerous others js close bugs but i
couldnt find a similar one
Severity: normal → critical
Keywords: crash
Blocks: 115520
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
*** Bug 114563 has been marked as a duplicate of this bug. ***
Attached patch patch (obsolete) — Splinter Review
This patch adds a destroyed flag to the embedding widget so that if the window
is destroyed it doesn't send out any DOM events during destruction.  The
problem is that as part of destruction, gtk automatically sends out a focus_out
event and we try to send that back to the layout engine.  Since the
window.close() call in this example is attached to the blur handler in JS the
focus out event causes the window.close() call to happen again.
Whiteboard: has patch
Comment on attachment 66301 [details] [diff] [review]
patch

sr=jst
Attachment #66301 - Flags: superreview+
Whiteboard: has patch → [driver:blizzard] has patch
+  // mark the owner as destroyed so it won't emit events anymore.
+  mOwner->mIsDestroyed;

That should be mOwner->mIsDestroyed = PR_TRUE;

I've got that fixed in my local tree.  It's nothing more than emacs gone wrong.
Attachment #66301 - Attachment is obsolete: true
Comment on attachment 66911 [details] [diff] [review]
final patch after shaver's comments

r=shaver, and cheekily moving the sr= forward from the last patch!

I'm so naughty!
Attachment #66911 - Flags: superreview+
Attachment #66911 - Flags: review+
Comment on attachment 66911 [details] [diff] [review]
final patch after shaver's comments

I'm a triple-threat, or something.

a=shaver on behalf of drivers for 0.9.8.
Attachment #66911 - Flags: approval+
Checked in on the 0.9.8 branch.
Keywords: mozilla0.9.8+
Checked into the trunk.
Fixed.
Status: ASSIGNED → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: