12226 - [BLOCKER] backspace in GFX text control crashes on event procesing in the PresShell

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect, P1)

Description

[rods (gone)]

To reproduce:

Start up apprunner
Click at end of url bar
remove all the text with the backspace key
type in www.weather.com, hit return
while it is loading, click in the urlbar and hit backspace.

PresShell::HandleEvent(PresShell * const 0x02ec7754, nsIView * 0x02ecac50,
nsGUIEvent * 0x0012fb94, nsEventStatus & nsEventStatus_eIgnore) line 1877 + 35
bytes
nsView::HandleEvent(nsView * const 0x02ecac50, nsGUIEvent * 0x0012fb94, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 835
nsView::HandleEvent(nsView * const 0x02ec98a0, nsGUIEvent * 0x0012fb94, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 820
nsView::HandleEvent(nsView * const 0x02ec9930, nsGUIEvent * 0x0012fb94, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 820
nsView::HandleEvent(nsView * const 0x02ec7b50, nsGUIEvent * 0x0012fb94, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 820
nsViewManager::DispatchEvent(nsViewManager * const 0x02ec7d70, nsGUIEvent *
0x0012fb94, nsEventStatus & nsEventStatus_eIgnore) line 1611
HandleEvent(nsGUIEvent * 0x0012fb94) line 67
nsWindow::DispatchEvent(nsWindow * const 0x02ec9764, nsGUIEvent * 0x0012fb94,
nsEventStatus & nsEventStatus_eIgnore) line 498 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fb94) line 523
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 8)
line 1973 + 15 bytes
nsWindow::OnChar(unsigned int 8, unsigned int 8, unsigned char 1) line 2270
nsWindow::ProcessMessage(unsigned int 258, unsigned int 8, long 917505, long *
0x0012fdd4) line 2413 + 52 bytes
nsWindow::WindowProc(HWND__ * 0x00170368, unsigned int 258, unsigned int 8, long
917505) line 571 + 27 bytes

Comment 1

[buster]

I see a related crash in GFX text controls doing the following:  control-A to
select all, then del to delete.  Here's the stack:
PresShell::HandleEvent() line 1877 + 35 bytes
nsView::HandleEvent() line 835
nsView::HandleEvent() line 820
nsView::HandleEvent() line 820
nsView::HandleEvent() line 820
nsViewManager::DispatchEvent() line 1611
HandleEvent() line 67
nsWindow::DispatchEvent() line 498 + 10 bytes
nsWindow::DispatchWindowEvent() line 523
nsWindow::DispatchKeyEvent() line 1973 + 15 bytes
nsWindow::OnChar() line 2270
nsWindow::ProcessMessage() line 2439 + 22 bytes
nsWindow::WindowProc() line 571 + 27 bytes
USER32! 77e71250()

mCurrentEventFrame is garbage.  I wonder...in the handling of events above the
line where it crashes, mCurrentEventFrame is set, then events are dispatched,
and then mCurrentEventFrame is used again. Is it possible that
mCurrentEventFrame is getting destroyed as a result of the event handling?
Should mCurrentEventFrame be a weak link, so there is notification of such
destruction?

Comment 2

[buster]

this is a blocker for turning on gfx text controls (bug 6262).  If this bug is
not fixed, the stability of apprunner will go way down when gfx text controls
are turned on.
Setting milestone, severity, and priority.

Comment 3

[joki (gone)]

Ok, fix checked in.

Comment 4

[joki (gone)]

*** Bug 12210 has been marked as a duplicate of this bug. ***