12711 - [CRASHER]gfx select crashes after 'onclick' event

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[phillip]

Overview Description:
	gfx select crashes after 'onclick' event and a few mouse clicks.

Steps to Reproduce:
	1) launch apprunner.
	2) make sure GFX widgets are turned on via
		user_pref("nglayout.widget.mode", 2);
	3) load the attatchment to come
	4) single click (and immediately let go of the button)
		on the select/dropdown box
	5) single click on either option (the select disappears)
	6) single click again in the same spot.

Actual Results:

	SIGSEGV on linux and nt, no crash on mac. (but the gfx select
	disappears across platforms)

Expected Results:

	The select should not disappear, and no crash should occur.

Occurs on Apprunner on these Build Dates & Platforms:
     1999-08-27-05-M10 RedHat Linux 6.0 (GNOME/enlightenment)
     1999-08-27-09-M10 WinNT 4.0 sp5
     1999-08-27-12-M10 MacOS 8.51

Stacktrace:
	to come (it seems cyclone is down, no talkback id today)

Comment 1

[phillip]

Attachment: stack trace

Comment 2

[phillip]

Attachment: the testcase

Comment 3

[Peter Trudelle]

not an xptoolkit widget, reassigning to kmcclusk

Comment 4

[Kevin McCluskey (gone)]

Rod, reassigning to you

Comment 5

[rods (gone)]

this happens with the input select because the text selection is getting invoked
when you select an item in the list (a little confusing).

I can duplicate this by selecting some text and then pressing a button,
sometimes I have to do it more than once. reasssigning to mike.

Comment 6

[rods (gone)]

Attachment: New test case that shows it crashing with a button and text

Comment 7

[buster]

ir Rod is right, then when 12520 is fixed, this should just go away

Comment 8

[mjudge]

umm joki event again. the frames are destroyed and messages arive. here is a
mini stack trace i have:

nsGenericElement::GetParent(nsIContent * & 0x00000000) line 723 + 24 bytes
nsHTMLSelectElement::GetParent(const nsHTMLSelectElement * const 0x02be5510,
nsIContent * & 0x00000000) line 163 + 18 bytes
nsCSSFrameConstructor::FindPrimaryFrameFor(nsCSSFrameConstructor * const
0x02bc54d0, nsIPresContext * 0x02dfd910, nsIFrameManager * 0x02bc5a70,
nsIContent * 0x02be5510, nsIFrame * * 0x02bc55fc) line 7620
StyleSetImpl::FindPrimaryFrameFor(StyleSetImpl * const 0x02bc5440,
nsIPresContext * 0x02dfd910, nsIFrameManager * 0x02bc5a70, nsIContent *
0x02be5510, nsIFrame * * 0x02bc55fc) line 966
FrameManager::GetPrimaryFrameFor(FrameManager * const 0x02bc5a70, nsIContent *
0x02be5510, nsIFrame * * 0x02bc55fc) line 238 + 47 bytes
PresShell::GetPrimaryFrameFor(const PresShell * const 0x02bc55a0, nsIContent *
0x02be5510, nsIFrame * * 0x02bc55fc) line 1804 + 32 bytes
PresShell::HandleEvent(PresShell * const 0x02bc55a4, nsIView * 0x02bd56a0,
nsGUIEvent * 0x0012fbf8, nsEventStatus & nsEventStatus_eIgnore) line 1979

Comment 9

[joki (gone)]

Adding waterson to cc.

Chris, Vidur said you were going to look into nulling out parent refs when the
content tree goes away.  This seems like a case where we're hitting a bad parent
ref on content.  Is this anywhere near the stuff you were looking at?  Or is
Vidur just nuts.

Comment 10

[Paul MacQuiddy]

giving me rest of phillips open qa contact bugs, sorry for spam

Comment 11

[joki (gone)]

I believe waterson fixed the bad parent pointer thing a while back.  I'm going
to mark this fixed unless someone proves me wrong.

Comment 12

[Paul MacQuiddy]

verified

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0ca44fbcae2d
[components] For https://github.com/mozilla-mobile/android-components/issues/12711 - Use a separate reader for autocomplete suggestions