1386418 - Removing an element in a callback for said element crashes the tab

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[dogescript]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Build ID: 20170727114534

Steps to reproduce:

Create an `<input type="text">` element
Register an event handler for the `select` event
In the event handler, remove the input element from the DOM

JSFiddle Example: https://jsfiddle.net/13kpvogc/2/


Actual results:

The tab crashes


Expected results:

The input element gets removed, nothing else happens

Comment 1

[dogescript]

Oops forgot to add to the reproduction steps that the tab crashes when you highlight text entered in the input box

Comment 2

[Andrew Overholt [:overholt]]

Based on crashing frame, moving to Layout.

Comment 3

[Andrew McCreight [:mccr8]]

This crashed for me, too. It looks like a null deref.

Comment 4

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Sample crash report (from me, with today's nightly): bp-575b9079-014e-4b13-9145-616d00171023

Comment 5

[Daniel Holbert [:dholbert] (vacation until Jun 23)]

Attachment: testcase 1

Here's a standalone testcase, based on the jsfiddle.

Comment 6

[Sean Feng [:sefeng]]

This is still crashing for me as of today's nightly :)

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1386418 - Fix two issues in nsIFrame::HandleRelease. r=dholbert

The frame selection changes can run script, so we need to check for the
frame itself getting destroyed. This fixes the crash as reported.

Additionally, the document check it does for pointer capture is
incorrect, it should use the composed, not uncomposed doc, so that it
works in shadow dom.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e140c6cd2eb9
Fix two issues in nsIFrame::HandleRelease. r=dholbert

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/25019 for changes under testing/web-platform/tests

Comment 10

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/e140c6cd2eb9

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot