Closed
Bug 1386418
Opened 7 years ago
Closed 4 years ago
Removing an element in a callback for said element crashes the tab
Categories
(Core :: Layout, defect, P3)
Tracking
()
RESOLVED
FIXED
81 Branch
People
(Reporter: dogescript, Assigned: emilio)
References
(Regression)
Details
(Keywords: crash, regression)
Crash Data
Attachments
(2 files)
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0 Build ID: 20170727114534 Steps to reproduce: Create an `<input type="text">` element Register an event handler for the `select` event In the event handler, remove the input element from the DOM JSFiddle Example: https://jsfiddle.net/13kpvogc/2/ Actual results: The tab crashes Expected results: The input element gets removed, nothing else happens
Reporter | ||
Comment 1•7 years ago
|
||
Oops forgot to add to the reproduction steps that the tab crashes when you highlight text entered in the input box
Updated•7 years ago
|
Updated•7 years ago
|
Crash Signature: [@ nsLayoutUtils::GetNearestScrollableFrame ]
Comment 3•7 years ago
|
||
This crashed for me, too. It looks like a null deref.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Updated•7 years ago
|
Priority: -- → P3
Comment 4•7 years ago
|
||
Sample crash report (from me, with today's nightly): bp-575b9079-014e-4b13-9145-616d00171023
Assignee | ||
Updated•4 years ago
|
Flags: needinfo?(emilio)
Assignee | ||
Updated•4 years ago
|
Assignee | ||
Comment 7•4 years ago
|
||
The frame selection changes can run script, so we need to check for the
frame itself getting destroyed. This fixes the crash as reported.
Additionally, the document check it does for pointer capture is
incorrect, it should use the composed, not uncomposed doc, so that it
works in shadow dom.
Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/e140c6cd2eb9 Fix two issues in nsIFrame::HandleRelease. r=dholbert
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/25019 for changes under testing/web-platform/tests
Comment 10•4 years ago
|
||
bugherder |
Status: NEW → RESOLVED
Closed: 4 years ago
status-firefox81:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch
Upstream PR merged by moz-wptsync-bot
Updated•4 years ago
|
status-firefox79:
--- → wontfix
status-firefox80:
--- → wontfix
status-firefox-esr68:
--- → wontfix
status-firefox-esr78:
--- → wontfix
Flags: in-testsuite+
Updated•3 years ago
|
Keywords: regression
Updated•3 years ago
|
Has Regression Range: --- → yes
You need to log in
before you can comment on or make changes to this bug.
Description
•