148948 - crash when using context menu of window closed via onBlur

Status: VERIFIED DUPLICATE of bug 132532

(Core :: JavaScript Engine, defect)

Description

[Andrey Kislyuk]

Browser crashes when using a Save Image As... context menu item when the page
loaded has "onBlur=window.close()" in its body tag.

To reproduce: In the above URL, click on a link to the viewpic script (any link
to a picture) and try to save the picture using the context menu. As soon as
focus leaves the pop-up window, the window closes and the browser crashes.

Reproduced on RC3/win32.

Comment 1

[Joel]

win98 2002053104 trunk

i couldnt get the browser to crash, but the popup window closed whenever i
changed focus to another window/program. when 'save image as..'ing, the whole
browser closed; but it didnt crash. wierd

Comment 2

[Andrey Kislyuk]

Yeah, the whole browser closes. Assertion, crash, something, the end effect is
loss of data.

Comment 3

[Ian Neal]

Using buildID 2002060108 on win2ksp2 and following the above process I get a
crash with talkback ID TB6981615Q

Comment 4

[Phil Schwartau]

This is all that Talkback recorded for Ian's crash above:

Incident ID 6981615 
Stack Trace

comdlg32.dll + 0x7e8d (0x76b37e8d) 
0xf70c758b 


It also said the screen configuration was 1280 x 1024, 32 bits per pixel.
I wonder if that's relevant or not -

Comment 5

[Phil Schwartau]

Confirming crash with recent Mozilla trunk binaries and debug build.
If you are running a debug build, you have to attach a debugger to
the Mozilla process before trying the steps to reproduce, because
Mozilla crashes instantaneously on this.

Here is a stack trace from a WinNT debug build, with VC++ attached
to the Mozilla process:

COMDLG32! 77d98371()
COMDLG32! 77d9a8c4()
COMDLG32! 77d9a1fe()
COMDLG32! 77d9d5e9()
USER32! 77e8306c()
USER32! 77e71962()
NTDLL! 77f763ef()
USER32! 77e82a35()
USER32! 77e8abf3()
USER32! 77e8b050()
USER32! 77e9b9b8()
COMDLG32! 77d9d875()
COMDLG32! 77d9d8fe()
COMDLG32! 77d88e8c()
COMDLG32! 77d81ed7()
XPTC_InvokeByIndex(nsISupports * 0x0379b258, unsigned int 16, unsigned int 1, 
nsXPTCVariant * 0x0012e4d4) line 106
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
CALL_METHOD) line 1994 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x022af8d8, JSObject * 0x0358fa28, unsigned int 0, 
long * 0x038a81e8, long * 0x0012e7b0) line 1266 + 14 bytes
js_Invoke(JSContext * 0x022af8d8, unsigned int 0, unsigned int 0) line 788 + 23 
bytes
js_Interpret(JSContext * 0x022af8d8, long * 0x0012f5f0) line 2743 + 15 bytes
js_Invoke(JSContext * 0x022af8d8, unsigned int 3, unsigned int 2) line 805 + 13 
bytes
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x0399f4a8, 
nsXPCWrappedJS * 0x037739c8, unsigned short 4, const nsXPTMethodInfo * 
0x02bdfd28, nsXPTCMiniVariant * 0x0012fb38) line 1193 + 22 bytes
nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x037739c8, unsigned short 4, 
const nsXPTMethodInfo * 0x02bdfd28, nsXPTCMiniVariant * 0x0012fb38) line 430
PrepareAndDispatch(nsXPTCStubBase * 0x037739c8, unsigned int 4, unsigned int * 
0x0012fbe8, unsigned int * 0x0012fbd8) line 115 + 31 bytes
SharedStub() line 139
nsURIChecker::SetStatusAndCallBack(nsIRequest * 0x039b1a10, unsigned int 0) line 
76
nsURIChecker::OnStartRequest(nsURIChecker * const 0x02d70c48, nsIRequest * 
0x039b1a10, nsISupports * 0x00000000) line 226
nsHttpChannel::OnStartRequest(nsHttpChannel * const 0x039b1a14, nsIRequest * 
0x0383a9ec, nsISupports * 0x00000000) line 2834 + 45 bytes
nsOnStartRequestEvent::HandleEvent() line 161 + 53 bytes
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x03529824) line 116
PL_HandleEvent(PLEvent * 0x03529824) line 596 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00bd2860) line 526 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0886068a, unsigned int 49496, unsigned int 0, 
long 12396640) line 1077 + 9 bytes
USER32! 77e7124c()
00bd2860()

Comment 6

[Phil Schwartau]

I have no idea what component is responsible here. Reassigning
to XPConnect for now. I don't think this is JS Engine's fault,
but please reassign back if I'm wrong.

The good thing is, this is very easy to reproduce, so
developers can diagnose what's going wrong here.

Here is the HTML for a typical pop-up window at the site:

<HTML><HEAD><TITLE>Picture</TITLE></HEAD>
<body etc. etc. onBlur="window.close()">
  <img src="/images/user_images/Tom_elevator.jpg">
</body></html>


I will attach such a reduced testcase below -

Comment 7

[Phil Schwartau]

Attachment: Reduced HTML testcase

Comment 8

[Kenton Hanson (gone)]

Is this a duplicate of bug#143946?

Comment 9

[Phil Schwartau]

cc'ing jst to see if he knows of any existing bug for Mozilla
crashing if there's a window.close() in <body> onblur() handler.

I seem to remember something like that, but I can't find it.
Is Event Handling a better component for this bug?

Comment 10

[Johnny Stenback (:jst)]

Hmm, I don't see a crash on Win2k here with my debug build...

Comment 11

[Phil Schwartau]

I also do not crash if I try a recent trunk build on Linux.
I only seem to crash with my WinNT builds -

Comment 12

[Adam Hauner]

Bug 68454 and bug 132532 are IMHO related. 
This bug should be duped against bug 132532, see its comment #7.

Comment 13

[Andrey Kislyuk]

Apparently this is a dupe of bug 132532. Sorry I missed it. Also, this seems
fixed on trunk and not in 1.0. Hopefully it will be out by 1.0.1.

*** This bug has been marked as a duplicate of 132532 ***

Comment 14

[Phil Schwartau]

Verified Duplicate -