16867 - crash closing app via XPMenu using keystrokes

Status: VERIFIED DUPLICATE of bug 10511

(Core :: XUL, defect, P3)

Description

[Chris Waterson]

To reproduce:

1. start apprunner on Win32
2. press "Alt+F" to open the file menu
3. press the down arrow to keyboard-navigate to the "Quit" menu item
4. press "Enter" to select it.

Result: crash in nsEventListenerManager::HandleEvent() double-freeing
mKeyListener. Stack below

nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012fbc8, nsIDOMEvent * * 0x0012f8f8, unsigned int 4, nsEventStatus &
nsEventStatus_eIgnore) line 814 + 9 bytes
XULDocumentImpl::HandleDOMEvent(XULDocumentImpl * const 0x01cb3e30,
nsIPresContext & {...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x0012f8f8,
unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2211
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01d47ca0, nsIPresContext &
{...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x0012f8f8, unsigned int 4,
nsEventStatus & nsEventStatus_eIgnore) line 2746 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f08d90, nsIPresContext &
{...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x0012f8f8, unsigned int 4,
nsEventStatus & nsEventStatus_eIgnore) line 2744
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f0a2c0, nsIPresContext &
{...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x0012f8f8, unsigned int 4,
nsEventStatus & nsEventStatus_eIgnore) line 2744
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f0bce0, nsIPresContext &
{...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x0012f8f8, unsigned int 4,
nsEventStatus & nsEventStatus_eIgnore) line 2744
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f0b6c0, nsIPresContext &
{...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x0012f8f8, unsigned int 4,
nsEventStatus & nsEventStatus_eIgnore) line 2744
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x0230f054,
nsIPresContext & {...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x0012f8f8,
unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2891
nsDocument::HandleDOMEvent(nsDocument * const 0x02313530, nsIPresContext &
{...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x0012f8f8, unsigned int 1,
nsEventStatus & nsEventStatus_eIgnore) line 2379
nsHTMLHtmlElement::HandleDOMEvent(nsHTMLHtmlElement * const 0x023131ac,
nsIPresContext & {...}, nsEvent * 0x0012fbc8, nsIDOMEvent * * 0x00000000,
unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 188 + 41 bytes
PresShell::HandleEvent(PresShell * const 0x02392554, nsIView * 0x023a51c0,
nsGUIEvent * 0x0012fbc8, nsEventStatus & nsEventStatus_eIgnore) line 2164 + 39
bytes
nsView::HandleEvent(nsView * const 0x023a51c0, nsGUIEvent * 0x0012fbc8,
unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834
nsView::HandleEvent(nsView * const 0x023a4210, nsGUIEvent * 0x0012fbc8,
unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x023a42a0, nsGUIEvent * 0x0012fbc8,
unsigned int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x02392930, nsGUIEvent * 0x0012fbc8,
unsigned int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsViewManager::DispatchEvent(nsViewManager * const 0x02392e30, nsGUIEvent *
0x0012fbc8, nsEventStatus & nsEventStatus_eIgnore) line 1739
HandleEvent(nsGUIEvent * 0x0012fbc8) line 63
nsWindow::DispatchEvent(nsWindow * const 0x023927f4, nsGUIEvent * 0x0012fbc8,
nsEventStatus & nsEventStatus_eIgnore) line 401 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbc8) line 422
nsWindow::DispatchKeyEvent(unsigned int 133, unsigned short 0, unsigned int 13)
line 2049 + 15 bytes
nsWindow::OnKeyDown(unsigned int 13, unsigned int 28) line 2249 + 25 bytes
nsWindow::ProcessMessage(unsigned int 256, unsigned int 13, long 1835009, long
* 0x0012fdf4) line 2598 + 40 bytes
nsWindow::WindowProc(HWND__ * 0x006405f2, unsigned int 256, unsigned int 13,
long 1835009) line 579 + 27 bytes
USER32! 77e71268()

Comment 1

[Peter Trudelle]

reassigning to saari as p3 for m12

Comment 2

[Peter Trudelle]

reproduced in 10/21 opt bits on win98

Comment 3

[Kathleen :Brade]

This bug sounds very similar to bug 10511 assigned to joki (at the moment).  I
would consider it a duplicate.

Comment 4

[Claudius Gayle]

resolving as dupe of bug 10511


*** This bug has been marked as a duplicate of 10511 ***

Comment 5

[Claudius Gayle]

VERIFIED dupe