18127 - crash removing broadcast listener from content model

Status: RESOLVED WORKSFORME

(Core :: XUL, defect, P2)

Description

[Chris Waterson]

Because broadcast listener nodes are only held by weak reference from the
broadcaster, we will -crash- if:

1. a listener is removed from the content model.
2. all refs are dropped to the listener
3. an attribute changes on the broadcaster

Need to fix nsXULDocument::RemoveSubtreeFromDocument() to deal with this.

Comment 1

[Paul MacQuiddy]

spam: changing qa contact from ckritzer -> paulmac for xul bugs

Comment 2

[Chris Waterson]

Not critical because no script does this...yet.

Comment 3

[Chris Waterson]

Attachment: test case

Comment 4

[Chris Waterson]

attached test case. to reproduce:

1. click on the "test case" link in the bug.
2. open another window (to force the JS GC to run)
3. in the original window, click on the "poke button one" button

Unfortunately, right now, this is not causing a crash because we leak the
buttons :-/. Once I fix the leak, we should see a crash.

Comment 5

[Chris Waterson]

Moving the Gordian Knot of 18127, 23905, and 20677 to M14. Fixing this has just
introduced way too many instabilities in my tree that it'll take a couple of
days to sort out. I'll shoot to get these in when M14 opens.

Comment 6

[Chris Waterson]

feh

Comment 7

[leger]

BULK MOVE: Changing component from XUL to XP Toolkit/Widgets: XUL.  XUL 
component will be deleted.

Comment 8

[leger]

Adding "crash" keyword to all known open crasher bugs.

Comment 9

[Chris Waterson]

This is a design flaw, not visible in current practive. Reducing priority to 
reflect this.

Comment 10

[Paul MacQuiddy]

*IGNORE* - massive spam changing open XPToolkit bug's QA contact to
[e-mail]

Comment 11

[leger]

Putting on [nsbeta2-] radar. Not critical to beta2.

Comment 12

[Chris Waterson]

you've gotta do some crazy stuff to make this happen. future projects.

Comment 13

[Andreas Franke (gone)]

Marking [obscure] to separate it from `known' crashers.

Comment 14

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 15

[Adam Hauner]

BTW testcase isn't working (any button isn't visible) with 2003090204/trunk/W2K.

Comment 16

[Kevin Berkheiser]

The testcase link starts download manager.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316

Comment 17

[Ronald Tilby]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050905
Firefox/1.6a1
Testcase WFM - No crash.

Comment 18

[skierpage]

If I save the testcase, open a new window, and load it with File > Open File..., I see nothing (no buttons) and there's no crash.  So the XUL needs re-work for Firefox 3.  The Error Console shows

  Error: removeButtonTwo is not defined
  Source File: file:///C:/Documents%20and%20Settings/S%20Page/Desktop/Downloads/18127.xul
  Line: 1

I'm on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007081905 Minefield/3.0a8pre ID:2007081905

Comment 19

[arno renevier]

Attachment: testcase rewrotten

testcase used obselete tags for gecko 1.9
Here is an updated version

Comment 20

[Mike]

>testcase rewrotten
WFM on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/20080818033342 Minefield/3.1a2pre

Comment 21

[Nochum Sossonko [:Natch]]

->WORKSFORME