18796 - crash changing focus off select

Status: VERIFIED WORKSFORME

(Core :: Layout: Form Controls, defect, P3)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

DESCRIPTION:  I crash on the bugzilla query page after clicking on the page
after control-clicking on an option.

STEPS TO REPRODUCE:
 * load http://bugzilla.mozilla.org/query.cgi
 - you should see the first three items in "Status" selected (NEW, ...)
 * control-click on the fourth item in tha select (RESOLVED)
 * click out in the blank area of the page to the right

ACTUAL RESULTS:
 * crash

EXPECTED RESULTS:
 * no crash; able to scroll down using arrows

DOES NOT WORK CORRECTLY ON:
 * Linux, mozilla, 1999-11-13-08-M12
 * Linux, mozilla, my debug build from 1999-11-13, 05:00 PDT (with some of my
own modifications and using the SUPERWIN branch)

ADDITIONAL INFORMATION:

Top of stack trace (from above debug build):

#0  0x4105c97d in nsEventStateManager::ChangeFocus (this=0x8330ad8,
    aFocusContent=0x85c1560, aFocusFrame=0x0, aSetFocus=0)
    at nsEventStateManager.cpp:1254
#1  0x4105e42f in nsEventStateManager::SendFocusBlur (this=0x8330ad8,
    aPresContext=0x85b6c98, aContent=0x0) at nsEventStateManager.cpp:1752
#2  0x4105dc01 in nsEventStateManager::SetContentState (this=0x8330ad8,
    aContent=0x0, aState=2) at nsEventStateManager.cpp:1624
#3  0x4105a9b6 in nsEventStateManager::PostHandleEvent (this=0x8330ad8,
    aPresContext=@0x85b6c98, aEvent=0xbffff5a0, aTargetFrame=0x83fc9a8,
    aStatus=@0xbffff498, aView=0x83fc4f0) at nsEventStateManager.cpp:610
#4  0x410a7aed in PresShell::HandleEvent (this=0x84bcb18, aView=0x83fc4f0,
    aEvent=0xbffff5a0, aEventStatus=@0xbffff498) at nsPresShell.cpp:2436
#5  0x41489e19 in nsView::HandleEvent (this=0x83fc4f0, event=0xbffff5a0,
    aEventFlags=8, aStatus=@0xbffff498, aHandled=@0xbffff43c) at nsView.cpp:837
#6  0x41489dad in nsView::HandleEvent (this=0x83e1920, event=0xbffff5a0,
    aEventFlags=8, aStatus=@0xbffff498, aHandled=@0xbffff43c) at nsView.cpp:821
#7  0x41489dad in nsView::HandleEvent (this=0x83e1868, event=0xbffff5a0,
    aEventFlags=8, aStatus=@0xbffff498, aHandled=@0xbffff43c) at nsView.cpp:821
#8  0x41489dad in nsView::HandleEvent (this=0x86193f0, event=0xbffff5a0,
    aEventFlags=28, aStatus=@0xbffff498, aHandled=@0xbffff43c)
    at nsView.cpp:821
#9  0x41495b33 in nsViewManager::DispatchEvent (this=0x85da170,
    aEvent=0xbffff5a0, aStatus=@0xbffff498) at nsViewManager.cpp:1741
#10 0x41487f34 in HandleEvent (aEvent=0xbffff5a0) at nsView.cpp:66

Comment 1

[karnaze (gone)]

Reassigning to Rod.

Comment 2

[rods (gone)]

I  am not seeing this bug with today's build on NT. I will test it tomorrow on
Linux.

Comment 3

[old account]

I reproduced this on Linux and Win98 (current builds) using a slightly different
method:

1. Click an item in the select list (doesn't matter which one)
2. Click outside the select list
3. Click an item in the select list again (doesn't matter which one)
4. Click outside the select list again

This causes the crash for me, with the same stack trace as originally reported.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I think this is the same as bug 18876.

I also saw the same stack trace (twice, in about 100 tries) after selecting text
and clicking elsewhere, but that was very hard to replicate.

Comment 5

[rods (gone)]

I have tested this out on viewer.exe and mozilla.exe on NT and it works fine
with today's build. This may have been caused by saari's check in which has been
fixed. marking - works for me

Comment 6

[Eli Goldberg]

Unable to reproduce on 1999111808 builds on Win32/Mac OS/Linux using dbaron's and
bryner's steps to reproduce, as well as various ad hoc banging. Thus, verifying
as WORKSFORME.

Please re-open if I've missed a trigger. Thanks!