212988 - Crash if a focus change by Tab key hides the next item in the tab order [@ PresShell::HandleEventInternal ]

Status: RESOLVED DUPLICATE of bug 212338

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Thierry]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030516 Mozilla Firebird/0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030516 Mozilla Firebird/0.6

Let there be two input form elements: X and Y.
- Y is the element after X in the tab order.
- If X loses focus, it hides Y (e.g. onblur="Y.style.display='none';").
Switching from X to Y using the tab key crashes Mozilla / Firebird.

Reproducible: Always

Steps to Reproduce:
1. Open the attached file in Mozilla or Firebird (also hosted on
<http://webplaza.pt.lu/steinber/bugtest.htm>)
2. Focus the Select control by clicking on it.
3. Press <TAB> to switch to the text input control.
Actual Results:  
Mozilla crashes.

Expected Results:  
Mozilla should have either focussed on the next visible item in the tab order or
focus no item at all.


Mozilla Crash Information:

AppName: mozill~1.exe	 AppVer: 1.4.20030.51616	 ModName: mozill~1.exe
ModVer: 1.4.20030.51616	 Offset: 001a0b19

Comment 1

[Thierry]

Attachment: Test case for reproducing the bug.

Comment 2

[Bill Mason]

Very similar: bug 212338.
->Event Handling
Talkback ID TB21977895Y

Comment 3

[Olivier Cahagne]

crashing 20030717 debug build on Linux:

0x4108996d in PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned, 
nsEventStatus*) (this=0x8a54bc8, aEvent=0xbfffee80, aView=0x86da938, aFlags=1,
    aStatus=0xbfffebec) at nsPresShell.cpp:6204
6204            rv = mCurrentEventFrame->GetContentForEvent(mPresContext, 
aEvent,
(gdb) bt
#0  0x4108996d in PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned, 
nsEventStatus*) (this=0x8a54bc8, aEvent=0xbfffee80, aView=0x86da938, aFlags=1,
    aStatus=0xbfffebec) at nsPresShell.cpp:6204
#1  0x410893cd in PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*,
int, int&) (this=0x8a54bc8, aView=0x86da938, aEvent=0xbfffee80,
    aEventStatus=0xbfffebec, aForceHandle=1, aHandled=@0xbfffebe8)
    at nsPresShell.cpp:6100
#2  0x414fdb1c in nsViewManager::HandleEvent(nsView*, nsGUIEvent*, int) (
    this=0x8a6e1d8, aView=0x86da938, aEvent=0xbfffee80, aCaptured=0)
    at nsViewManager.cpp:2251
#3  0x414f2f70 in nsView::HandleEvent(nsViewManager*, nsGUIEvent*, int) (
    this=0x86da938, aVM=0x8a6e1d8, aEvent=0xbfffee80, aCaptured=0)
    at nsView.cpp:305
#4  0x414fd350 in nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) (
    this=0x8a6e1d8, aEvent=0xbfffee80, aStatus=0xbfffed20)
    at nsViewManager.cpp:2036

Please reopen if I'm wrong.


*** This bug has been marked as a duplicate of 212338 ***