It's poking at mCurrentMenu, which looks like it has been freed. No crash on 0.9.1, or the trunk. Attaching stack.
Pretty sure we want this for 1.0, not sure if it hold 1.0RC1.
I'm guessing this is a nsIFrame-in-nsCOMPtr issue. I fixed a few of these in my local tree, but there's at least two dozen nsIMenuFrame's that get stuck in nsCOMPtr's in one place or another. Most look innocent, but some don't.. i'll try to find the culprit. Also, biesinger has embarked on a remove-nsISupports-inheritance-from-nsIFrame project, which will also help.
Status: NEW → ASSIGNED
Severity: normal → critical
Summary: right-click, cut of BM inside folder inside PT crashes: nsMenuPopupFrame::SetCurrentMenuItem (aviary) → right-click, cut of BM inside folder inside PT crashes [@ nsMenuPopupFrame::SetCurrentMenuItem ] (aviary)
Created attachment 152886 [details] [diff] [review] context-menu-crash-0.patch Blah. The chain of events looked like this: - A destructive context menu option is selected (Cut, Delete) - The menu's command handler executes the command - The command modifies the bookmarks RDF data source, and removes some assertions from the parent RDF container (to remove the items) - The template builder (!@#$) notices this, and sees that it has to remove content - It removes the menu item entry from the menu that corresponds to the thing that was just removed - The command returns to the menu handler after execution, and the menu starts to tear down the visible menus - It goes boom while trying to unselect the active menu item, because that item got destroyed The patch makes sure that the menu frame's parent doesn't have it selected as the current item, if it's being destroyed.
Assignee: nobody → vladimir
Comment on attachment 152886 [details] [diff] [review] context-menu-crash-0.patch Looks good to me -- Ben?
15 years ago
Attachment #152886 - Flags: review?(bugs) → review+
In on aviary; does trunk want this as well?
Status: ASSIGNED → RESOLVED
Last Resolved: 15 years ago
Resolution: --- → FIXED
Yes, very. Maybe even for 1.8a2 -- asking. (If not, a3 for sure.)
14 years ago
Reopening this as it's not on trunk; need a menu person to take a look, though this has been in on aviary for a while now.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Neil, can you have a look at this for the trunk?
As far as I can tell the patch looks good for the trunk too.
Comment on attachment 152886 [details] [diff] [review] context-menu-crash-0.patch Who can land this? Time is short for 1.8a6. a=asa.
Attachment #152886 - Flags: approval1.8a6+
Fix checked in to the trunk.
Status: REOPENED → RESOLVED
Last Resolved: 15 years ago → 14 years ago
Resolution: --- → FIXED
Component: XP Toolkit/Widgets: Menus → XUL
QA Contact: xptoolkit.widgets
Crash Signature: [@ nsMenuPopupFrame::SetCurrentMenuItem ]
You need to log in before you can comment on or make changes to this bug.