If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

right-click, cut of BM inside folder inside PT crashes [@ nsMenuPopupFrame::SetCurrentMenuItem ] (aviary)

RESOLVED FIXED

Status

()

Core
XUL
--
critical
RESOLVED FIXED
14 years ago
4 years ago

People

(Reporter: shaver, Assigned: vlad)

Tracking

({crash, fixed-aviary1.0})

Other Branch
x86
Linux
crash, fixed-aviary1.0
Points:
---
Bug Flags:
blocking-aviary1.0 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

It's poking at mCurrentMenu, which looks like it has been freed.  No crash on
0.9.1, or the trunk.

Attaching stack.
Created attachment 152558 [details]
stack trace (Linux, today's build, clean)
Pretty sure we want this for 1.0, not sure if it hold 1.0RC1.
Flags: blocking-aviary1.0RC1?
Flags: blocking-aviary1.0+
I'm guessing this is a nsIFrame-in-nsCOMPtr issue.  I fixed a few of these in my
local tree, but there's at least two dozen nsIMenuFrame's that get stuck in
nsCOMPtr's in one place or another.  Most look innocent, but some don't.. i'll
try to find the culprit.  Also, biesinger has embarked on a
remove-nsISupports-inheritance-from-nsIFrame project, which will also help.
Status: NEW → ASSIGNED

Updated

14 years ago
Severity: normal → critical
Keywords: crash
Summary: right-click, cut of BM inside folder inside PT crashes: nsMenuPopupFrame::SetCurrentMenuItem (aviary) → right-click, cut of BM inside folder inside PT crashes [@ nsMenuPopupFrame::SetCurrentMenuItem ] (aviary)
Created attachment 152886 [details] [diff] [review]
context-menu-crash-0.patch

Blah.  The chain of events looked like this:

- A destructive context menu option is selected (Cut, Delete)
- The menu's command handler executes the command
- The command modifies the bookmarks RDF data source, and removes some
assertions from the parent RDF container (to remove the items)
- The template builder (!@#$) notices this, and sees that it has to remove
content
- It removes the menu item entry from the menu that corresponds to the thing
that was just removed
- The command returns to the menu handler after execution, and the menu starts
to tear down the visible menus
- It goes boom while trying to unselect the active menu item, because that item
got destroyed

The patch makes sure that the menu frame's parent doesn't have it selected as
the current item, if it's being destroyed.
Assignee: nobody → vladimir
Comment on attachment 152886 [details] [diff] [review]
context-menu-crash-0.patch

Looks good to me -- Ben?
Attachment #152886 - Flags: superreview+
Attachment #152886 - Flags: review?(bugs)
Attachment #152886 - Flags: review?(bugs) → review+
In on aviary; does trunk want this as well?
Status: ASSIGNED → RESOLVED
Last Resolved: 14 years ago
Resolution: --- → FIXED
Yes, very.  Maybe even for 1.8a2 -- asking.  (If not, a3 for sure.)
Flags: blocking1.8a2?

Updated

13 years ago
Flags: blocking-aviary1.0PR?

Updated

13 years ago
Keywords: fixed-aviary1.0
Flags: blocking1.8a2?
Reopening this as it's not on trunk; need a menu person to take a look, though
this has been in on aviary for a while now.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---

Comment 9

13 years ago
nominating
Flags: blocking1.8a6?

Comment 10

13 years ago
Neil, can you have a look at this for the trunk?

Comment 11

13 years ago
As far as I can tell the patch looks good for the trunk too.

Comment 12

13 years ago
Comment on attachment 152886 [details] [diff] [review]
context-menu-crash-0.patch

Who can land this? Time is short for 1.8a6.  a=asa.
Attachment #152886 - Flags: approval1.8a6+

Comment 13

13 years ago
Fix checked in to the trunk.
Status: REOPENED → RESOLVED
Last Resolved: 14 years ago13 years ago
Resolution: --- → FIXED

Updated

13 years ago
Flags: blocking1.8a6?

Updated

9 years ago
Component: XP Toolkit/Widgets: Menus → XUL
QA Contact: xptoolkit.widgets
Crash Signature: [@ nsMenuPopupFrame::SetCurrentMenuItem ]
You need to log in before you can comment on or make changes to this bug.