288827 - browser crash if a select element is removed onchange

Status: RESOLVED DUPLICATE of bug 231830

(Firefox :: General, defect)

Description

[Klaus Reimer]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050325 Firefox/1.0.2 (Debian package 1.0.2-1)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050325 Firefox/1.0.2 (Debian package 1.0.2-1)

Firefox crashes with a segfault if the onchange event (which removes the select
element) is fired when changing the option with the keyboard and leaving the
select element with the  tab key.

Reproducible: Always

Steps to Reproduce:
1. Select the form element with the mouse
2. Choose an other option with the keyboard (cursor keys)
3. Press Tab to leave the element. This will fire the onchange event which will
call a javascript function which deletes the form element. Segfault.


Actual Results:  
Segfault.

Expected Results:  
Form element should simply be removed. This works if its done by mouse clicks
instead of keyboard navigation.

Comment 1

[Giles Robertson]

TB4804882G

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050330
Firefox/1.0+

dupeme 231830, by way of 285419 (285419 isn't duplicated atm, but if Boris
Zbarsky thinks it's a dupe of 231830, who am I to disagree (more importantly,
231830 isn't just limited to use of the alert() function)

Comment 2

[Klaus Reimer]

*** This bug has been marked as a duplicate of 231830 ***