292706 - Firefox crashed when typeing a letter in dropdownbox, using javascript action

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Morten Vejhe]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

If a dropdownbox (with a javascript action) is selected and the user presses a
letter on the keyboard, firefox will crash if the javascript action contains
something like this:
document.getElementById('ID').style.display = 'none';
I havn't investigated it further, than to the onchange-action.

Reproducible: Always

Steps to Reproduce:
1. Go to http://cyrack.dk/crash-and-burn.html
2. Click on the dropdown-menu
3. Press a letter on the keyboard, eg. B
4. Click anywhere on the screen

Actual Results:  
Firefox crashed

Expected Results:  
Hidden the dropdown menu

The bug has been observed on these builds:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414
Firefox/1.0.3
Mozilla/5.0 (Windows; U; Windows NT 5.1; da-DK; rv:1.7.6) Gecko/20050321
Firefox/1.0.2
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041105 Firefox/1.0RC2
Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.7) Gecko/20050420 Firefox/1.0.3
Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050405 Firefox/1.0
(Ubuntu package 1.0.2)

Output at crash:
/opt/firefox/run-mozilla.sh: line 451: 21659 Lagersegmentfejl        "$prog"
${1+"$@"}
(translated to english)
/opt/firefox/run-mozilla.sh: line 451: 21659 Segmentionfault        "$prog"
${1+"$@"}

Nothing further was outputted.

Comment 1

[Morten Vejhe]

Attachment: The html-file from bug-report

This is the same HTML file as mentioned in the bug-report, just to insure
everybody got access to it.

Comment 2

[Steve England [:stevee]]

Crashes for me with -- Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7)
Gecko/20050414 Firefox/1.0.3
Works for me with -- Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2)
Gecko/20050502 Firefox/1.0+

Reporter, can you please try with a nightly trunk (1.1beta) build of firefox and
report back as to whether you still see the crash? Thanks!
- http://ftp.uni-erlangen.de/pub/mozilla.org/firefox/nightly/latest-trunk/

Comment 3

[Morten Vejhe]

Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8b2) Gecko/20050501
Firefox/1.0+ doesn't crash.
Should the bug stay open?

Comment 4

[Steve England [:stevee]]

Resolved WORKSFORME as per comment 2 and comment 3. Thanks for the quick
feedback Morten!