336662 - menu-button with context="_child" crashes on shutdown [@ nsFrameManager::CaptureFrameStateFor]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Pam Greene]

Using a XUL layout with an element of the form 

<toolbarbutton type="menu-button" context="_child">

will produce extraneous menus in some cases, and will crash the browser on shutdown in every case.

Steps to Reproduce:

(A) To crash the browser:
1. Load enclosed test case contextmenu-test.xul in Firefox
2. Context-click on the small button to the left of the arrow to display the two-item context menu
3. Click elsewhere to hide the menu
4. Quit the app
Result: App crashes on shutdown.  See enclosed call trace.

(B) To see extraneous menus:
Unfortunately, I have not been able to produce a reduced test case for this situation.  It can be generated using the 1.8 FF branch.
1. In mozilla/browser/components/search/content/search.xml, just above the location of the XXX in the "searchbar" binding, insert |context="_child"| into the toolbarbutton element
2. Build and launch the app
3. Right-click on the magnifying glass at the right end of the searchbar, showing its context menu, then click elsewhere to hide it again
4. Hover over another section of the searchbox text field
Result: The same context menu appears as you hover, overlaid on the "Search ___" tooltip that should correctly show there

Build (nightly):
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8) Gecko/20060504 BonEcho/2.0a1

Note: The (B) case described here will not be observable until the patch for bug 335441 has been checked in.

Comment 1

[Pam Greene]

Attachment: Reduced test case

Comment 2

[Pam Greene]

Attachment: Stack trace (OS X crash log)

Comment 3

[Martijn Wargers (dead)]

Seems related to bug 288763.

Comment 4

[Asaf Romano (gone)]

*** Bug 345659 has been marked as a duplicate of this bug. ***

Comment 5

[Adam Guthrie]

*** Bug 345936 has been marked as a duplicate of this bug. ***

Comment 6

[Martijn Wargers (dead)]

So the testcase doesn't crash anymore on current trunk builds, because the context menu won't open anymore. I think that should work, not?
I think this regressed with the fix for bug 288763.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

No it should not open since menus as context menus are prevented because of those crashes. I'd like to get that fixed so that we wouldn't have this limitation, 
but until someone (I? ;) ) come up with some solution, better to make sure that
there are no crashes.

Comment 8

[Neil Deakin]

Should now be fixed with bug 279703.