340045 - Loose close timer causes crash with content area context menu

Status: RESOLVED DUPLICATE of bug 246712

(Core :: XUL, defect)

Description

[Alex Sirota (iosart)]

I've spent a while hunting this down, and I found the cause for this crash.

Problem: Firefox content area context menu with child menupopups will cause a timing dependent occasional crash.

Reason:
1. Content area menupopup starts a close timer (mCloseTimer) meant to close child menupopups when the mouse moves to other menuitem. This is done so the child menupopup is hidden after a timeout and not immediately.
http://lxr.mozilla.org/mozilla1.8/source/layout/xul/base/src/nsMenuPopupFrame.cpp#1383

2. The default timeout for this timer on Windows is 400ms 

3. If the menupopup is destroyed before the timer fires, there will be a crash in: mCallback.i->Notify(this);
http://lxr.mozilla.org/mozilla1.8/source/xpcom/threads/nsTimerImpl.cpp#397

because the mCallback.i is nsMenuPopupFrame which is already distroyed.

4.  The problem is that the mCloseTimer for the top level context menu isn't cancelled before this menu popup is destroyed.

Reproducing:
1. Open http://www.quirksmode.org/ 
   We need a context menu with child menupopup to demonstrate this, quirksmode has frames, so we can use the 'This Frame' menupopup

2. Click on 'This Frame' to open its submenu

3. Move the mouse down to 'View Page Source', this will trigger the 'close' timer for closing the "This Frame" submenu.

4. While the submenu is open, quickly (within 400ms timeout period) click anywhere on the page (outside the context menu). This will destroy the menupopup chain.

5. Now the timer is fired and when it tries to callback to the now destroyed nsMenuPopupFrame, we have a crash

(*) this highly timing dependant, so you might have to repeat the above steps several times (it usually takes me 4-5 tries) to reproduce the crash.

I reproduce this on both Firefox 1.5.* and Bon Echo

Comment 1

[jpl24]

I'm pretty sure this is a dupe of 246712 which was fixed on the trunk but not branches.

Comment 2

[Adam Guthrie]

If he could get a stack we could tell. :) http://kb.mozillazine.org/Talkback

Comment 3

[Alex Sirota (iosart)]

Indeed, this no longer crashes with the trunk version.
I hope this gets merged into the branch in time for Firefox 2.0

*** This bug has been marked as a duplicate of 246712 ***