35257 - crash setting selectedIndex for SELECT not in DOM tree

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Myk Melez [:myk] [@mykmelez]]

Overview Description:

Mozilla crashes when JavaScript code creates a SELECT menu, populates it with
two OPTIONs, then attempts to set the SELECT's selectedIndex property to a legal
value before the SELECT menu has been added to the DOM tree.

Steps to Reproduce: load test case and click button
Actual Results: crash
Expected Results: SELECT menu appears in document with correct OPTION selected
Build Date & Platform Bug Found: Linux 2000-04-06-10
Additional Builds and Platforms Tested On: Linux 2000-04-06-10 also crashes
Additional Information: Could be related to bug 9136.

Comment 1

[Myk Melez [:myk] [@mykmelez]]

Attachment: test case

Comment 2

[David Krause]

This also crashed on MacOS build 2000040908

Mozilla/5.0 (Macintosh; N; PPC; en-US; m14)

Changing to all platforms

Comment 3

[leger]

Adding crash keyword.

Comment 4

[Jan Carpenter]

nominating for nsbeta2

Comment 5

[Johnny Stenback (:jst)]

The obvious crasher here is fixed, some issues still remain though, I was able
to crash my debug mozilla on my WinNT system but not my optimized mozilla on
linux.

Rods, on my WinNT system I sometimes got *two* selects by clicking on the button
once (as you probably remember there was a bug on that some time back), and when
I clicked on either one of the selects mozilla crashed in nsListControlFrame,
one of the crashes I saw was a null pointer reference in
nsListControlFrame::GetOptionFromContent(), the first NS_ADDREF in that
function, I tried making that a NS_IF_ADDREF() but then I crashed somewhere
else...

Over to you Rods...

Comment 6

[rods (gone)]

This maybe behaving better now that my fix for comboboxes is turned. I can't 
reproduce it, so I will close it out. fixed

Comment 7

[Myk Melez [:myk] [@mykmelez]]

Works for me too in Linux 2000-05-27-20.  Verifying fixed.