Crashes [@ nsEventStateManager::ShiftFocusInternal]

VERIFIED FIXED

Status

()

Core
Event Handling
--
critical
VERIFIED FIXED
11 years ago
11 years ago

People

(Reporter: smaug, Assigned: smaug)

Tracking

({crash, testcase})

Trunk
x86
Windows XP
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

nsEventStateManager::ShiftFocusInternal  [mozilla/content/events/src/nsEventStateManager.cpp, line 3391]
nsEventStateManager::ShiftFocus  [mozilla/content/events/src/nsEventStateManager.cpp, line 3356]
nsEventStateManager::PostHandleEvent  [mozilla/content/events/src/nsEventStateManager.cpp, line 2329]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6497]
PresShell::HandleEvent  [mozilla/layout/base/nsPresShell.cpp, line 6261]
nsViewManager::HandleEvent  [mozilla/view/src/nsViewManager.cpp, line 2514]
nsViewManager::DispatchEvent  [mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [mozilla/view/src/nsView.cpp, line 174]
Created attachment 259418 [details]
testcase

This testcase crashes with current trunk build with this stack trace, it also crashes branch builds.

The iframe consists of this html code:
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
</head>
<body>
<area xmlns="http://www.w3.org/1999/xhtml" style="display: inline;">
<map tabindex="5" style="display: block;" onfocus="window.frameElement.parentNode.removeChild(window.frameElement)">
</map>
</area>
</body>
</html>

Updated

11 years ago
Keywords: crash, testcase
Version: 1.8 Branch → Trunk
Created attachment 259422 [details] [diff] [review]
proposed patch

like the fix for bug 337607
Attachment #259422 - Flags: superreview?(jst)
Attachment #259422 - Flags: review?(jst)

Updated

11 years ago
Attachment #259422 - Flags: superreview?(jst)
Attachment #259422 - Flags: superreview+
Attachment #259422 - Flags: review?(jst)
Attachment #259422 - Flags: review+
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a3pre) Gecko/20070324 Minefield/3.0a3pre
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsEventStateManager::ShiftFocusInternal]
You need to log in before you can comment on or make changes to this bug.