371981 - Crash [@ nsCOMPtr_base::assign_assuming_AddRef] when focusing isindex, reloading and then tabbing a lot of times

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, to reproduce the crash:
- Focus the <isindex>
- Reload the document
- Tab a lot of times

Talkback ID: TB29753049Q
0x6c83ffff
nsCOMPtr_base::assign_assuming_AddRef  [mozilla/xpcom/glue/nscomptr.h, line 532]

This regressed between 2007-02-18 and 2007-02-19, regression from bug 257868.

Comment 1

[Martijn Wargers (dead)]

Hmm, can't reproduce it anymore with today's trunk build.

Comment 2

[Nickolay_Ponomarev]

FWIW, I was able to reproduce with an old build, but hasn't been able to track it down, mainly due to unfamiliarity with widget code and its interaction with layout. The <isindex> is not necessary to reproduce, 
<div></div>
<div>
 <div></div>
</div>
(all of them scrollable) is enough. Don't have the testcase handy. I think one of the widgets for scrollable divs was released prematurely (i.e. it was still referred to by its previous sibling), but it was late night, so I might be wrong.

Comment 3

[Martijn Wargers (dead)]

I suspect this was basically something similar as bug 371993.
I'm just marking it worksforme now.
Thanks for looking into it.