Crash [@ nsEventStateManager::GetNextTabbableContent] when tabbing with fixed positioning, mathml, xbl, ::first-line and generated content

RESOLVED FIXED

Status

()

Core
Event Handling
--
critical
RESOLVED FIXED
11 years ago
11 years ago

People

(Reporter: Martijn Wargers (dead), Unassigned)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
x86
Windows XP
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

1.21 KB, application/xhtml+xml
Details
(Reporter)

Description

11 years ago
Created attachment 258968 [details]
testcase

See testcase, when pressing the tab key once (or a couple of times), I crash with current trunk builds.
This regressed between 2006-10-08 and 2006-10-09:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-10-08+04&maxdate=2006-10-09+12&cvsroot=%2Fcvsroot
I think a regression from bug 322625.

Btw, the testcase looks a lot like the one from bug 374193.

Talkback ID: TB30366919W
0x00000000
nsEventStateManager::GetNextTabbableContent  [mozilla/content/events/src/nseventstatemanager.cpp, line 3575]
nsEventStateManager::ShiftFocusInternal  [mozilla/content/events/src/nseventstatemanager.cpp, line 3315]
nsEventStateManager::ShiftFocus  [mozilla/content/events/src/nseventstatemanager.cpp, line 3193]
nsEventStateManager::PostHandleEvent  [mozilla/content/events/src/nseventstatemanager.cpp, line 2237]
0x0282d008
0x8b57f685

The testcase does not crash on branch.
(Reporter)

Comment 1

11 years ago
I guess this could be fixed by a fix for bug 374193.
Severity: normal → critical
Depends on: 374193

Comment 2

11 years ago
Windows only? Can't reproduce in Linux.
(Reporter)

Comment 3

11 years ago
Created attachment 260030 [details]
testcase

Sorry, the attached testcase also doesn't crash for me, I guess I did something wrong here.
This testcase should crash just fine when tabbing a couple of times.
Attachment #258968 - Attachment is obsolete: true
(Reporter)

Comment 4

11 years ago
Boris'patch in bug 374193 fixes this crash.
(Reporter)

Comment 5

11 years ago
Bug 374193 is fixed, this testcase doesn't crash anymore, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070411 Minefield/3.0a4pre
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
Would be great to get this test into a testsuite
Flags: in-testsuite?
Crash Signature: [@ nsEventStateManager::GetNextTabbableContent]
You need to log in before you can comment on or make changes to this bug.