374422 - Crash [@ nsEventStateManager::GetNextTabbableContent] when tabbing with fixed positioning, mathml, xbl, ::first-line and generated content

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, when pressing the tab key once (or a couple of times), I crash with current trunk builds.
This regressed between 2006-10-08 and 2006-10-09:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-10-08+04&maxdate=2006-10-09+12&cvsroot=%2Fcvsroot
I think a regression from bug 322625.

Btw, the testcase looks a lot like the one from bug 374193.

Talkback ID: TB30366919W
0x00000000
nsEventStateManager::GetNextTabbableContent  [mozilla/content/events/src/nseventstatemanager.cpp, line 3575]
nsEventStateManager::ShiftFocusInternal  [mozilla/content/events/src/nseventstatemanager.cpp, line 3315]
nsEventStateManager::ShiftFocus  [mozilla/content/events/src/nseventstatemanager.cpp, line 3193]
nsEventStateManager::PostHandleEvent  [mozilla/content/events/src/nseventstatemanager.cpp, line 2237]
0x0282d008
0x8b57f685

The testcase does not crash on branch.

Comment 1

[Martijn Wargers (dead)]

I guess this could be fixed by a fix for bug 374193.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Windows only? Can't reproduce in Linux.

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase

Sorry, the attached testcase also doesn't crash for me, I guess I did something wrong here.
This testcase should crash just fine when tabbing a couple of times.

Comment 4

[Martijn Wargers (dead)]

Boris'patch in bug 374193 fixes this crash.

Comment 5

[Martijn Wargers (dead)]

Bug 374193 is fixed, this testcase doesn't crash anymore, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070411 Minefield/3.0a4pre

Comment 6

[Boris Zbarsky [:bzbarsky]]

Would be great to get this test into a testsuite