Last Comment Bug 378325 - Crash [@ PresShell::FlushPendingNotifications] when removing window on focus and then reappearing again
: Crash [@ PresShell::FlushPendingNotifications] when removing window on focus ...
Status: VERIFIED FIXED
[sg:critical?] deleted frame and pres...
: crash, testcase, verified1.8.0.12, verified1.8.1.4
Product: Core
Classification: Components
Component: Event Handling (show other bugs)
: Trunk
: x86 Windows XP
: -- critical (vote)
: ---
Assigned To: Olli Pettay [:smaug]
: Hixie (not reading bugmail)
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2007-04-21 17:02 PDT by Martijn Wargers [:mwargers] (not working for Mozilla)
Modified: 2009-04-24 10:50 PDT (History)
4 users (show)
dveditz: blocking1.8.1.4+
dveditz: blocking1.8.0.12+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (1.07 KB, text/html)
2007-04-21 17:02 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
for trunk (2.24 KB, patch)
2007-04-22 03:49 PDT, Olli Pettay [:smaug]
roc: review+
roc: superreview+
Details | Diff | Splinter Review
for branches (1.22 KB, patch)
2007-04-22 03:59 PDT, Olli Pettay [:smaug]
roc: review+
roc: superreview+
dveditz: approval1.8.1.4+
dveditz: approval1.8.0.12+
Details | Diff | Splinter Review

Description Martijn Wargers [:mwargers] (not working for Mozilla) 2007-04-21 17:02:01 PDT
Created attachment 262377 [details]
testcase

See testcase, which crashes Mozilla within 500ms after load for me.

Talkback ID: TB31415506E
PresShell::FlushPendingNotifications  [mozilla/layout/base/nspresshell.cpp, line 4627]
nsGfxScrollFrameInner::AsyncScrollPortEvent::Run  [mozilla/layout/generic/nsgfxscrollframe.cpp, line 1893]
NS_ProcessNextEvent_P  [mozilla/xpcom/build/nsthreadutils.cpp, line 227]
nsBaseAppShell::Run  [mozilla/widget/src/xpwidgets/nsbaseappshell.cpp, line 154]
MSVCR80.dll + 0x8ac9 (0x78138ac9)

On current branch builds I get this talkback ID: TB31415588Y
0x00000000
nsGenericElement::SetFocus  [mozilla/content/base/src/nsGenericElement.cpp, line 2623]
nsGenericHTMLElement::SetElementFocus  [mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 3631]
nsHTMLTextAreaElement::Focus  [mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp, line 236]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2156]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1451]
etc.

That stacktrace was fixed on trunk with the patch from bug 372665. After that fix, the trunk builds have begun to crash with the first mentioned stacktrace.

Marking security sensitive for now, because the testcase also crashes on branch.
Comment 1 Martijn Wargers [:mwargers] (not working for Mozilla) 2007-04-21 17:02:52 PDT
The iframe with the data url consists of this:
<html><body tabindex="1" onfocus="top.doe2();window.frameElement.parentNode.removeChild(window.frameElement);">
<script>
setTimeout(function(){document.body.focus()}, 200);
</script></body></html>
Comment 2 Olli Pettay [:smaug] 2007-04-22 03:49:40 PDT
Created attachment 262413 [details] [diff] [review]
for trunk
Comment 3 Olli Pettay [:smaug] 2007-04-22 03:59:38 PDT
Created attachment 262414 [details] [diff] [review]
for branches

This is sort of surprising that having a strong ref is enough on branches.
Comment 4 Daniel Veditz [:dveditz] 2007-04-23 10:42:55 PDT
Comment on attachment 262414 [details] [diff] [review]
for branches

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers
Comment 5 Martijn Wargers [:mwargers] (not working for Mozilla) 2007-04-27 10:18:32 PDT
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070427 Minefield/3.0a4pre

I see a painting issue, though. The iframe doesn't get unpainted, after I pressed the stop button, to make the recursive loads go away.
When I change this:
 function doe2() {
 setInterval(doe, 200); 
 }
to:
 function doe2() {
 setTimeout(doe, 200); 
 }
that problem goes away.

I guess I should file a new bug about this one day.
Comment 6 Marcia Knous [:marcia - use ni] 2007-05-08 15:13:17 PDT
verified fixed on the 1.8 branch using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.4pre) Gecko/2007050804 BonEcho/2.0.0.4pre. No crash with the original testcase. Adding branch verified keyword.
Comment 7 Marcia Knous [:marcia - use ni] 2007-05-08 16:37:38 PDT
verified fixed on the 1.8.0 branch using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.12pre) Gecko/20070508 Firefox/1.5.0.12pre. No crash with the
original testcase. Adding branch verified keyword.
Comment 8 Bob Clary [:bc:] 2009-04-24 10:50:41 PDT
crash test landed
http://hg.mozilla.org/mozilla-central/rev/7356f9a0fd10

Note You need to log in before you can comment on or make changes to this bug.