378961 - Crash [@ nsSplitterFrameInner::RemoveListener] when dragging splitter and DOMAttrModified event removing window

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, when dragging the splitter in the iframe, Mozilla crashes.

Talkback ID: TB31576269E
nsSplitterFrameInner::RemoveListener  [mozilla/layout/xul/base/src/nssplitterframe.cpp, line 634]
nsSplitterFrameInner::MouseMove  [mozilla/layout/xul/base/src/nssplitterframe.cpp, line 884]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nseventlistenermanager.cpp, line 1203]
nsEventTargetChainItem::HandleEvent  [mozilla/content/events/src/nseventdispatcher.cpp, line 209]
nsEventTargetChainItem::HandleEventTargetChain  [mozilla/content/events/src/nseventdispatcher.cpp, line 267]
nsEventDispatcher::Dispatch  [mozilla/content/events/src/nseventdispatcher.cpp, line 484]
PresShell::HandleEventInternal  [mozilla/layout/base/nspresshell.cpp, line 5779]
PresShell::HandlePositionedEvent  [mozilla/layout/base/nspresshell.cpp, line 5670]
PresShell::HandleEvent  [mozilla/layout/base/nspresshell.cpp, line 5513]
nsViewManager::HandleEvent  [mozilla/view/src/nsviewmanager.cpp, line 1457]
nsViewManager::DispatchEvent  [mozilla/view/src/nsviewmanager.cpp, line 1410]
HandleEvent  [mozilla/view/src/nsview.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nswindow.cpp, line 1107]
nsWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nswindow.cpp, line 6288]

The testcase is crashing branch builds directly, I'll file a new on that, the stacktrace looks different. Because of crashing on branch, I'm filing this as security sensitive.

The source of the iframe in the testcase:
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" orient="horizontal">
<textbox/><splitter/><box/>

<script xmlns="http://www.w3.org/1999/xhtml">
function doe() {
window.frameElement.parentNode.removeChild(window.frameElement);
}
document.addEventListener('DOMAttrModified', doe, true);
</script>
</window>

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase

Ugh, finally the correct testcase, I hope.

Comment 3

[Martijn Wargers (dead)]

(In reply to comment #0)
> The testcase is crashing branch builds directly, I'll file a new on that, 

I filed bug 378963 for it.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Have to test this in the branch too, trunk is FIXED.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for branch

If bug 378963 gets fixed, this patch might be needed.

Comment 7

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070524 Minefield/3.0a5pre

Comment 8

[Mats Palmgren (inactive)]

Landed a crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b5e597a7d229

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/b5e597a7d229