391960 - Crash when double click on info button of canceled download in the new DM[@ nsMenuPopupFrame::SetPopupPosition]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Emil Ivanov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6

When download is canceled and the popup info from the blue icon is showed, if the blue icon is double clicked at this time the browser crashes.

Tested on 2007081205 Minefield/3.0a8pre

Reproducible: Always

Steps to Reproduce:
1.Open the new DM
2.Start to download a file and cancel it
3.Click on the blue information icon to show up the popup information
4.Double click on the blue information icon

Comment 1

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a8pre) Gecko/2007081203 Minefield/3.0a8pre ID:2007081203

I just reproduced this.

Comment 2

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007081212 Minefield/3.0a8pre ID:2007081212

I can't reproduce with this build.
doubleclick causes downloading to restart

Comment 3

[Peter van der Woude [:Peter6]]

(In reply to comment #2)
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007081212
> Minefield/3.0a8pre ID:2007081212
> 
> I can't reproduce with this build.
> doubleclick causes downloading to restart
> 
Forget that, crash here too

Comment 4

[Steve England [:stevee]]

maybe relevant: bug 279539

Comment 5

[Neil Deakin]

Is this the crash in SetPopupPosition that appears in the top bugs list?

Comment 6

[Shawn Wilsher :sdwilsh]

This code just landed yesterday, so I'd think not.  Might be a way to cause it though.

Comment 7

[Neil Deakin]

The stacktrace in the url looks the same and nsMenuPopupFrame hasn't changed recently, so it looks like the same crash.
 

Comment 8

[Neil Deakin]

Attachment: null-check document

What I think is happening here is that the richlistitem the context menu is anchored to is being removed. This is because the richlistbox has this hacky mechanism to open the context menu manually, and supplies the item as an custom anchor.

The fix is to null-check the document to anchor is in, which, of course, should be fixed anyway. Here, if the document is null, we just anchor to the root frame instead.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 276541 [details] [diff] [review]
null-check document

Makes sense.