Closed Bug 394825 Opened 13 years ago Closed 13 years ago

Crash [@ nsGenericHTMLElement::SetElementFocus] with kbd focus, onbeforecopy removing window

Categories

(Core :: DOM: UI Events & Focus Handling, defect)

x86
All
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: smaug)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(2 files)

Attached file testcase
See testcase, which crashes current trunk builds on load.
Since the testcase uses onbeforecopy, I think this is a regression from bug 280959.

The iframe content consists of this:
<html><head></head>
<body>
<kbd id="mw_a" onbeforecopy="window.frameElement.parentNode.removeChild(window.frameElement)">
</kbd>
<script>
var y=document.getElementById('mw_a');
y.setAttribute('tabindex','1');
y.focus();
</script>
</body>
</html>

http://crash-stats.mozilla.com/report/index/3d5e2f94-5a90-11dc-b9ae-001a4bd46e84
0  	@0x0  	
1 	nsGenericHTMLElement::SetElementFocus(int) 	mozilla/content/html/content/src/nsGenericHTMLElement.cpp:3085
2 	nsHTMLInputElement::Focus() 	mozilla/content/html/content/src/nsHTMLAnchorElement.cpp:227
3 	nsGenericHTMLElementTearoff::Focus() 	mozilla/content/html/content/src/nsGenericHTMLElement.cpp:202
4 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
5 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2285
6 	XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1467
7 	js_Invoke 	mozilla/js/src/jsinterp.c:1378
8 	js_Interpret 	mozilla/js/src/jsinterp.c:4111
9 	js_Execute 	mozilla/js/src/jsinterp.c:1645
OS: Windows XP → All
Assignee: nobody → Olli.Pettay
Status: NEW → ASSIGNED
Attachment #279584 - Flags: superreview?(jst)
Attachment #279584 - Flags: review?(jst)
Attachment #279584 - Flags: approval1.9?
Attachment #279584 - Flags: superreview?(jst)
Attachment #279584 - Flags: superreview+
Attachment #279584 - Flags: review?(jst)
Attachment #279584 - Flags: review+
Attachment #279584 - Flags: approval1.9?
Attachment #279584 - Flags: approval1.9+
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007090504 Minefield/3.0a8pre
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsGenericHTMLElement::SetElementFocus]
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.