Closed Bug 394825 Opened 17 years ago Closed 17 years ago

Crash [@ nsGenericHTMLElement::SetElementFocus] with kbd focus, onbeforecopy removing window

Categories

(Core :: DOM: UI Events & Focus Handling, defect)

Product:
Core
Component:
DOM: UI Events & Focus Handling
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: smaug)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(2 files)

testcase
589 bytes, text/html
Details
Caller should make sure that objects stay alive
1.32 KB, patch
jst
: review+
jst
: superreview+
jst
: approval1.9+
Details | Diff | Splinter Review
Attached file testcase — 
See testcase, which crashes current trunk builds on load.
Since the testcase uses onbeforecopy, I think this is a regression from bug 280959.

The iframe content consists of this:
<html><head></head>
<body>
<kbd id="mw_a" onbeforecopy="window.frameElement.parentNode.removeChild(window.frameElement)">
</kbd>
<script>
var y=document.getElementById('mw_a');
y.setAttribute('tabindex','1');
y.focus();
</script>
</body>
</html>

http://crash-stats.mozilla.com/report/index/3d5e2f94-5a90-11dc-b9ae-001a4bd46e84
0  	@0x0  	
1 	nsGenericHTMLElement::SetElementFocus(int) 	mozilla/content/html/content/src/nsGenericHTMLElement.cpp:3085
2 	nsHTMLInputElement::Focus() 	mozilla/content/html/content/src/nsHTMLAnchorElement.cpp:227
3 	nsGenericHTMLElementTearoff::Focus() 	mozilla/content/html/content/src/nsGenericHTMLElement.cpp:202
4 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
5 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2285
6 	XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1467
7 	js_Invoke 	mozilla/js/src/jsinterp.c:1378
8 	js_Interpret 	mozilla/js/src/jsinterp.c:4111
9 	js_Execute 	mozilla/js/src/jsinterp.c:1645
OS: Windows XP → All
Assignee: nobody → Olli.Pettay
Status: NEW → ASSIGNED

        Attachment #279584 -
        Flags: superreview?(jst)

        Attachment #279584 -
        Flags: review?(jst)

        Attachment #279584 -
        Flags: approval1.9?

        Attachment #279584 -
        Flags: superreview?(jst)

        Attachment #279584 -
        Flags: superreview+

        Attachment #279584 -
        Flags: review?(jst)

        Attachment #279584 -
        Flags: review+

        Attachment #279584 -
        Flags: approval1.9?

        Attachment #279584 -
        Flags: approval1.9+
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED

    
  
Flags: in-testsuite?

    
    

    
  
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007090504 Minefield/3.0a8pre
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsGenericHTMLElement::SetElementFocus]
Component: Event Handling → User events and focus handling

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: