395725 - Crash [@ nsIFrame::GetFrameSelection] with testcase using onbeforecopy and removing window

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, when double-clicking in the empty area in the iframe, current trunk builds crash.
This regressed between 2007-07-25 and 2007-07-26, this is when bug 280959 was checked in.
And the testcase also uses onbeforecopy, so this is a regression from that bug.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Attachment: possible patch

Could someone try this on windows, just to make sure everything is ok.

Comment 2

[Martijn Wargers (dead)]

Yeah, the patch fixes the crash (tested on a vc debug build).

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 280432 [details] [diff] [review]
possible patch

Asking review, but I think I'll have to audit all the similar code we might have.

Comment 4

[Martijn Wargers (dead)]

(In reply to comment #3)
> Asking review, but I think I'll have to audit all the similar code we might
> have.

Maybe that's what bug 368760 is about?

Comment 5

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007091604 Minefield/3.0a8pre