Closed Bug 395725 Opened 13 years ago Closed 13 years ago

Crash [@ nsIFrame::GetFrameSelection] with testcase using onbeforecopy and removing window

Categories

(Core :: DOM: UI Events & Focus Handling, defect)

x86
All
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: smaug)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(2 files)

Attached file testcase
See testcase, when double-clicking in the empty area in the iframe, current trunk builds crash.
This regressed between 2007-07-25 and 2007-07-26, this is when bug 280959 was checked in.
And the testcase also uses onbeforecopy, so this is a regression from that bug.
Attached patch possible patchSplinter Review
Could someone try this on windows, just to make sure everything is ok.
Assignee: nobody → Olli.Pettay
Status: NEW → ASSIGNED
OS: Windows XP → All
Yeah, the patch fixes the crash (tested on a vc debug build).
Comment on attachment 280432 [details] [diff] [review]
possible patch

Asking review, but I think I'll have to audit all the similar code we might have.
Attachment #280432 - Flags: superreview?(roc)
Attachment #280432 - Flags: review?(roc)
(In reply to comment #3)
> Asking review, but I think I'll have to audit all the similar code we might
> have.

Maybe that's what bug 368760 is about?

Attachment #280432 - Flags: superreview?(roc)
Attachment #280432 - Flags: superreview+
Attachment #280432 - Flags: review?(roc)
Attachment #280432 - Flags: review+
Attachment #280432 - Flags: approval1.9+
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007091604 Minefield/3.0a8pre
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsIFrame::GetFrameSelection]
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.