399254 - using a popup attribute in a toolbarbutton, with a type="menu", crashes FF on exit

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Ray Kiddy]

This occurs on FF 2.0.0.7 and not FF 3. I am on Mac OS X 10.4.10.

I have an extension, a copy of which can be found at http://www.wykiwyk.com/mozilla/xyzzy2.xpi:

It has this overlay. If one adds the XYZZY button to the toolbar, if one clicks on the button a few times and then quits FF, the app crashes on exit. Take out the "popup" line, it does not crash.


<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE overlay SYSTEM "chrome://xyzzy/locale/xyzzy.dtd">

<overlay id="xyzzy-overlay" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

    <toolbarpalette id="BrowserToolbarPalette">
        <toolbarbutton id="xyzzy-everything-button-2"
                       label="XYZZY"
                       tooltiptext="xyzzy"
                       image="chrome://xyzzy/skin/Home16X16.png"
                       popup="xyzzy-everything-menu-2"
                       type="menu"
                       class="toolbarbutton-1 chromeclass-toolbar-additional">

            <menupopup id="xyzzy-everything-menu-2" position="after_start">

                <menuitem label="Log in" />
                <menuitem label="Open Close Event Viewer" />
                <menuitem label="Upload" />
                <menuitem label="Capture Screen" />
                <menuitem label="Log out" />
                <menuitem label="Send Feedback" />
                <menuitem label="Go to the XYZZY Web Site" />
            </menupopup>
        </toolbarbutton>
    </toolbarpalette>
</overlay>

Here is the stack:

Thread 0 Crashed:
0   org.mozilla.firefox      	0x004d69a7 nsFrameList::DestroyFrames(nsPresContext*) + 37
1   org.mozilla.firefox      	0x005f61ef nsMenuFrame::DestroyPopupFrames(nsPresContext*) + 73
2   org.mozilla.firefox      	0x005f8ce1 nsMenuFrame::OnCreate() + 2019
3   org.mozilla.firefox      	0x004d69aa nsFrameList::DestroyFrames(nsPresContext*) + 40
4   org.mozilla.firefox      	0x00427119 nsContainerFrame::MoveOverflowToChildList(nsPresContext*) + 241
5   org.mozilla.firefox      	0x004d69aa nsFrameList::DestroyFrames(nsPresContext*) + 40
6   org.mozilla.firefox      	0x00427119 nsContainerFrame::MoveOverflowToChildList(nsPresContext*) + 241
7   org.mozilla.firefox      	0x004d69aa nsFrameList::DestroyFrames(nsPresContext*) + 40
8   org.mozilla.firefox      	0x00427119 nsContainerFrame::MoveOverflowToChildList(nsPresContext*) + 241
9   org.mozilla.firefox      	0x004d69aa nsFrameList::DestroyFrames(nsPresContext*) + 40
10  org.mozilla.firefox      	0x00427119 nsContainerFrame::MoveOverflowToChildList(nsPresContext*) + 241
11  org.mozilla.firefox      	0x004d69aa nsFrameList::DestroyFrames(nsPresContext*) + 40
12  org.mozilla.firefox      	0x00427119 nsContainerFrame::MoveOverflowToChildList(nsPresContext*) + 241
13  org.mozilla.firefox      	0x0042537b nsCSSRendering::PaintBackground(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) + 2101
14  org.mozilla.firefox      	0x00113778 PresShell::RemoveDummyLayoutRequest() + 704
15  org.mozilla.firefox      	0x001538bb DocumentViewerImpl::InitInternal(nsIWidget*, nsISupports*, nsIDeviceContext*, nsRect const&, int, int) + 6817
16  org.mozilla.firefox      	0x0052fb1b nsRefreshTimer::nsRefreshTimer[in-charge]() + 1065
17  org.mozilla.firefox      	0x0035ee07 nsXULWindow::SetContentScrollbarVisibility(int) + 2909
18  org.mozilla.firefox      	0x0035b5b3 nsWebShellWindow::SetPersistenceTimer(unsigned) + 455
19  org.mozilla.firefox      	0x0040fd27 nsGlobalWindow::ReallyCloseWindow() + 401
20  libxpcom_core.dylib      	0x00e44551 PL_HandleEvent + 21
21  libxpcom_core.dylib      	0x00e4480a PL_ProcessPendingEvents + 103
22  com.apple.CoreFoundation 	0x01ff3f92 CFRunLoopRunSpecific + 1213
23  com.apple.CoreFoundation 	0x01ff3ace CFRunLoopRunInMode + 61
24  com.apple.HIToolbox      	0x02ce58d8 RunCurrentEventLoopInMode + 285
25  com.apple.HIToolbox      	0x02ce4f19 ReceiveNextEventCommon + 184
26  com.apple.HIToolbox      	0x02d2da74 _AcquireNextEvent + 58
27  com.apple.HIToolbox      	0x02d2d8bc RunApplicationEventLoop + 150
28  org.mozilla.firefox      	0x00234d73 nsAppShell::~nsAppShell [in-charge deleting]() + 133
29  org.mozilla.firefox      	0x002c0942 nsAppStartup::DestroyExitEvent(PLEvent*) + 148
30  org.mozilla.firefox      	0x00005dce XRE_main + 5892
31  org.mozilla.firefox      	0x000029d8 main + 32
32  org.mozilla.firefox      	0x0000295e start + 270
33  org.mozilla.firefox      	0x00002879 start + 41

Comment 1

[Ray Kiddy]

Attachment: extension that demonstrates the crash

Comment 2

[Ray Kiddy]

dupe of https://bugzilla.mozilla.org/show_bug.cgi?id=288763 ?

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Can you find the time when this was fixed on the trunk?

Comment 4

[Ray Kiddy]

Checked bonsai. Is this is?

2006-08-02 01:24
Olli.Pettay%helsinki.fi 	mozilla/content/xul/content/src/nsXULPopupListener.cpp
1.138
16/0
Bug 288763, problems with context menupopup cause a crash on window close, r=enndeakin, sr=bz

Comment 5

[:Gavin Sharp [email: [e-mail]]]

I don't know, could be. The only way to find out is to either understand the code and patch, or test builds from before and after that checkin. Have you tried the latter?