401160 - Infinite-recursion crash calling focus() involving label, legend, contenteditable

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase makes Firefox crash due to running out of stack space.

...
106 nsHTMLLegendElement::SetFocus (nsHTMLLegendElement.cpp:272)
107 nsHTMLLabelElement::SetFocus (nsHTMLLabelElement.cpp:276)
108 nsEventStateManager::ChangeFocusWith (nsEventStateManager.cpp:3285)
109 nsEventStateManager::ShiftFocusInternal (nsEventStateManager.cpp:3570)
110 nsEventStateManager::ShiftFocus (nsEventStateManager.cpp:3365)
111 nsFocusController::MoveFocus (nsFocusController.cpp:327)
112 nsHTMLLegendElement::SetFocus (nsHTMLLegendElement.cpp:272)
...

Comment 1

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

Ignore recursive invocation of SetFocus()

Comment 2

[Mats Palmgren (inactive)]

Better description:
Ignore recursive invocation of SetFocus() on the same element.

Comment 3

[Mats Palmgren (inactive)]

Attachment: mochitest

Comment 4

[Peter Van der Beken [:peterv]]

Comment on attachment 286299 [details] [diff] [review]
Patch rev. 1

>Index: content/html/content/src/nsHTMLLabelElement.cpp
>===================================================================

>+  PRPackedBool mHandlingEvent :1;
>+  PRPackedBool mInSetFocus :1;

No need for bitfields, just use plain PRPackedBools.

Comment 5

[Mike Schroepfer]

Comment on attachment 286299 [details] [diff] [review]
Patch rev. 1

approving crash fix..

Comment 6

[Mats Palmgren (inactive)]

Attachment: Patch with nit fixed + mochitest, (Checked in)

Comment 7

[Mats Palmgren (inactive)]

mozilla/content/html/content/src/nsHTMLLabelElement.cpp 	1.106
mozilla/content/html/content/src/nsHTMLLegendElement.cpp 	1.70
mozilla/content/html/content/test/Makefile.in 	1.32
mozilla/content/html/content/test/test_bug401160.xhtml 	1.1 

-> FIXED