41246 - crash in nsLineBox::DeleteLineList

Status: VERIFIED FIXED

(Core :: Layout: Form Controls, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

DESCRIPTION:  This seems to be a variant of the crash in bug 36558 that is still
occurring.

STEPS TO REPRODUCE:
 * download files in http://www.people.fas.harvard.edu/~dbaron/nstmp/M9-4-bad1/
 * load the "when-com.xul" file via a file URL
 * click the "Add" tab at the bottom
 * click the "List" tab at the bottom

ACTUAL RESULTS:
 * crash, stack trace:
#0  0x0 in ?? ()
#1  0x4147c144 in nsLineBox::DeleteLineList (aPresContext=0x86fd2d8, 
    aLine=0x88822d0) at nsLineBox.cpp:250
#2  0x414425cc in nsBlockFrame::Destroy (this=0x895e89c, 
    aPresContext=0x86fd2d8) at nsBlockFrame.cpp:1192
#3  0x415a09d6 in nsComboboxControlFrame::Destroy (this=0x895e89c, 
    aPresContext=0x86fd2d8) at nsComboboxControlFrame.cpp:2341
#4  0x4147c15b in nsLineBox::DeleteLineList (aPresContext=0x86fd2d8, 
    aLine=0x8883108) at nsLineBox.cpp:251
#5  0x414425cc in nsBlockFrame::Destroy (this=0x895c0c4, 
    aPresContext=0x86fd2d8) at nsBlockFrame.cpp:1192
#6  0x417237c3 in nsFrameList::DestroyFrames (this=0x88f55b0, 
    aPresContext=0x86fd2d8) at nsFrameList.cpp:35
etc...

DOES NOT WORK CORRECTLY ON:
 * Linux, mozilla, 2000-05-31-08-M16
 * Linux, mozilla, debug build from around 4PM PDT on 2000-05-31 (source of
stack trace)

ADDITIONAL INFORMATION:
If you want me to try to get a simpler testcase, I could try.  I haven't looked
at this testcase for a year.  (It was written for M9.)

Comment 1

[rods (gone)]

Although this is an html in xul issue, this bug points out that the 
Unregistering of the access keys should be done in the Destroy method not the 
destructor. This could cause other problems. Also, the unreg method must check 
for a null PresContext.

Nominating for nsbeta2, it is a low risk change and is the right things to do.

Comment 2

[rods (gone)]

fixed

Comment 3

[ckritzer (gone)]

Marking VERIFIED FIXED on:
- MacOS9 2000-07-12-15-M17 Commercial
- Linux6 2000-07-12-21-M17 Commercial
- Win98  2000-07-12-21-M17 Commercial