460273 - Crash [@ nsMenuBarSwitchMenu::Run] while keeping the right arrow key pressed in this case

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, with the testcase, press the right arrow key and keep it pressed.
Normally, after a few reloads, I get a crash in current trunk build and Firefox 3. (probably not a big deal, but marking security sensitive, just to be sure)

http://crash-stats.mozilla.com/report/index/fa204c85-9b1f-11dd-89d3-0013211cbf8a?p=1
0  	xul.dll  	nsMenuBarSwitchMenu::Run  	 layout/xul/base/src/nsMenuBarFrame.cpp:342
1 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
2 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
3 	nspr4.dll 	PR_GetEnv 	
4 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:87
5 	firefox.exe 	firefox.exe@0x2197 	
6 	kernel32.dll 	BaseProcessStart

Comment 1

[Martijn Wargers (dead)]

Ok, the slowness of bugzilla isn't really helping with the speed of reloading, so you probably need to download the testcase to your computer or run the testcase in offline mode.

Comment 2

[Lucas Adamski [:ladamski]]

I could get this to repro with 3.0.3 but marking high based upon crash address, but mitigated by difficulty of reproing issue reliability.

Comment 3

[chris hofmann]

martijn,  not seeing this with testing with Build identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090116 Shiretoko/3.1b3pre Ubiquity/0.1.5

do you still see the crash.

If its still a problem and its going to make 1.9.1 we need to figure out plans for this fast.

Comment 4

[Martijn Wargers (dead)]

I can still see the crash.

Because of the slowness of bugzilla, you need to run the testcase in offline mode or test it locally.

But this probably not a big security issue, since (some special) user interaction is involved.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Is this still an issue now that remote xul is prevented?

Comment 6

[Martijn Wargers (dead)]

Seems to be wfm now.