Closed Bug 58429 Opened 24 years ago Closed 23 years ago

Crash with tag based event handler on object/embed

Categories

(Core :: DOM: UI Events & Focus Handling, defect, P3)

defect

Tracking

()

VERIFIED FIXED
mozilla0.9.1

People

(Reporter: bugzillaabuse, Assigned: joki)

References

()

Details

(Keywords: crash, regression, Whiteboard: [rtm-])

Happens in: MacOS, Win 98
Does not happen in: Linux

BuildID: Win 98 10-29-09, Mac 10-29-09

Reproducible: Always

Steps to Reproduce: 
1. Go to above URL
2. Run through all the tests (I tried less than all, but it won't crash with just 
one or even ten tests)
3. Close window (top left in Win98-clicking twice, use close box on top left in 
MacOS
4. Crash.

Actual Results: Crash when window is closed

Expected Results: Closing of window without crash would be nice.

Don't know where to file this, so its going in Event Handling.  Any ideas are 
more than welcome.  Also feel free to change the Summary-I certainly don't know 
what is going on.
Adding RTM and CRASH keywords.  Also adding REGRESSION, since this doesn't happen 
in the 10-18-08 *or* 10-24-08 Mac OS builds, or Win 98 10-18-08 build [all branch 
builds].  Also, this tends to be more reproducible on Win 98-it will happen every 
time, whereas on the MacOS its good to restart the machine before reprodicing the 
issue.

Changing Platform to ALL, Severity to Critical.
Severity: normal → critical
Keywords: crash, regression, rtm
OS: Mac System 9.x → All
Hardware: Macintosh → All
We should narrow this one down more so that we can make a better call about
whether it is something that has enough user impact to let into the rtm branch.
 Marking rtm need info.
Whiteboard: [rtm need info]
PDT marking [rtm-] unless this crash can be reproduced on a page that end users
will frequently encounter.
Whiteboard: [rtm need info] → [rtm-]
Changing crasher bug milestone to mozilla0.9.
Target Milestone: --- → mozilla0.9
Reassigning QA Contact for all open and unverified bugs previously under Lorca's
care to Gerardo as per phone conversation this morning.
QA Contact: lorca → gerardok
I can't make this crash on window close anymore but it does crash nicely if you 
mouseover the object tag.  This area of code is changing a lot with the DOM 
XPConnect code so I'm moving this to 0.9.1 to be reevaluated after that code 
goes in.

For the sake of documentation, the problem in the current crash is that the 
creation of a script object for the Object tag during the lazy compilation of 
its script handlers call SetScriptObject(nsnull) which causes a clearing of the 
event handlers.  The handler in process at the time then crashes as it fires 
after the compilation.
Status: NEW → ASSIGNED
Summary: Browser crashes with Event Activity and closing of window (?) → Browser crashes with mouseover of object
Target Milestone: mozilla0.9 → mozilla0.9.1
*** Bug 69893 has been marked as a duplicate of this bug. ***
Testcase from dupe

http://bugzilla.mozilla.org/showattachment.cgi?attach_id=25967
Summary: Browser crashes with mouseover of object → Crash with tag based event handler on object/embed
Crash seems very infrequent.  Let's retest after the XPCDOM work lands and
reevaluate at that time.
Keywords: nsbeta1nsbeta1-, qawanted
As I'd hoped this seems fine with the new XPCDOM code.  I do seem assertions 
here and there but the events themselves fire just fine.
Status: ASSIGNED → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
verifying on build 2001-05-15-04-trunk windows 98
Status: RESOLVED → VERIFIED
Keywords: qawanted, rtmnsrtm
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.