Last Comment Bug 666225 - [@ nsFrame::HandlePress ] Browser crash on changing <input type=text> to type=file
: [@ nsFrame::HandlePress ] Browser crash on changing <input type=text> to type...
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: Layout (show other bugs)
: unspecified
: All All
: -- major (vote)
: ---
Assigned To: Simon Montagu :smontagu
:
Mentors:
http://www.whatsup.org.il/index.php?n...
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-06-22 05:32 PDT by Tomer Cohen :tomer
Modified: 2011-06-27 09:43 PDT (History)
7 users (show)
smontagu: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
nullcheck patch (211 bytes, patch)
2011-06-22 06:52 PDT, Simon Montagu :smontagu
no flags Details | Diff | Review
nullcheck patch (1.12 KB, patch)
2011-06-22 06:54 PDT, Simon Montagu :smontagu
roc: review+
Details | Diff | Review
mochitest (2.22 KB, patch)
2011-06-24 04:28 PDT, Simon Montagu :smontagu
roc: review+
Details | Diff | Review

Description Tomer Cohen :tomer 2011-06-22 05:32:19 PDT
Reported on a forum we are monitoring, and affects stable and development branches. 

Steps to reproduce: 
Type the following into Firefox location bar and hit enter: 
data:text/html,<input type="text" onmousedown="this.type='file';" />
Click on the input field.

Current result:
Browser crash.

https://crash-stats.mozilla.com/report/index/bp-784a0be1-69ad-43c9-be27-d64142110622
https://crash-stats.mozilla.com/report/index/bp-5b778da6-e8d8-435d-8bbd-0f9832110622
http://crash-stats.mozilla.com/report/index/dab2cd06-c5e2-4d9d-b035-5bb992110622
http://crash-stats.mozilla.com/report/index/0afb8160-0df3-4f6c-a702-465992110622
Comment 1 Simon Montagu :smontagu 2011-06-22 06:52:27 PDT
Created attachment 541034 [details] [diff] [review]
nullcheck patch

With this there is no crash, but there is an assertion:

###!!! ASSERTION: Unexpected document: 'capturingContent->GetCurrentDoc() == GetDocument()', ... layout/base/nsPresShell.cpp, line 6656

That looks the same as bug 560764.
Comment 2 Simon Montagu :smontagu 2011-06-22 06:54:46 PDT
Created attachment 541035 [details] [diff] [review]
nullcheck patch
Comment 3 Robert O'Callahan (:roc) (Exited; email my personal email if necessary) 2011-06-22 14:21:34 PDT
Comment on attachment 541035 [details] [diff] [review]
nullcheck patch

Review of attachment 541035 [details] [diff] [review]:
-----------------------------------------------------------------
Comment 4 Robert O'Callahan (:roc) (Exited; email my personal email if necessary) 2011-06-22 14:23:05 PDT
Also, add a crashtest.
Comment 5 Simon Montagu :smontagu 2011-06-22 14:35:36 PDT
Is there a way to synthesize a mousepress in a crashtest? I was thinking it would have to be a mochitest.
Comment 6 Robert O'Callahan (:roc) (Exited; email my personal email if necessary) 2011-06-24 02:36:42 PDT
OK, make it a mochitest :-)
Comment 7 Simon Montagu :smontagu 2011-06-24 04:28:52 PDT
Created attachment 541660 [details] [diff] [review]
mochitest
Comment 9 Simon Montagu :smontagu 2011-06-27 09:43:26 PDT
http://hg.mozilla.org/mozilla-central/rev/b93c0c4cb84a
http://hg.mozilla.org/mozilla-central/rev/cfd2af15e1c3

Checked in with a tweak to the test: for some reason on OSX
 synthesizeMouseAtCenter($("i"), { });
never triggers the mouseup event listener, but
 synthesizeMouseAtCenter($("i"), { type: "mousedown" });
 synthesizeMouseAtCenter($("i"), { type: "mouseup" });
does.

Note You need to log in before you can comment on or make changes to this bug.