666225 - [@ nsFrame::HandlePress ] Browser crash on changing <input type=text> to type=file

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Tomer Cohen :tomer]

Reported on a forum we are monitoring, and affects stable and development branches. 

Steps to reproduce: 
Type the following into Firefox location bar and hit enter: 
data:text/html,<input type="text" onmousedown="this.type='file';" />
Click on the input field.

Current result:
Browser crash.

https://crash-stats.mozilla.com/report/index/bp-784a0be1-69ad-43c9-be27-d64142110622
https://crash-stats.mozilla.com/report/index/bp-5b778da6-e8d8-435d-8bbd-0f9832110622
http://crash-stats.mozilla.com/report/index/dab2cd06-c5e2-4d9d-b035-5bb992110622
http://crash-stats.mozilla.com/report/index/0afb8160-0df3-4f6c-a702-465992110622

Comment 1

[Simon Montagu :smontagu]

Attachment: nullcheck patch

With this there is no crash, but there is an assertion:

###!!! ASSERTION: Unexpected document: 'capturingContent->GetCurrentDoc() == GetDocument()', ... layout/base/nsPresShell.cpp, line 6656

That looks the same as bug 560764.

Comment 2

[Simon Montagu :smontagu]

Attachment: nullcheck patch

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 541035 [details] [diff] [review]
nullcheck patch

Review of attachment 541035 [details] [diff] [review]:
-----------------------------------------------------------------

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Also, add a crashtest.

Comment 5

[Simon Montagu :smontagu]

Is there a way to synthesize a mousepress in a crashtest? I was thinking it would have to be a mochitest.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

OK, make it a mochitest :-)

Comment 7

[Simon Montagu :smontagu]

Attachment: mochitest

Comment 9

[Simon Montagu :smontagu]

http://hg.mozilla.org/mozilla-central/rev/b93c0c4cb84a
http://hg.mozilla.org/mozilla-central/rev/cfd2af15e1c3

Checked in with a tweak to the test: for some reason on OSX
 synthesizeMouseAtCenter($("i"), { });
never triggers the mouseup event listener, but
 synthesizeMouseAtCenter($("i"), { type: "mousedown" });
 synthesizeMouseAtCenter($("i"), { type: "mouseup" });
does.