Closed Bug 684927 Opened 9 years ago Closed 9 years ago

unchecked null pointer in nsMenuBarListener::KeyUp


(Core :: XUL, defect)

7 Branch
Windows XP
Not set





(Reporter: clever, Assigned: sicking)


(Keywords: crash, crashreportid)


(3 files)

the bug seems to be triggered by this part of the JS in my extension

 function kick_input(node,evt) {
       var ev = node.ownerDocument.createEvent('Events');
quant being an html <input type=text>
If you're sending key events you really should be using the correct interface. The fix here is going to be to no-op the implementation so you might as well not send the event.
yeah, ive corrected the code to use var ev = node.ownerDocument.createEvent("keyboardevent"); now
but it would still be nice for firefox to not segfault the moment an API is mis-used
just image what could happen if you just put that code on the homepage of a site, instantly block all firefox users from viewing it
Can you please make such a page (html file) having this code that crashes Firefox and attach it here?
thru some testing, i found that it only occurs when the event is made from chrome code
ive attached an extension and .htm file that will reproduce the problem 100%
just install the extension and open the .htm file
Comment on attachment 558950 [details]
the main part of the testcase

oops, this was meant to be a .xpi
Attachment #558950 - Attachment mime type: text/plain → application/x-xpinstall
Attachment #558951 - Attachment mime type: text/plain → text/html
I installed the extension and visited the testcase html. No crash for me, Win XP 32bit.
Attached patch Patch to fixSplinter Review
This should fix the crash. I would be awesome if someone could figure out how to write a automated testcase for this.
Attachment #559491 - Flags: review?(Olli.Pettay)
Component: General → XUL
Product: Firefox → Core
QA Contact: general → xptoolkit.widgets
aceman, did you try testing it on the nightly or beta channel?
i havent checked nightly at all yet, but have seen it on beta channel in 2 computers
NO, I did it on FF6.0.2. But it seems Jonas can already see it.
Ever confirmed: true
Keywords: crash, crashreportid
Version: unspecified → 7 Branch
Attachment #559491 - Flags: review?(Olli.Pettay) → review+

(In reply to Jonas Sicking (:sicking) from comment #9)
> Created attachment 559491 [details] [diff] [review]
> Patch to fix
> This should fix the crash. I would be awesome if someone could figure out
> how to write a automated testcase for this.

Couldn't you convert the test case attached to the bug to a chrome mochitest of some sort?
Assignee: nobody → jonas
Target Milestone: --- → mozilla9
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.