Crash when tapping multiple comboboxes, then dismissing multiple dialogs

VERIFIED FIXED in Firefox 11

Status

()

Firefox for Android
General
P2
critical
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: Martijn Wargers (dead), Assigned: wesj)

Tracking

({crash, testcase})

Trunk
Firefox 12
ARM
Android
crash, testcase
Points:
---

Firefox Tracking Flags

(firefox11 fixed, fennec11+)

Details

(Whiteboard: [native-crash])

Attachments

(3 attachments)

(Reporter)

Description

6 years ago
Created attachment 590402 [details]
testcase

Tested on the LG Optimus Black, Android 2.2.2.

Steps to reproduce:
- Open testcase, tap on multiple comboboxes quickly.

Multiple dialogs appear (should not happen, should it?). After tapping on 3 on them, Fennec hangs and after a while you get the "not responding" dialog, where you finally can choose to force close Fennec.
(Reporter)

Comment 1

6 years ago
Created attachment 590408 [details]
Catlog of crash

Updated

6 years ago
Whiteboard: [native-crash]
Assignee: nobody → wjohnston
tracking-fennec: --- → 11+
Priority: -- → P2
(Assignee)

Comment 2

6 years ago
Created attachment 591199 [details] [diff] [review]
Patch

This is really a dup of bug 707029, and I also fixed bug 718965 while I was here.
Attachment #591199 - Flags: review?(bnicholson)
Comment on attachment 591199 [details] [diff] [review]
Patch

       result.listitems[aIndex] = {
         label: aNode.text || aNode.label,
         isGroup: this._isOptionGroupElement(aNode),
         inGroup: this._isOptionGroupElement(aNode.parentNode),
         disabled: aNode.disabled,
         id: aIndex
       }
+      if (result.listitems[aIndex].inGroup)
+        result.listitems[aIndex].disabled = result.listitems[aIndex].disabled || aNode.parentNode.disabled;

It might be a bit cleaner if you factor out result.listitems[aIndex]:
       let listItem = result.listitems[aIndex] = {
         label: aNode.text || aNode.label,
         isGroup: this._isOptionGroupElement(aNode),
         inGroup: this._isOptionGroupElement(aNode.parentNode),
         disabled: aNode.disabled,
         id: aIndex
       };
       if (listItem.inGroup)
         listItem.disabled = listItem.disabled || aNode.parentNode.disabled;
Attachment #591199 - Flags: review?(bnicholson) → review+
(Assignee)

Comment 4

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/1a83fdd31f60
Whiteboard: [native-crash] → [native-crash][inbound]
(Assignee)

Comment 5

6 years ago
Whoops brian. Completely forgot about the comment idea. Fixed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/80a63d2f69ea
https://hg.mozilla.org/mozilla-central/rev/1a83fdd31f60
https://hg.mozilla.org/mozilla-central/rev/80a63d2f69ea
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Whiteboard: [native-crash][inbound] → [native-crash]
Target Milestone: --- → Firefox 12
(Assignee)

Comment 7

6 years ago
Comment on attachment 591199 [details] [diff] [review]
Patch

[Approval Request Comment]
Regression caused by (bug #): bug 695485
User impact if declined: potential crashiness on a few sites
Testing completed (on m-c, etc.): landed on Jan 24
Risk to taking this patch (and alternatives if risky): low risk.
Attachment #591199 - Flags: approval-mozilla-aurora?
(Reporter)

Comment 8

6 years ago
Verified fixed in current Native trunk build.
Status: RESOLVED → VERIFIED

Comment 9

6 years ago
Comment on attachment 591199 [details] [diff] [review]
Patch

[Triage Comment]
Mobile only - approved for Aurora.
Attachment #591199 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/20e91ae263ad
status-firefox11: --- → fixed
Blocks: 707029
You need to log in before you can comment on or make changes to this bug.