720058 - Crash when tapping multiple comboboxes, then dismissing multiple dialogs

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: General, defect, P2)

Description

[Martijn Wargers (dead)]

Attachment: testcase

Tested on the LG Optimus Black, Android 2.2.2.

Steps to reproduce:
- Open testcase, tap on multiple comboboxes quickly.

Multiple dialogs appear (should not happen, should it?). After tapping on 3 on them, Fennec hangs and after a while you get the "not responding" dialog, where you finally can choose to force close Fennec.

Comment 1

[Martijn Wargers (dead)]

Attachment: Catlog of crash

Comment 2

[Wesley Johnston (:wesj)]

Attachment: Patch

This is really a dup of bug 707029, and I also fixed bug 718965 while I was here.

Comment 3

[Brian Nicholson (:bnicholson)]

Comment on attachment 591199 [details] [diff] [review]
Patch

       result.listitems[aIndex] = {
         label: aNode.text || aNode.label,
         isGroup: this._isOptionGroupElement(aNode),
         inGroup: this._isOptionGroupElement(aNode.parentNode),
         disabled: aNode.disabled,
         id: aIndex
       }
+      if (result.listitems[aIndex].inGroup)
+        result.listitems[aIndex].disabled = result.listitems[aIndex].disabled || aNode.parentNode.disabled;

It might be a bit cleaner if you factor out result.listitems[aIndex]:
       let listItem = result.listitems[aIndex] = {
         label: aNode.text || aNode.label,
         isGroup: this._isOptionGroupElement(aNode),
         inGroup: this._isOptionGroupElement(aNode.parentNode),
         disabled: aNode.disabled,
         id: aIndex
       };
       if (listItem.inGroup)
         listItem.disabled = listItem.disabled || aNode.parentNode.disabled;

Comment 4

[Wesley Johnston (:wesj)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1a83fdd31f60

Comment 5

[Wesley Johnston (:wesj)]

Whoops brian. Completely forgot about the comment idea. Fixed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/80a63d2f69ea

Comment 6

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/1a83fdd31f60
https://hg.mozilla.org/mozilla-central/rev/80a63d2f69ea

Comment 7

[Wesley Johnston (:wesj)]

Comment on attachment 591199 [details] [diff] [review]
Patch

[Approval Request Comment]
Regression caused by (bug #): bug 695485
User impact if declined: potential crashiness on a few sites
Testing completed (on m-c, etc.): landed on Jan 24
Risk to taking this patch (and alternatives if risky): low risk.

Comment 8

[Martijn Wargers (dead)]

Verified fixed in current Native trunk build.

Comment 9

[Alex Keybl [:akeybl]]

Comment on attachment 591199 [details] [diff] [review]
Patch

[Triage Comment]
Mobile only - approved for Aurora.

Comment 10

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/20e91ae263ad