730694 - Crash when combobox dropdown persists across page load

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[test_test_testing]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120226 Firefox/13.0a1
Build ID: 20120226031015

Steps to reproduce:

Go to fanfic reviews page (http://www.fanfiction.net/r/5782108/17/1/)
In the top-right corner there is a drop-down box thing to select the chapter.
Click to make the drop-down list appear, and choose some random chapter.
The page will begin loading that page. before the page has loaded, click to drop-down again.
The drop-down list will persist across the page-load, and Firefox will crash when you try to scroll the drop-down list.


Actual results:

Crash


Expected results:

No crash. The drop-down shouldn't have persisted across the page load.

Comment 1

[Thomas Ahlblom]

Reproduced:
Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120226 Firefox/13.0a1

bp-8ef3fad8-751e-45ec-9f1d-8229f2120226

Comment 2

[Scoobidiver (away)]

It's #39 top browser crasher in 13.0a2 and #32 in 14.0a1.

Comment 4

[Alice0775 White]

STR
> Go to fanfic reviews page (http://www.fanfiction.net/r/5782108/17/1/)
> In the top-right corner there is a drop-down box thing to select the chapter.
> Click to make the drop-down list appear, and choose some random chapter.
> The page will begin loading that page. before the page has loaded, click to drop-down again.
> The drop-down list will persist across the page-load, and Firefox will crash when you try to scroll the drop-down list.

Crash when you try to scroll the drop-down list by dragging of thumb.


Regression window(m-c),
Not crash:
http://hg.mozilla.org/mozilla-central/rev/a3b93f3949fe
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/20120217 Firefox/13.0a1 ID:20120217155649
Crash:
http://hg.mozilla.org/mozilla-central/rev/e001b5eda618
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217162149
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a3b93f3949fe&tochange=e001b5eda618

Regression window(m-i),
Not crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/174ce0df7cdd
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217061753
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/51d333edddfd
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217062249
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=174ce0df7cdd&tochange=51d333edddfd

Triggered by: Bug 499008

Comment 5

[Neil Deakin]

Attachment: fixes crash

There's a bug somewhere on select elements not closing when the page changes that really is the main cause of the problem here. A drag event is firing at the window despite it having gone away.

This patch just adds a null check to prevent the crash but it doesn't really fix the problem.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 608699 [details] [diff] [review]
fixes crash

if (expr) {
  stmt;
}

Comment 7

[Scoobidiver (away)]

It's #24 top browser crasher in 13.0a2 and #25 in 14.0a1.

Comment 8

[Alex Keybl [:akeybl]]

(In reply to Neil Deakin from comment #5)
> Created attachment 608699 [details] [diff] [review]
> fixes crash
> 
> There's a bug somewhere on select elements not closing when the page changes
> that really is the main cause of the problem here. A drag event is firing at
> the window despite it having gone away.
> 
> This patch just adds a null check to prevent the crash but it doesn't really
> fix the problem.

Neil/Olli - can we land this fix on m-c now in preparation for uplift to FF13 (currently on beta)? This bug is a top crasher in our most recent releases.

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/722e163ecc1e

Comment 10

[Lukas Blakk [:lsblakk] use ?needinfo]

Adding qawanted - can someone verify this crash is fixed so we can go forward with beta/aurora uplift?

Comment 11

[u279076]

Appears to be fixed...

Firefox 15.0a1 Nightly 2012-05-13 crashes
Firefox 15.0a1 Nightly 2012-05-18 does not crash

Comment 12

[u279076]

Sorry, not sure why the "blocker" field got cleared on my edit. Adding back bug 499008.

Marking this bug VERIFIED FIXED for Firefox 15 based on my testing in comment 11.

Comment 13

[Scoobidiver (away)]

(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #12)
> Sorry, not sure why the "blocker" field got cleared on my edit. Adding back
> bug 499008.
It's a bug in Bugzilla or the Mozilla's server (appeared yesterday). Each time, a bug is changed the Blocks and Depends On fields are cleared.

Comment 14

[Lukas Blakk [:lsblakk] use ?needinfo]

Thanks Anthony for verifying the fix - please nominate for aurora/beta approval so we can get this into tomorrow's beta.

Comment 15

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 608699 [details] [diff] [review]
fixes crash

Applies to other branches too

[Approval Request Comment]
Bug caused by (feature/regressing bug #): NA
User impact if declined: Crash
Testing completed (on m-c, etc.): m-c since 2012-05-17
Risk to taking this patch (and alternatives if risky): simple null-check
String or UUID changes made by this patch: NA

Comment 16

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 608699 [details] [diff] [review]
fixes crash

simple, low-risk fix (verified on trunk) - approved.

Comment 17

[Olli Pettay [:smaug][[e-mail]]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/6ba8f41fc10d
https://hg.mozilla.org/releases/mozilla-beta/rev/48f5308b2d46

Comment 18

[Paul Silaghi, QA [:pauly]]

No crashes reproducing the steps in comment 0. Verified fixed on FF 13b5:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20100101 Firefox/13.0

Comment 19

[u279076]

I'm assuming the status change of VERIFIED -> RESOLVED was a mistake in comment 18.

Comment 20

[Paul Silaghi, QA [:pauly]]

I set it on resolved because it wasn't yet verified on all tracking versions of FF. I was going to set it back when will be verified on FF 14 too.

Comment 21

[Scoobidiver (away)]

(In reply to Paul Silaghi [QA] from comment #20)
> I set it on resolved because it wasn't yet verified on all tracking versions
> of FF.
The VERIFIED flag is not a global one as I also thought before but it's a trunk one like the FIXED flag.

Comment 22

[Paul Silaghi, QA [:pauly]]

Verified fixed on FF 14b6:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:14.0) Gecko/20100101 Firefox/14.0

I was able to see the crash on Nightly 2012-05-13.