Crash when combobox dropdown persists across page load

VERIFIED FIXED in Firefox 13

Status

()

Core
Event Handling
--
critical
VERIFIED FIXED
6 years ago
5 years ago

People

(Reporter: test_test_testing, Assigned: Neil Deakin (not available until Aug 9))

Tracking

(4 keywords)

13 Branch
mozilla15
crash, regression, reproducible, topcrash
Points:
---

Firefox Tracking Flags

(firefox13+ verified, firefox14+ verified)

Details

(Whiteboard: [qa+], crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120226 Firefox/13.0a1
Build ID: 20120226031015

Steps to reproduce:

Go to fanfic reviews page (http://www.fanfiction.net/r/5782108/17/1/)
In the top-right corner there is a drop-down box thing to select the chapter.
Click to make the drop-down list appear, and choose some random chapter.
The page will begin loading that page. before the page has loaded, click to drop-down again.
The drop-down list will persist across the page-load, and Firefox will crash when you try to scroll the drop-down list.


Actual results:

Crash


Expected results:

No crash. The drop-down shouldn't have persisted across the page load.

Comment 1

6 years ago
Reproduced:
Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120226 Firefox/13.0a1

bp-8ef3fad8-751e-45ec-9f1d-8229f2120226
Severity: normal → critical
Crash Signature: [@ DragDataProducer::Produce ]
Keywords: crash

Updated

6 years ago
Status: UNCONFIRMED → NEW
Component: Untriaged → Event Handling
Ever confirmed: true
Keywords: reproducible
Product: Firefox → Core
QA Contact: untriaged → events

Comment 2

5 years ago
It's #39 top browser crasher in 13.0a2 and #32 in 14.0a1.
Crash Signature: [@ DragDataProducer::Produce ] → [@ DragDataProducer::Produce(nsDOMDataTransfer*, bool*, nsISelection**, nsIContent**)] [@ DragDataProducer::Produce ]
OS: Linux → All
Hardware: x86_64 → All

Updated

5 years ago
Duplicate of this bug: 735174

Comment 4

5 years ago
STR
> Go to fanfic reviews page (http://www.fanfiction.net/r/5782108/17/1/)
> In the top-right corner there is a drop-down box thing to select the chapter.
> Click to make the drop-down list appear, and choose some random chapter.
> The page will begin loading that page. before the page has loaded, click to drop-down again.
> The drop-down list will persist across the page-load, and Firefox will crash when you try to scroll the drop-down list.

Crash when you try to scroll the drop-down list by dragging of thumb.


Regression window(m-c),
Not crash:
http://hg.mozilla.org/mozilla-central/rev/a3b93f3949fe
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/20120217 Firefox/13.0a1 ID:20120217155649
Crash:
http://hg.mozilla.org/mozilla-central/rev/e001b5eda618
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217162149
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a3b93f3949fe&tochange=e001b5eda618

Regression window(m-i),
Not crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/174ce0df7cdd
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217061753
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/51d333edddfd
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0a1) Gecko/13.0a1 Firefox/13.0a1 ID:20120217062249
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=174ce0df7cdd&tochange=51d333edddfd

Triggered by: Bug 499008
Blocks: 499008

Updated

5 years ago
Keywords: regression
Created attachment 608699 [details] [diff] [review]
fixes crash

There's a bug somewhere on select elements not closing when the page changes that really is the main cause of the problem here. A drag event is firing at the window despite it having gone away.

This patch just adds a null check to prevent the crash but it doesn't really fix the problem.
Assignee: nobody → enndeakin
Attachment #608699 - Flags: review?(bugs)
Comment on attachment 608699 [details] [diff] [review]
fixes crash

if (expr) {
  stmt;
}
Attachment #608699 - Flags: review?(bugs) → review+

Updated

5 years ago
See Also: → bug 738781

Comment 7

5 years ago
It's #24 top browser crasher in 13.0a2 and #25 in 14.0a1.
tracking-firefox13: --- → ?
tracking-firefox14: --- → ?
Keywords: topcrash

Updated

5 years ago
tracking-firefox13: ? → +
tracking-firefox14: ? → +

Comment 8

5 years ago
(In reply to Neil Deakin from comment #5)
> Created attachment 608699 [details] [diff] [review]
> fixes crash
> 
> There's a bug somewhere on select elements not closing when the page changes
> that really is the main cause of the problem here. A drag event is firing at
> the window despite it having gone away.
> 
> This patch just adds a null check to prevent the crash but it doesn't really
> fix the problem.

Neil/Olli - can we land this fix on m-c now in preparation for uplift to FF13 (currently on beta)? This bug is a top crasher in our most recent releases.
https://hg.mozilla.org/mozilla-central/rev/722e163ecc1e
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
Adding qawanted - can someone verify this crash is fixed so we can go forward with beta/aurora uplift?
Keywords: qawanted
Appears to be fixed...

Firefox 15.0a1 Nightly 2012-05-13 crashes
Firefox 15.0a1 Nightly 2012-05-18 does not crash
No longer blocks: 499008
Keywords: qawanted
Sorry, not sure why the "blocker" field got cleared on my edit. Adding back bug 499008.

Marking this bug VERIFIED FIXED for Firefox 15 based on my testing in comment 11.
Blocks: 499008
Status: RESOLVED → VERIFIED

Comment 13

5 years ago
(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #12)
> Sorry, not sure why the "blocker" field got cleared on my edit. Adding back
> bug 499008.
It's a bug in Bugzilla or the Mozilla's server (appeared yesterday). Each time, a bug is changed the Blocks and Depends On fields are cleared.
status-firefox13: --- → affected
status-firefox14: --- → affected
Thanks Anthony for verifying the fix - please nominate for aurora/beta approval so we can get this into tomorrow's beta.
Comment on attachment 608699 [details] [diff] [review]
fixes crash

Applies to other branches too

[Approval Request Comment]
Bug caused by (feature/regressing bug #): NA
User impact if declined: Crash
Testing completed (on m-c, etc.): m-c since 2012-05-17
Risk to taking this patch (and alternatives if risky): simple null-check
String or UUID changes made by this patch: NA
Attachment #608699 - Flags: approval-mozilla-beta?
Attachment #608699 - Flags: approval-mozilla-aurora?
Comment on attachment 608699 [details] [diff] [review]
fixes crash

simple, low-risk fix (verified on trunk) - approved.
Attachment #608699 - Flags: approval-mozilla-beta?
Attachment #608699 - Flags: approval-mozilla-beta+
Attachment #608699 - Flags: approval-mozilla-aurora?
Attachment #608699 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/6ba8f41fc10d
https://hg.mozilla.org/releases/mozilla-beta/rev/48f5308b2d46
status-firefox13: affected → fixed
status-firefox14: affected → fixed
Whiteboard: [qa+]
No crashes reproducing the steps in comment 0. Verified fixed on FF 13b5:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20100101 Firefox/13.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20100101 Firefox/13.0
Status: VERIFIED → RESOLVED
Last Resolved: 5 years ago5 years ago
status-firefox13: fixed → verified
I'm assuming the status change of VERIFIED -> RESOLVED was a mistake in comment 18.
Status: RESOLVED → VERIFIED
I set it on resolved because it wasn't yet verified on all tracking versions of FF. I was going to set it back when will be verified on FF 14 too.

Comment 21

5 years ago
(In reply to Paul Silaghi [QA] from comment #20)
> I set it on resolved because it wasn't yet verified on all tracking versions
> of FF.
The VERIFIED flag is not a global one as I also thought before but it's a trunk one like the FIXED flag.
Verified fixed on FF 14b6:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:14.0) Gecko/20100101 Firefox/14.0

I was able to see the crash on Nightly 2012-05-13.
status-firefox14: fixed → verified
You need to log in before you can comment on or make changes to this bug.