When opening a hyperlink with its target attribute set to "_blank" a
new buffer is opened. When there is no content handler for the
mimetype a content_handler_prompt is opened and the new (blank) buffer
is killed. saved_focused_frame then references a destroyed object.

A simple example of what used to trigger the bug (unless a content
handler for midi files is available):
<a href="a.mid" target="_blank">link</a>
---
 modules/minibuffer.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/modules/minibuffer.js b/modules/minibuffer.js
index 0f3946d..7aec70a 100644
--- a/modules/minibuffer.js
+++ b/modules/minibuffer.js
@@ -358,8 +358,11 @@ minibuffer.prototype = {
                 this.window.buffers.current.browser.focus();
                 if (this.saved_focused_element && 
this.saved_focused_element.focus)
                     set_focus_no_scroll(this.window, 
this.saved_focused_element);
-                else if (this.saved_focused_frame)
-                    set_focus_no_scroll(this.window, this.saved_focused_frame);
+                else if (this.saved_focused_frame) {
+                    try {
+                        set_focus_no_scroll(this.window, 
this.saved_focused_frame);
+                    } catch (e) { /* saved_focused_frame may be dead */ }
+                }
                 this.saved_focused_element = null;
                 this.saved_focused_frame = null;
                 this._show(this.current_message || this.default_message);
-- 
1.8.1.2

_______________________________________________
Conkeror mailing list
[email protected]
https://www.mozdev.org/mailman/listinfo/conkeror

Reply via email to