Closed Bug 104310 Opened 23 years ago Closed 23 years ago

Browser crashes when loding above URL - Trunk M098 [@ nsXULElement::HandleDOMEvent]

Categories

(Core :: DOM: Events, defect)

Product:
Core
Component:
DOM: Events
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla0.9.9

People

(Reporter: moied, Assigned: joki)

References

(
URL
)

Details

(Keywords: crash, testcase, topcrash, Whiteboard: [INF-REC])

Crash Data

Attachments

(4 files)

Talkback Query Result for nsXULElement::HandleDOMEvent
114.77 KB, text/html
Details
Test case which causes the stack overflow in mozilla
562 bytes, text/html
Details
work around to avoid the stack overflow
1.31 KB, text/plain
Details
Updated patch
1.86 KB, patch
saari
: review+
jst
: superreview+
Details | Diff | Splinter Review 
Browser crash  if any one goes to the about URL

Step 1 : go to http://calstatehayward.com
Step 2: clink on Campus Directory


Expected: The browser should render the Campus Directory page.
Actual : Observed that browser crash
URL : http://imctwo.csuhayward.edu/public/staffdir/index.cfm?FuseAction=Advanced
Stack trace fallowed...
Build ID 2001101106 
Product ID MozillaBranch 
Platform ID Win32 
Trigger Reason Stack overflow 
Stack Trace

nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3574] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3700] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3700] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3700] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3700] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3700] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3700] 
nsXULElement::HandleChromeEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
5113] 
GlobalWindowImpl::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 620] 
nsDocument::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3024] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1811] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1805] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1805] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 466] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1805] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1805] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1805] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1805] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1805] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1805] 
nsHTMLInputElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp, 
line 1115] 
nsHTMLInputElement::Select 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp, 
line 817] 
XPTC_InvokeByIndex 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, 
line 154] 
XPCWrappedNative::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
1953] 
XPC_WN_CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 1255] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 811] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2733] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 827] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 902] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3389] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 980] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 156] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1214] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1817] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1825] 
nsHTMLInputElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp, 
line 1115] 
nsHTMLInputElement::Select 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp, 
line 817] 
XPTC_InvokeByIndex 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, 
line 154] 
XPCWrappedNative::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
1953] 
XPC_WN_CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 1255] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 811] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2733] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 827] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 902] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3389] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 980] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 156] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1214] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1817] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1825] 
nsHTMLInputElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp, 
line 1115] 
nsHTMLInputElement::Select 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp, 
line 817] 
XPTC_InvokeByIndex 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, 
line 154] 
XPCWrappedNative::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
1953] 
XPC_WN_CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 1255] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 811] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2733] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 827] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 902] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3389] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 980] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 156] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1214] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1817]
Severity: normal → critical
Component: Browser-General → DOM Events
QA Contact: doronr → moied
-> default owner
Assignee: asa → joki
QA Contact: moied → vladimire
QA Contact: vladimire → moied
no crash on Linux with a current CVS build
Crashed Win98 Build 2001101103

FWIW: TB36587285H
Confirmed 2001101003-trunk WinNT4. Talkback ID TB36588580Q.
Still crashes Win98 build 2001121909

TB694396K
Still crashes Win95 2002012503
TB2128599M
this looks like an infinite recursion bug in form selection. guessing this is
actually low volume crasher.
Keywords: crash
Target Milestone: --- → mozilla1.1
Whiteboard: [INF-REC]
Yeah, there are only 12 crashes with recent MozillaTrunk builds (withiin the
last 30 days).  Most of them appear to be reported by the same person (Tom
Greer) visiting  www.malaysiaair.com:

 Incident ID 2072165   Stack Signature  nsXULElement::HandleDOMEvent a908c39f
Trigger Time 2002-01-24 12:56:29
Email Address greer@netscape.com
URL visited www.malaysiaair.com
User Comments Went to the site, selected US from the dropdown options, selected
economy from the dropdown options -> crash
Build ID 2002012309
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Stack overflow
Stack Trace
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3195]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3340]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3340]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3340]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3340]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3340]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3340]
nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4568]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 635]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3238]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1633]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1627]
nsHTMLSelectElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1812]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5993]
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5956]
nsListControlFrame::SelectionChanged
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line
2149]
nsListControlFrame::UpdateSelection
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line
2106]
nsComboboxControlFrame::UpdateSelection
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsComboboxControlFrame.cpp,
line 1898]
nsHTMLOptionElement::SetText
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLOptionElement.cpp,
line 623]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2000]
XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1291]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 834]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 925]
js_SetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2601]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2644]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 850]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 925]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3407]
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1014]
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 182]
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1206]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1809]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1648]
nsHTMLSelectElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1812]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5993]
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5956]
nsListControlFrame::SelectionChanged
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line
2149]
nsListControlFrame::UpdateSelection
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line
2106]
nsComboboxControlFrame::UpdateSelection
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsComboboxControlFrame.cpp,
line 1898]
nsHTMLOptionElement::SetText
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLOptionElement.cpp,
line 623]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2000]
XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1291]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 834]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 925]
js_SetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2601]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2644] 

This does look like a topcrasher for Mozilla 0.9.7 though. Adding M097 to
summary and topcrash keyword:

nsXULElement::HandleDOMEvent   31
		 76694 	 VERI 	 FIXE 	 pollmann@netscape.com 	 mozilla0.9 	 2001-05-30
		 76780 	 VERI 	 DUPL 	 ducarroz@netscape.com 	 --- 	 2001-05-10 
BBID range: 1774010 - 2195052
Min/Max Seconds since last crash: 83 - 1971154
Min/Max Runtime: 3199 - 7078089
Crash data range: 2002-01-17 to 2002-01-27
Build ID range: 2001122109 to 2001122109
Keyword List : 
Stack Trace: 

	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3270]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3408]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3408]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3408]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3408]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3408]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3408]
	 nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 3408]
	 nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp  line 4634]
	 GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp  line 632]
	 nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp  line 3058]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1853]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsHTMLFormElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp 
line 498]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1847]
	 nsHTMLSelectElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp 
line 1788]
	 PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5856]
	 PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5821]
	 nsListControlFrame::SelectionChanged
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp  line
2149]
	 nsListControlFrame::UpdateSelection
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp  line
2106]
	 nsComboboxControlFrame::UpdateSelection
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsComboboxControlFrame.cpp 
line 1901]
	 nsHTMLOptionElement::SetText
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLOptionElement.cpp 
line 618]
	 XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp 
line 106]
	 XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp  line 2011]
	 XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp 
line 1291]
	 js_Invoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 834]
	 js_InternalInvoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 925]
	 js_SetProperty
[d:\builds\seamonkey\mozilla\js\src\jsobj.c  line 2601]
	 js_Interpret
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 2644]
	 js_Invoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 850]
	 js_InternalInvoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 925]
	 JS_CallFunctionValue
[d:\builds\seamonkey\mozilla\js\src\jsapi.c  line 3407]
	 nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp  line 1012]
	 nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp  line 182]
	 nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp  line
1215]
	 nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp  line
1818]
	 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1868]
	 nsHTMLSelectElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp 
line 1788]
	 PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5856]
	 PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5821]
	 nsListControlFrame::SelectionChanged
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp  line
2149]
	 nsListControlFrame::UpdateSelection
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp  line
2106]
	 nsComboboxControlFrame::UpdateSelection
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsComboboxControlFrame.cpp 
line 1901]
	 nsHTMLOptionElement::SetText
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLOptionElement.cpp 
line 618]
	 XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp 
line 106]
	 XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp  line 2011]
	 XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp 
line 1291]
	 js_Invoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 834]
	 js_InternalInvoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 925]
	 js_SetProperty
[d:\builds\seamonkey\mozilla\js\src\jsobj.c  line 2601]
	 js_Interpret
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 2644]
	 js_Invoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 850]
	 js_InternalInvoke
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 925]
	 JS_CallFunctionValue
[d:\builds\seamonkey\mozilla\js\src\jsapi.c  line 3407]
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xul/content/src/nsXULElement.cpp
line : 3270
     (2158376)	URL: compaq.com
     (2116889)	URL: www.compaq.com
     (2116889)	Comments: I was configuring a notebook computer there...
     (1974360)	URL: http://www.smb.compaq.com/dstore/default.asp
     (1974360)	Comments: I selected an option from a drop-down menu.  As the menu was
collapsing back to its original form  mozilla crashed.  I'd have this same
problem before.
     (1894301)	URL: www.compaq.ca
     (1894301)	Comments: Same as last time.  Picking options in Compaq.ca store.
     (1894223)	URL: www.compaq.ca
     (1894223)	Comments: Selecting options for an imaginary laptop.
     (1893235)	URL: www.compaq.com
     (1876126)	URL: http://athome.compaq.com/default.asp?ProductLineId=440&page=families
     (1876126)	Comments: Configuring a notebook at Compaq's website
     (1868697)	URL: www.compaq.com
     (1774139)	URL: www.compaq.com
     (1774139)	Comments: Choosing an option from a pull-down list (again)
     (1774010)	URL: www.compaq.com
     (1774010)	Comments: Choosing a processor option from a pull-down list.
Keywords: topcrash
Summary: Browser crashes when loding above URL → Browser crashes when loding above URL - Trunk M097 [@ nsXULElement::HandleDOMEvent]
The following is the query result of search for  nsXULElement::HandleDOMEvent.
It looks like it was a topcrash for Mozilla 0.9.7.
Following are the observations for the url ->
http://imctwo.csuhayward.edu/public/staffdir/index.cfm?FuseAction=Advanced 
causing mozilla to crash

a) In the onLoad event of the body, focus is called for the first text field 
named "name".
b) In the OnFocus of the textfield named "name", this.select() is invoked, 
which causes onSelect handler to be invoked.
c) The onSelect handler in turn calls this.select(). 
I think the last step (c) is causing infinte recurssion, as onSelect handler 
calls select(), resulting in a call to itself.
This test case is result of the source of the url
->http://imctwo.csuhayward.edu/public/staffdir/index.cfm?FuseAction=Advanced
which casuses the stack overflow. The page contains only the data, which
results mozilla to crash. This page works fine on NS4.7 and IE6.0. 

I would look into how mozilla handles the select event and look if we could
avoid the recurssive call if the handler is calling itself.

If anyone has better thoughts on this, please convey the same.
The stack over flow which was occurring because of the event handler calling
its own event, hence causing infinite recursion. This could be avoided if the
event was called only once. I have attached the work around for avoiding the
recursion by making sure that it is event is called only once, for the Select
event.

But this problem could occur on other valid form events, like onblur, onfocus
and etc. Hence I think it would be better to take care at the java script
level, to handle the case of the event handler calling it own event, which
results into recursion.
nominate nsbeta1 since this is a topcrash and now we have a reproduce test case.
Keywords: nsbeta1
Keywords: testcase
Blocks: 123367
Keywords: nsbeta1 → nsbeta1+
Target Milestone: mozilla1.1 → mozilla0.9.9
Summary: Browser crashes when loding above URL - Trunk M097 [@ nsXULElement::HandleDOMEvent] → Browser crashes when loding above URL - Trunk M098 [@ nsXULElement::HandleDOMEvent]
Attached patch Updated patch — — Splinter Review 
I agree that we need a more general solution (see bug 77271) but this is a top
crash and it's worthwhile for now.  Many of the other dangerously recursive
events in on nsHTMLInputElement already have similar protection.  The main
current danger is still focus/blur but that proves to be somewhat more complex.
 So I propose we still do this for now.
Comment on attachment 70210 [details] [diff] [review]
Updated patch

r=saari, although you might want to add a comment above the if() just to note
that we're trying to avoid recursion with the check.
Attachment #70210 - Flags: review+
Comment on attachment 70210 [details] [diff] [review]
Updated patch

sr=jst
Attachment #70210 - Flags: superreview+
Fix checked in.  Continuing to track general recursive event issue in bug 77271.
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
verified fix checked in cvs (Rev 1.218)
Status: RESOLVED → VERIFIED
Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/54417ebbaea2
Flags: in-testsuite+
Crash Signature: [@ nsXULElement::HandleDOMEvent]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: