125906 - crash in Form

Status: VERIFIED FIXED

(Core :: Layout: Form Controls, defect, P1)

Description

[Matthias Versen [:Matti]]

win2k build 20020210.. debug and 20020215..

1. Open URL
2. click on the link "SELFHTML Quickbar"
3. Select CSS-Syntaxverzeichnis in the form "SELFHTML Quickbar"
4.click the arrow in the right (second) form
5. hit the key "o" and scroll down with the scroll wheel and sevelct "overflow"
6. crash

Comment 1

[Matthias Versen [:Matti]]

Attachment: win2k stack trace

Comment 2

[Tuukka Tolvanen (sp3000)]

froze for nearly a minute before dying, linux 2002-02-10-06-trunk. os->all

Comment 3

[rods (gone)]

I get basically the same stack trace. Basically, just scroll around and then
select an item to do the submit

Comment 4

[Kevin McCluskey (gone)]

nsbeta1+

Comment 5

[John Keiser (jkeiser)]

Attachment: Patch

The problem is, nsHTMLSelectElement::RemoveFocus() is called before that bit is
set that tells the system that it is actually blurred.	When we fire onChange
from there, and the selected index has changed, the JS immediately runs and
causes another blur to occur (since the system still thinks it's blurred).  We
have not yet marked the boolean flag that says onChange has already been fired,
so we then fire again, which blurs again ... etc.

This fix should deal with all symptoms of the problem, though I'm queasy about
the fact that onBlur() is called twice at all.	Perhaps there is a way to dump
the onChange event in the event queue rather than handling it immediately?

Comment 6

[John Keiser (jkeiser)]

Ok, I have decided this is good enough for 1.0 since it fixes the crash and
really is the way to do it anyway.  The rest of the story is filed as bug 130500.

Comment 7

[rods (gone)]

Comment on attachment 73636 [details] [diff] [review]
Patch

r=rods

Comment 8

[John Keiser (jkeiser)]

Attachment: Patch v1.0.1

Added a nullcheck to make us not crash on listboxes.

Comment 9

[John Keiser (jkeiser)]

Comment on attachment 73916 [details] [diff] [review]
Patch v1.0.1

Transferring r=rods

Comment 10

[Marc Attinasi]

Comment on attachment 73916 [details] [diff] [review]
Patch v1.0.1

sr=attinasi

Comment 11

[Asa Dotzler [:asa]]

Comment on attachment 73916 [details] [diff] [review]
Patch v1.0.1

a=asa (on behalf of drivers) for checkin to the 1.0 trunk

Comment 12

[John Keiser (jkeiser)]

Fix checked in.

Comment 13

[Madhur Bhatia]

verified fixed 
win2000 buildID: 2002-03-18-05trunk
redhat Linux 7.2 buildID: 2002-03-18-06trunk

Comment 14

[carnold]

Attachment: Subset of W3C/NIST L2 HTML test suite that crashes Mozilla's XHTML impl