184931 - Trap in GKCONTNT.DLL

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Max Alekseyev]

OS/2 build 2002121112

To reproduce:
1. Open provided URL
2. Enter "Elite" in "Basic Search" field 
3. Click [Search] button
4. Confirm couple of times that you're sending unencrypted info
5. Got a trap like shown below

------------------------------------------------------------

12-11-2002  16:50:58  SYS3175  PID 0add  TID 0001  Slot 0111
P:\INTERNET\MOZILLA\MOZILLA.EXE
c0000005
12d9e412
P1=00000001  P2=0000002c  P3=XXXXXXXX  P4=XXXXXXXX  
EAX=016e5820  EBX=00130bc8  ECX=00130bc8  EDX=0185eaa0
ESI=00130bc4  EDI=01483c60  
DS=0053  DSACC=f0f3  DSLIM=ffffffff  
ES=0053  ESACC=f0f3  ESLIM=ffffffff  
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:12d9e412  CSACC=f0df  CSLIM=ffffffff
SS:ESP=0053:00130b60  SSACC=f0f3  SSLIM=ffffffff
EBP=00000000  FLG=00212206

GKCONTNT.DLL 0001:001fe412

Comment 1

[Max Alekseyev]

Sorry, it works find when you click [Search] button. Trap happens when

3. Hit [Enter] key

Comment 2

[Mike Kaply [:mkaply]]

Confirming and moving to all and DOM events.

The interesting thing here is the double security notification when you press Enter.

My wager is that the enter key is being processed twice and causing bad things
to happen.

The trap itself is in nsHTMLFormElement::SubmitSubmission

Comment 3

[Randell Jesup [:jesup] (needinfo me)]

For reference: doesn't happen in 1.2b on BSD

Comment 4

[Brendan Eich [:brendan]]

When did this regress?

/be

Comment 5

[Mike Kaply [:mkaply]]

Appears to have happened between 12/03/2002 8:00 AM and 12/04/2002 8:00 AM

Comment 6

[Mike Kaply [:mkaply]]

I can get it between 12/3 at noon and 12/4 at 8AM

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=12%2F3%2F2002+12%3A00+PM&maxdate=12%2F4%2F2002+8%3A00+AM&cvsroot=%2Fcvsroot

Comment 7

[Mike Kaply [:mkaply]]

Got it.

This bug caused the regression:

http://bugzilla.mozilla.org/show_bug.cgi?id=147878

Comment 8

[Felix Miata]

The EBP=001318c0 FLG=00012206 traps I reported in bug 184833 began on 4 Dec at
21:00 EST after unzipping the PM OS/2 trunk build.

Comment 9

[Randell Jesup [:jesup] (needinfo me)]

Any non-OS/2 confirmations?

Comment 10

[Mike Kaply [:mkaply]]

I changed the bug to all because it happens on Windows as well.

I can recreate this bug at will on Windows and OS/2. I only used OS/2 to narrow
down the regression.

Comment 11

[Randell Jesup [:jesup] (needinfo me)]

Anything else that can help?  Asa and blizzard have tried to duplicate without
success using the latest 1.3a bits on Linux, XP and Mac.

Comment 12

[Mike Kaply [:mkaply]]

Did they use a new profile?

You have to get the security popups to see the failure?

I recreated at home on Windows nightly.

Comment 13

[Felix Miata]

I tried 2002121108 Linux. After typing elite in the search box and hitting
<enter> the result page loaded without asking me any questions about encryption.

Comment 14

[Felix Miata]

WFM in 2002121112 OS/2 as well.

Comment 15

[Mike Kaply [:mkaply]]

You have to get the popup to see the failure! Use a new profile or go to
preferences and check:

Sending form data from an unencrypted page to an unencrypted page.

Comment 16

[Felix Miata]

I just retried with that pref set. On Linux I unchecked "alert me . . ." in the
modal before OK and got no crash. On OS/2 I left "alert me . . ." checked and
got the crash. I retried another user on Linux and left "alert me . . ." checked
and again got no crash. However, Linux did not display the modal the second time
as indicated by the reporter, while OS/2 did. Another difference is that on
Linux, setting that pref resulted in all 8 checkboxes checked in SSL prefs,
while in OS/2, only boxes 1, 2, 3, & 7 were checked.

Comment 17

[Alexandru Savulov]

yep, was able to repro with a new profile. on it.

Comment 18

[Alexandru Savulov]

Attachment: fix

this will fix the crash and correct the code.

Comment 19

[Alexandru Savulov]

Comment on attachment 109212 [details] [diff] [review]
fix

dude, that was my foult

Comment 20

[Alexandru Savulov]

this will get fixed by the patch for bug 184207.

Comment 21

[John Keiser (jkeiser)]

We really plan to fix this, it's just dependent on that other bug, which
contains the this fix.

To my great regret, however, I cannot reproduce this bug.

Comment 22

[John Keiser (jkeiser)]

Someone else is going to have to verify that this is fixed in tomorrow's build
(12/14/2002).  I could not reproduce for some reason.

Comment 23

[Max Alekseyev]

OS/2 build 2002121512 works fine.

Comment 24

[Felix Miata]

v fixed

No second modal any more either! ;-)