20942 - Using tab key in form fields causes stack overflow

Status: VERIFIED WORKSFORME

(Core :: Layout: Form Controls, defect, P3)

Description

[ppandit]

I have reproduced this problem on Windows NT 4.0 three times.
Twice using today's release build and once using a debug build from 11/2/99.
In each case, the error was different.

1) Start mozilla
2) Go to www.visto.com
3) Enter ppandit in the Username field
4) Press TAB key to go to password field
5) Crash
a) First try - release build - Unhandled exception in mozilla.exe (XPCOM.DLL)
0xC00000FD. Stack Overflow.
b) Debug build - Unhandled exception in mozilla.exe (JSDOM.DLL) xC00000FD. See
trace below for beginning of trace. Actual trace is in attachment.
c) Second try - release build - Unhandled exception in mozilla.exe (RDF.DLL)
0xC0000FD

GetHTMLDocumentProperty(JSContext * 0x026ceb80, JSObject * 0x02362f60, long -17,
long * 0x00033d70) line 98 + 3 bytes
js_GetProperty(JSContext * 0x026ceb80, JSObject * 0x02362f60, long 41032800,
long * 0x00033d70) line 1853 + 123 bytes
js_Interpret(JSContext * 0x026ceb80, long * 0x00033f00) line 2182 + 1055 bytes
js_Invoke(JSContext * 0x026ceb80, unsigned int 0, unsigned int 0) line 681 + 13
bytes
js_Interpret(JSContext * 0x026ceb80, long * 0x0003472c) line 2226 + 15 bytes
js_Invoke(JSContext * 0x026ceb80, unsigned int 1, unsigned int 2) line 681 + 13
bytes
js_InternalCall(JSContext * 0x026ceb80, JSObject * 0x00dc6500, long 37105288,
unsigned int 1, long * 0x000348a8, long * 0x00034850) line 758 + 15 bytes
JS_CallFunction(JSContext * 0x026ceb80, JSObject * 0x00dc6500, JSFunction *
0x02bd3460, unsigned int 1, long * 0x000348a8, long * 0x00034850) line 2720 + 32
bytes
nsJSContext::CallFunction(nsJSContext * const 0x026ced10, void * 0x00dc6500,
void * 0x02bd3460, unsigned int 1, void * 0x000348a8, int * 0x000348a4) line 466
+ 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x02ca3fc4) line 133 + 51 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x026d6350,
nsIDOMEvent * 0x02ca3fc4, unsigned int 4) line 617 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x02a6e630, nsEvent *
0x00034d08, nsIDOMEvent * * 0x00034c78, unsigned int 7, nsEventStatus *
0x00034d30) line 1096 + 31 bytes
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x02a6e630, nsEvent *
0x00034d08, nsIDOMEvent * * 0x00034c78, unsigned int 1, nsEventStatus *
0x00034d30) line 795
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x026d6640,
nsIPresContext * 0x02a6e630, nsEvent * 0x00034d08, nsIDOMEvent * * 0x00000000,
unsigned int 1, nsEventStatus * 0x00034d30) line 643 + 31 bytes
nsEnderEventListener::Blur(nsIDOMEvent * 0x02ca2074) line 3400
nsEventListenerManager::HandleEvent(nsIPresContext * 0x02a6e630, nsEvent *
0x0003502c, nsIDOMEvent * * 0x00034eec, unsigned int 7, nsEventStatus *
0x0003504c) line 983 + 17 bytes
nsDocument::HandleDOMEvent(nsDocument * const 0x02a98e80, nsIPresContext *
0x02a6e630, nsEvent * 0x0003502c, nsIDOMEvent * * 0x00034eec, unsigned int 1,
nsEventStatus * 0x0003504c) line 2417
nsEventStateManager::SendFocusBlur(nsEventStateManager * const 0x01948270,
nsIPresContext * 0x02a6e630, nsIContent * 0x026d4e90) line 1984
nsEventStateManager::SetContentState(nsEventStateManager * const 0x01948270,
nsIContent * 0x026d4e90, int 2) line 1829
nsHTMLInputElement::SetFocus(nsHTMLInputElement * const 0x026d4e98,
nsIPresContext * 0x02a6e630) line 561
nsHTMLInputElement::Focus(nsHTMLInputElement * const 0x026d4e80) line 539 + 25
bytes
HTMLInputElementFocus(JSContext * 0x026ceb80, JSObject * 0x02362f88, unsigned
int 0, long * 0x00d6f538, long * 0x000352c0) line 879 + 15 bytes
js_Invoke(JSContext * 0x026ceb80, unsigned int 0, unsigned int 0) line 665 + 26
bytes
js_Interpret(JSContext * 0x026ceb80, long * 0x00035b30) line 2226 + 15 bytes
js_Invoke(JSContext * 0x026ceb80, unsigned int 0, unsigned int 0) line 681 + 13
bytes
js_Interpret(JSContext * 0x026ceb80, long * 0x0003635c) line 2226 + 15 bytes
js_Invoke(JSContext * 0x026ceb80, unsigned int 1, unsigned int 2) line 681 + 13
bytes
js_InternalCall(JSContext * 0x026ceb80, JSObject * 0x00dc6500, long 37105288,
unsigned int 1, long * 0x000364d8, long * 0x00036480) line 758 + 15 bytes
JS_CallFunction(JSContext * 0x026ceb80, JSObject * 0x00dc6500, JSFunction *
0x02bd3460, unsigned int 1, long * 0x000364d8, long * 0x00036480) line 2720 + 32
bytes

Comment 1

[ppandit]

Attachment: Most of the trace

Comment 2

[ppandit]

Adding lchiang to cc list.
I am willing to be QA Contact for this if Chris wants to pass to me.

Comment 3

[karnaze (gone)]

Norris, I'm not sure who should get this.

Comment 4

[Norris Boyd]

Tom, is this yours?

Comment 5

[rods (gone)]

works for me with todays build, focus rendering is still wrong, but that is a
known problem.

Comment 6

[ckritzer (gone)]

Marking VERIFIED FIXED on:
- Linux6 2000-02-01-10 Commercial build
- Win98 2000-02-01-08 Commercial build
- MacOS86 2000-02-01-09 Commercial build

Comment 7

[Luis Villa]

I'm seeing this bug again. To reproduce:
1. Open Mozilla, and go to this bug.
2. Go to the QA Contact line above.
3. Hit the tab key.
4. Watch Moz crash.
I can get this nine times out of ten (or more so- have done it reliably 7
consecutive times now, and have seen it on several other pages.)

Clicking around the same form fields works fine.

Build: 2000040708
Platform: Debian Linux (woody), 2.2.14 SMP kernel.

I'm not sure if this is a stack overflow problem, but this seemed to be a very
similar bug so I filed it here instead of duping it.