Closed Bug 88343 Opened 24 years ago Closed 24 years ago

Crash when selecting "Back" from the "Go" menu - Trunk, M092 & N610 [@ nsListControlFrame::SetContentSelected]

Categories

(Core :: Layout: Form Controls, defect)

Product:
Core
Component:
Layout: Form Controls
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla0.9.3

People

(Reporter: kleist, Assigned: dcone)

References

(
URL
)

Details

(Keywords: crash, topcrash, Whiteboard: PDT+)

Crash Data

Attachments

(2 files)

Patch to fix the crash.
1.33 KB, patch
Details | Diff | Splinter Review
Better patch
1.37 KB, patch
Details | Diff | Splinter Review
Incident ID: TB32313682E (why can't I copy-paste this one from the Agent???) Build ID: 2001062504 RECIPE: 1. Visit "http://www.bostad.dn.se/bostadsborsen/", click the link "Mäklarnas utbud" at the top of the sidebar 2. In the ComboBox "1. Välj län:", select "Östergötland". 3. In the ComboBox "2. Välj kommun:", select "Söderköping". 4. Press the OK button. 5. From the "Go" menu, select "Back". Now Mozilla crashes.
Keywords: crash
Build: 2001062804 I can't reproduce this on my Win 2k install... Have you tried a newer build?
Verified. Browser crashes on RH Linux 7.1 , Mozilla build 2001062814. Incident ID.: TB32314561Q (Program Exception)
Status: UNCONFIRMED → NEW
Ever confirmed: true
Confirmed, win95 build 2001062704 Changed os to All. --- MOZILLA ha provocato un errore di pagina non valida nel modulo GKLAYOUT.DLL in 0137:603c290b. Registri: EAX=00000000 CS=0137 EIP=603c290b EFLGS=00010246 EBX=00000000 SS=013f ESP=006880a4 EBP=006880b0 ECX=026674e0 DS=013f ESI=00000000 FS=0e37 EDX=02a63470 ES=013f EDI=026674e0 GS=0000 Byte all'indirizzo CS:EIP: 8b 06 56 ff 50 08 8b 45 fc 50 8b 08 ff 51 08 5e Immagine dello stack: 026674e0 80000000 02a63470 00688108 603c2d73 00000007 00000001 00000001 00000000 00688344 026674e0 02667574 60efc458 02a53b80 00000000 02a53b80
Confirmed, mandrake 8, build 2001062814 Incident ID: TB32324813V Does it take all steps to reproduce this? Mark all/all please
Mozilla 0.9.1 Mozilla/5.0 (X11; U; Linux 2.4.3-20mdk i686; en-US; rv:0.9.1) Gecko/20010611 --> It doesn't crash with this release. The bug must have been introduced later since Leon use a later version than I.
Incident ID 32313682 Stack Signature nsListControlFrame::SetContentSelected 716ca58d Bug ID Trigger Time 2001-06-28 23:56:27 User Comments selected "Back" from the "Go" menu, see bug report for details Build ID 2001062509 Product ID MozillaTrunk Platform ID Win32 Stack Trace nsListControlFrame::SetContentSelected [d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line 2004] nsListControlFrame::ResetList [d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line 2253] nsListControlFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line 695] nsLineLayout::ReflowFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp, line 956] nsBlockFrame::ReflowInlineFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3460] nsBlockFrame::DoReflowInlineFrames [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3344] nsBlockFrame::DoReflowInlineFramesMalloc [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3248] nsBlockFrame::ReflowInlineFrames [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3210] nsBlockFrame::ReflowLine [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2337] nsBlockFrame::ReflowDirtyLines [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027] nsBlockFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableCellFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 771] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableRowFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 879] nsTableRowFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1240] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableRowGroupFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, line 378] nsTableRowGroupFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, line 1047] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2951] nsTableFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1808] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableOuterFrame::OuterReflowChild [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 970] nsTableOuterFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1514] nsBlockReflowContext::DoReflowBlock [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line 559] nsBlockReflowContext::ReflowBlock [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line 343] nsBlockFrame::ReflowBlockFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960] nsBlockFrame::ReflowLine [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223] nsBlockFrame::ReflowDirtyLines [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027] nsBlockFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableCellFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 771] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableRowFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 879] nsTableRowFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1240] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableRowGroupFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, line 378] nsTableRowGroupFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, line 1047] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2951] nsTableFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1808] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableOuterFrame::OuterReflowChild [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 970] nsTableOuterFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1514] nsBlockReflowContext::DoReflowBlock [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line 573] nsBlockReflowContext::ReflowBlock [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line 343] nsBlockFrame::ReflowBlockFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960] nsBlockFrame::ReflowLine [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223] nsBlockFrame::ReflowDirtyLines [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027] nsBlockFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableCellFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 771] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableRowFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 879] nsTableRowFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1240] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableRowGroupFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, line 378] nsTableRowGroupFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, line 1047] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableFrame::ReflowChildren [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2951] nsTableFrame::Reflow [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1808] nsContainerFrame::ReflowChild [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 747] nsTableOuterFrame::OuterReflowChild [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 970]
Assignee: asa → rods
Component: Browser-General → HTML Form Controls
QA Contact: doronr → madhur
Marking all/all for now. Mac users, are you able to reproduce?
Keywords: nsBranch
Target Milestone: --- → mozilla0.9.3
Reassigning to Don, since Rod is unavailable.
Assignee: rods → dcone
2001062914 trunk for MacOS9 crashed with the same stack trace.
OS: Windows 2000 → All
Hardware: PC → All
This stacktrace looks similar to bug 86519.
cc'ing talkback. Adding topcrash keyword and sig in the summary. FWIW, here are the days comments from Windows reports (Mac and Lin are not out yet): (32583384) Comments: 00000000 02f545c0 Netscape crashed when I was deletinga file (pdf) on a remote (local) server with a PHP script. It was done by: @unlink ( $imgid ); . (32579960) URL: www.viatech.com (32579960) Comments: Hitting the "Back" button (32520458) URL: www.workopolis.com -> e-cruiter.com (32520458) Comments: had gone back to view information on a previous page and returned to a large Job application form. (32432666) Comments: noodling around on the Dialpad pages. (32404361) URL: http://www.ricardo.de/ (32404361) Comments: Tried to open an auction (32355862) Comments: I was using the Gist website to translate a page from russian to french.
Keywords: topcrash
Summary: Crash when selecting "Back" from the "Go" menu → Crash when selecting "Back" from the "Go" menu [@ nsListControlFrame::SetContentSelected]
This is a topcrasher for Mozilla 0.9.2 (adding Trunk & M092 to summary). Here are some user comments and urls for crashes happening with M092: (32579960) URL: www.viatech.com (32579960) Comments: Hitting the "Back" button (32566963) URL: www.rci.com (32566963) Comments: moving from one page to another (32563212) URL: thingamajob.com (32563212) Comments: using the 'back' button (32558855) URL: www.thingamajob.com (32520458) URL: www.workopolis.com -> e-cruiter.com (32520458) Comments: had gone back to view information on a previous page and returned to a large Job application form. (32503733) Comments: using back button (32503652) Comments: using the "back" button (32475021) Comments: I used javascript to submit a form - this seems not to be reproducable though (32463875) URL: http://www.boligzonen.dk/ --> "Sog i boligen" (32459393) URL: www.linuxprinting.org (32459393) Comments: Pressed back button after reading about HP Laserjet 4L (32459338) URL: www.linuxprinting.org (32459338) Comments: Pressed the back button after reading about the Brother MC-3000 (32454387) URL: http://www.yahoo.com (32454387) Comments: Did nothing...it just closed for some unknown reason... (32442090) Comments: Cannot use the CONTINUE button on the list item page in eBay. (32432666) Comments: noodling around on the Dialpad pages. (32414246) URL: www.tradingroom.com.au (32414246) Comments: Followed link to job search (32404361) URL: http://www.ricardo.de/ (32404361) Comments: Tried to open an auction (32403258) Comments: building a web based application (32402023) URL: www.faircar.de (32402023) Comments: reproducable - search for a car (32392023) URL: www.lineadirecta.com (32392023) Comments: The same error again: when I press the back button three times (32381731) URL: somewhere in www.toshiba.com (32381731) Comments: hit the back button (32373278) Comments: Was using the back-menu to switch back to the first site (which is www.gloth.net) for me. (32371763) URL: linuxprinting.org (32371763) Comments: clicked BACK to return to the Lexmark Optra Color 40 page from the Postscript link on that page. Booooom! (32365358) Comments: I was running mozilla-0.9.2 right after the installation procedure (it hadstarted up automatically). I had windows open for these 3 websites:www.kde.org (32365358) Comments: www.roomsaver.com (32364913) URL: http://www.nokia.com (32364913) Comments: i was browsing their job openings (32355862) Comments: I was using the Gist website to translate a page from russian to french. It sucks... I could only choose french as my destination language. The stack for M092 crashes are the same as the one Asa posted. Has anyone been able to reproduce this with the latest BRANCH builds?
Summary: Crash when selecting "Back" from the "Go" menu [@ nsListControlFrame::SetContentSelected] → Crash when selecting "Back" from the "Go" menu - Trunk & M092 [@ nsListControlFrame::SetContentSelected]
*** Bug 89924 has been marked as a duplicate of this bug. ***
*** Bug 89743 has been marked as a duplicate of this bug. ***
*** Bug 89387 has been marked as a duplicate of this bug. ***
*** Bug 88724 has been marked as a duplicate of this bug. ***
I have seen this crash a few times with the latest branch builds, so adding N610 to summary for tracking: 32751309 2001-07-10 17:37:41 nsListControlFrame::SetContentSelected 73f3b19a URL: http://kirkpp/Signup Comments: I had already created an account and successfully saved an appointment. So I went back to the bug 88333 to see if there were any other steps that I needed to do...there were not, so I just clicked the forward button a couple of times and I guess while it was trying to access the cache, n6 just crashed on me. Sys Info: Netscape6.10 Windows NT 4.0 build 1381 2001071005 717 6651 32750822 2001-07-10 17:22:25 nsListControlFrame::SetContentSelected 73f3b19a URL: my calender? Comment: i was reproducing some topcrash refreshing a calender page, will get the bug number next time. Sys Info: Netscape6.10 Windows NT 4.0 build 1381 2001071005 5934 5934 32415535 2001-07-01 23:53:44 nsListControlFrame::SetContentSelected 208253aa URL: www.fool.com Comments: i made some changes to the view of my portfolio and submitted the changes. on the next screen i clicked the back button and boom! Sys Info: Netscape6.10 Windows 98 4.10 build 67766446 The easiest steps to reproduce this crash is to follow these instructions from bug 88333: ------- Additional Comments From vladimire@netscape.com 2001-07-02 15:40 ------- I am able to reproduce the refreshing bug on windows 98 and 2000. On 2000 the State pulldown menu doesnt work, but it does on 98. On 98 the Start My Calendar doesnt work, but it does on 2000. Steps to reproduce this crash: 1) goto http://kirkpp/Calendar, get redirected to backdoorsignin 2) put in some name for screen name click "Submit Query" 2.5 (optional)) try to pull down the State menu 3) Hit the refresh button, and wait several seconds. For me it happens 100% of the time.
Summary: Crash when selecting "Back" from the "Go" menu - Trunk & M092 [@ nsListControlFrame::SetContentSelected] → Crash when selecting "Back" from the "Go" menu - Trunk, M092 & N610 [@ nsListControlFrame::SetContentSelected]
*** Bug 90346 has been marked as a duplicate of this bug. ***
In nsListControlFrame::SetContentSelected the following assert was hit, seems that the number of options is less that its supposed to be. NS_ASSERTION(0, "Bad Index has been passed into SetContentSelected!"); If the list box is being added to with script, the history may not re-execute this script and the history and the document loaded may not align.. causing a crash. I will investigate more.
Attached patch Better patch — — Splinter Review
This patch will fix the crash. I change the mSelectedIndex to kNothingSelected then return. Tested the crash and it no longer happens. I looked at changin the passed in value but there are loops and endless loops would happen. I even looked at changing the index to 0 but then thought an unpopulated list would still crash but this test case would work. I think this solution is the best. This is a topcrash so a quickreview and approval is needed to get this into the branch.
r=peterl
sr=karnaze. The comment is a bit verbose. You could change it to. + // check to see that the index is in the proper range. It could be + // out of range due to something like a back button being hit and the + // script that populates the list box not being executed (eg bug 88343)
PDT+, we'll take this on the branch. It sure looks like your ifdef'd printf can't be reached due to the return statement though...
Whiteboard: PDT+
Yes.. your right.. I moved the return past the end of the ifdef. Thanx
Checked into the trunk and the .92 branch.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
*** Bug 90529 has been marked as a duplicate of this bug. ***
*** Bug 90719 has been marked as a duplicate of this bug. ***
verified fixed in window2000 and macOS 8.6 -- build id : 2001-07-16 branch.
Keywords: vtrunk
sorry - i entered my comments under the wrong login name. verified fixed in window2000 and macOS 8.6 -- build id : 2001-07-16 Branch
*** Bug 89788 has been marked as a duplicate of this bug. ***
Verified Build 2001071604 os:win98 Build 2001071704 os:winNT Build 2001071604 os:win95
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsListControlFrame::SetContentSelected]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: