Closed Bug 5897 Opened 25 years ago Closed 25 years ago

Browser terminates when submitting a form

Categories

(Core :: Layout, defect, P3)

Product:
Core
Component:
Layout
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED WORKSFORME

People

(Reporter: morse, Assigned: nisheeth_mozilla)

References

Details

Submit the following form from a file url and the browser appears to crashes.
From a network url it works fine.

<html>
  <body>
    <form method=POST >
      <input type="text">
      Click here<input type="submit" value="crash">
    </form>
  </body>
</html>

Now the crash is really only an assertion failure but if you try to continue
execution from that point you get another crash.  If you continue from that
second crash, the browser terminates.  The stack traces for both crashes are
shown below:

This of course was done with a debug build.  Although I haven't tried it, I
would assume that a release build would simply terminate.


FIRST CRASH:


NTDLL! 77f76148()
net_check_file_type(_ActiveEntry * 0x012be460) line 281 + 20 bytes
net_ProcessFile(_ActiveEntry * 0x012be460) line 1291 + 9 bytes
net_FileLoad(_ActiveEntry * 0x012be460) line 1273 + 9 bytes
NET_GetURL(URL_Struct_ * 0x0260ec20, int 102, MWContext_ * 0x012beda0, void
(URL_Struct_ *, int, MWContext_ *)* 0x00412f2c bam_exit_routine(URL_Struct_ *,
int, MWContext_ *)) line 2979 + 12 bytes
nsNetlibService::OpenStream(nsNetlibService * const 0x00fb42b0, nsIURL *
0x012bdf60, nsIStreamListener * 0x012bbf10) line 476 + 20 bytes
nsDocumentBindInfo::Bind(nsIURL * 0x012bdf60, nsIStreamListener * 0x00000000)
line 1835 + 23 bytes
nsDocumentBindInfo::Bind(const nsString & {...}, nsIPostData * 0x012cd8c0,
nsIStreamListener * 0x00000000) line 1798 + 16 bytes
nsDocLoaderImpl::LoadDocument(nsDocLoaderImpl * const 0x012ba250, const nsString
& {...}, char * 0x01c2bacc, nsIContentViewerContainer * 0x012b9510, nsIPostData
* 0x012cd8c0, nsISupports * 0x00000000, nsIStreamObserver * 0x012b9f20,
nsURLReloadType nsURLReload, const unsigned int 0) line 1103 + 21 bytes
nsWebShell::DoLoadURL(const nsString & {...}, char * 0x01c2bacc, nsIPostData *
0x012cd8c0, nsURLReloadType nsURLReload, const unsigned int 0) line 1535
nsWebShell::LoadURL(nsWebShell * const 0x012b9510, unsigned short * 0x012e08a0,
char * 0x01c2bacc, nsIPostData * 0x012cd8c0, int 1, nsURLReloadType nsURLReload,
const unsigned int 0) line 1616 + 28 bytes
nsWebShell::LoadURL(nsWebShell * const 0x012b9510, unsigned short * 0x012e08a0,
nsIPostData * 0x012cd8c0, int 1, nsURLReloadType nsURLReload, const unsigned int
0) line 1463
nsWebShell::HandleLinkClickEvent(nsIContent * 0x0126a2a0, nsLinkVerb
eLinkVerb_Replace, unsigned short * 0x012e08a0, unsigned short * 0x002c1148,
nsIPostData * 0x012cd8c0) line 2100
OnLinkClickEvent::HandleEvent() line 1934
HandlePLEvent(OnLinkClickEvent * 0x012ce6a0) line 1947
PL_HandleEvent(PLEvent * 0x012ce6a0) line 476 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00fb0220) line 437 + 9 bytes
_md_EventReceiverProc(void * 0x01540526, unsigned int 49307, unsigned int 0,
long 16450080) line 799 + 9 bytes
USER32

SECOND CRASH:

MSVCRTD! 1020a993()
MSVCRTD! 1020fe9a()
PR_Assert(char * 0x004a6160, char * 0x004a6134, int 281) line 483
net_check_file_type(_ActiveEntry * 0x012be460) line 281 + 20 bytes
net_ProcessFile(_ActiveEntry * 0x012be460) line 1291 + 9 bytes
net_FileLoad(_ActiveEntry * 0x012be460) line 1273 + 9 bytes
NET_GetURL(URL_Struct_ * 0x0260ec20, int 102, MWContext_ * 0x012beda0, void
(URL_Struct_ *, int, MWContext_ *)* 0x00412f2c bam_exit_routine(URL_Struct_ *,
int, MWContext_ *)) line 2979 + 12 bytes
nsNetlibService::OpenStream(nsNetlibService * const 0x00fb42b0, nsIURL *
0x012bdf60, nsIStreamListener * 0x012bbf10) line 476 + 20 bytes
nsDocumentBindInfo::Bind(nsIURL * 0x012bdf60, nsIStreamListener * 0x00000000)
line 1835 + 23 bytes
nsDocumentBindInfo::Bind(const nsString & {...}, nsIPostData * 0x012cd8c0,
nsIStreamListener * 0x00000000) line 1798 + 16 bytes
nsDocLoaderImpl::LoadDocument(nsDocLoaderImpl * const 0x012ba250, const nsString
& {...}, char * 0x01c2bacc, nsIContentViewerContainer * 0x012b9510, nsIPostData
* 0x012cd8c0, nsISupports * 0x00000000, nsIStreamObserver * 0x012b9f20,
nsURLReloadType nsURLReload, const unsigned int 0) line 1103 + 21 bytes
nsWebShell::DoLoadURL(const nsString & {...}, char * 0x01c2bacc, nsIPostData *
0x012cd8c0, nsURLReloadType nsURLReload, const unsigned int 0) line 1535
nsWebShell::LoadURL(nsWebShell * const 0x012b9510, unsigned short * 0x012e08a0,
char * 0x01c2bacc, nsIPostData * 0x012cd8c0, int 1, nsURLReloadType nsURLReload,
const unsigned int 0) line 1616 + 28 bytes
nsWebShell::LoadURL(nsWebShell * const 0x012b9510, unsigned short * 0x012e08a0,
nsIPostData * 0x012cd8c0, int 1, nsURLReloadType nsURLReload, const unsigned int
0) line 1463
nsWebShell::HandleLinkClickEvent(nsIContent * 0x0126a2a0, nsLinkVerb
eLinkVerb_Replace, unsigned short * 0x012e08a0, unsigned short * 0x002c1148,
nsIPostData * 0x012cd8c0) line 2100
OnLinkClickEvent::HandleEvent() line 1934
HandlePLEvent(OnLinkClickEvent * 0x012ce6a0) line 1947
PL_HandleEvent(PLEvent * 0x012ce6a0) line 476 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00fb0220) line 437 + 9 bytes
_md_EventReceiverProc(void * 0x01540526, unsigned int 49307, unsigned int 0,
long 16450080) line 799 + 9 bytes
U
Assignee: nisheeth → morse
I tested this on the M5 NT apprunner build and submitting the form did not crash
the browser.  Steve, please verify this and close out the bug if it no longer
exists.  I'm assigning this back to you.
Assignee: morse → nisheeth
Sorry Nisheeth, it still crashes for me.  I'm using a tip build that I pulled on
5-9.  Reassigning back to you.
Status: NEW → ASSIGNED
Target Milestone: M8
This is an edge case which I'll fix for M8...
Blocks: 7530
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → WORKSFORME
I just had Steve double check this off of the latest build.  This must have
gotten fixed by other changes.  Marking worksforme.
Status: RESOLVED → VERIFIED
Using the June 23rd build (1999062308), I can't reproduce the crash using the
example form.
You need to log in before you can comment on or make changes to this bug.