76694 - search on e-bay gets reproducable crash - Trunk [@ nsXULElement::HandleDOMEvent]

Reporter

Description

•

23 years ago

go to ebay
enter somthing in the search field..  hit search... boom!

Incident ID 29333426 
 Trigger Time                 2001-04-19 10:51:46 
 Email Address                 chofmann@netscape.com 
 User Comments                 search on e-bay 
 Build ID                2001041906 
 Platform ID                Win32 

nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3529] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3654] 
nsXULElement::HandleChromeEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
4631] 
GlobalWindowImpl::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 569] 
nsDocument::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 2817] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1492] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line
429] 
nsHTMLFormElement::Submit 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 342] 
HTMLFormElementSubmit 
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLFormElement.cpp, line 427] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1034] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1590] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1506] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line
429] 
nsHTMLFormElement::Submit 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 342] 
HTMLFormElementSubmit 
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLFormElement.cpp, line 427] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1034] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1590] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1506] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line
429] 
nsHTMLFormElement::Submit 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 342] 
HTMLFormElementSubmit 
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLFormElement.cpp, line 427] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1034] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1590] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1506] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line
429] 
nsHTMLFormElement::Submit 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 342] 
HTMLFormElementSubmit 
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLFormElement.cpp, line 427] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155]

chris hofmann

Reporter

Comment 1

•

23 years ago

adding dr to cc list.  latest changes in the code 
around the area at the top of the stack are:

1.331 <dr@netscape.com> 03 Apr 2001 13:39
 fix for 40105. r=jst, sr=hyatt

I'm going to put this on the 0.9 radar since it 
may be highly visable for folks that might want 
to ship betas of the 0.9 milestone.   

let me know if thats dumb..

hyatt if this isn't your bug can you pass to the right 
person quickly?  thanks

Target Milestone: --- → mozilla0.9

chris hofmann

Reporter

Comment 2

•

23 years ago

*** Bug 76453 has been marked as a duplicate of this bug. ***

chris hofmann

Reporter

Updated

•

23 years ago

Keywords: crash, top100

Boris Zbarsky [:bzbarsky]

Comment 3

•

23 years ago

From bug 76453:

Seeing this on Linux build 2001-04-17-08 too.

Reading the JS, here's what's happening.  The form has a onSubmit handler that
does some parsing of the data in the form and unless it fits some _very_ narrow
constraints calls form.submit()

This gets us into an infinite recursion and eventually we just blow the runtime
stack.

For an even simpler testcase, try this:

<form onsubmit="this.submit(); return false;">

So it would seem that the right thing is to prevent a form from being submitted
from its own onsubmit handler... would that make sense?

What NS4.x seems to be doing is completely bypassing the onsubmit handler if
form.submit() is called inside the onsubmit handler.

OS: Windows 98 → All

Dan Rosen

Comment 4

•

23 years ago

choffman: my change to generic element was just for xbl anonymous content. seems
like bzbarsky is onto something, though... this probably isn't hyatt's bug.
who's the default owner for form submission?

Brendan Eich [:brendan]

Comment 5

•

23 years ago

*** Bug 76735 has been marked as a duplicate of this bug. ***

Brendan Eich [:brendan]

Comment 6

•

23 years ago

Yes more wisdom from the ages lost to the next generation! ;-)

http://lxr.mozilla.org/classic/source/lib/libmocha/lm_form.c#640

Reassigning to pollmann, cc'ing jst.

/be

Assignee: hyatt → pollmann

Eric Pollmann

Assignee

Comment 7

•

23 years ago

Attached patch patch, ignore recursive calls to submit and reset — Details — Splinter Review

Brendan Eich [:brendan]

Comment 8

•

23 years ago

Looks good to me, r=brendan@mozilla.org.

Putting on drivers' radar.

/be

Keywords: mozilla0.9

Whiteboard: important to mozilla0.9?

Eric Pollmann

Assignee

Comment 9

•

23 years ago

This patch fixes the crash but the ebay form no longer submits.  The failure to
submit is due to part of my checkin for bug 64702.  I will also have to back out
half of that patch to fix this problem.  Update coming...

Status: NEW → ASSIGNED

Eric Pollmann

Assignee

Comment 10

•

23 years ago

Attached patch patch, ignore recursive submit/reset, don't call event handlers on form.submit/reset — Details — Splinter Review

Mike Shaver (:shaver -- probably not reading bugmail closely)

Comment 11

•

23 years ago

Pollman: have you absorbed the libmocha wisdom fully, and protected against all
such event recursion?  It looks like that patch just checks for submit.

Boris Zbarsky [:bzbarsky]

Comment 12

•

23 years ago

*** Bug 77216 has been marked as a duplicate of this bug. ***

Eric Pollmann

Assignee

Comment 13

•

23 years ago

Mike, yes, this only checks for submit (and reset) recursion, it does not check
for mouse click, key press, ...  That seems like it would require a hash table
or at least a list and quite a bit more interesting logic (since event types are
no longer bits in a mask, having fun values like 1302), and nsHTMLFormElement is
certainly not the only element that is susceptible to that problem - the fix
should probably be made in a more generic place.

I reasoned that a change like that would be more time-consuming and risky than
needed for 0.9, and also fixed the source of the recursion, by backing out the
part of my old checkin that caused it.

Eric Pollmann

Assignee

Comment 14

•

23 years ago

Rod said: "r=rods@netscape.com"

Brendan Eich [:brendan]

Comment 15

•

23 years ago

I'll sr=brendan@mozilla.org on the last patch, provided you file a sequel bug
(cite it here via bug#) to generalize the recursion stopper per shaver's comment
-- deal?

/be

Jay Patel [:jay]

Comment 16

•

23 years ago

Added topcrash keyword and Trunk [@ nsXULElement::HandleDOMEvent] to summary for 
tracking.  This a topcrasher according to Talkback for recent Trunk builds.  
Here is some info from today's report:

nsXULElement::HandleDOMEvent   23 
     First BBID :29179844
     Last BBID  :29474025
     Min Runtime :37
     Max Runtime :36442
     First Appearance Date : 2001-04-16
     Last Appearance Date : 2001-04-22
     First BuildID : 2001041606
     Last BuildID : 2001042122

Stack Trace:
I didn't want to paste the stack here since it's identical to the one already 
posted. 

Source File :      
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xul/content/src/nsXU
LElement.cpp line : 3529

User Comments and URLS:
     (29462411) URL: www.aol.com
     (29462411) Comments: Tried to sign on to AOL Anywhere.  After entering 
password and clicking on GO
     (29462411) Comments: EBX=005933e4 SS=016f ESP=00591f44 
EBP=005920a0ECX=01d87da4 DS=016f ESI=014b2ab0 FS=0f67EDX=00592230 ES=016f 
EDI=00000000 GS=0000Bytes at CS:EIP:53 8b 5d 10 56 8b 75 08 57 33 ff f6 45 18 01 
89 Stack dump:00000000 00000000 00000000 00000000
     (29462411) Comments:  00000000 00000000 00000000 00000000 00000000 00000000 
00000000 00000000 00000000 00000000 00000000 00000000 
     (29448732) Comments: using a search textfield at zdnet
     (29443304) Comments: trying ebay search.
     (29386491) URL: http://www.ebay.com
     (29386491) Comments: Typed search text into the seach text entry area and 
hit the return key. Instant core/bus fault.
     (29333426) Comments: search on e-bay
     (29326952) Comments: checking merrill lynch account
     (29293361) URL: www.rational.com/accountink
     (29237713) URL: www.ebay.com
     (29237713) Comments: Attempting to search for an item from the main page
     (29179844) Comments: trying to set a bug ID on cylcone

Keywords: topcrash

Summary: search on e-bay gets reproducable crash → search on e-bay gets reproducable crash - Trunk [@ nsXULElement::HandleDOMEvent]

Eric Pollmann

Assignee

Comment 17

•

23 years ago

I filed a new bug for the generic event recursion problem as bug 77271.  (Thanks
for the r=/sr=!)

Asa Dotzler [:asa]

Comment 18

•

23 years ago

a= asa@mozilla.org for checkin to 0.9

Brendan Eich [:brendan]

Comment 19

•

23 years ago

*** Bug 77267 has been marked as a duplicate of this bug. ***

Eric Pollmann

Assignee

Comment 20

•

23 years ago

Fix checked in.  To verify, type a search term in to the main search form at
http://ebay.com, then click Search.  This should not cause a crash.  Thanks!

Status: ASSIGNED → RESOLVED

Closed: 23 years ago

Resolution: --- → FIXED

Vladimir Ermakov

Comment 21

•

23 years ago

Verifying on windows 98 build 2001-04-24-04-trunk

Status: RESOLVED → VERIFIED

Phil Schwartau

Comment 22

•

23 years ago

*** Bug 77504 has been marked as a duplicate of this bug. ***

Mike Shaver (:shaver -- probably not reading bugmail closely)

Comment 23

•

23 years ago

*** Bug 78049 has been marked as a duplicate of this bug. ***

Christine Hoffman

Comment 24

•

23 years ago

Tested on Win98 (05_24_06) and Mac (05_24_05). Still crashing. Reopening bug. Is 
this a dup of 77249?

Status: VERIFIED → REOPENED

Resolution: FIXED → ---

Christine Hoffman

Updated

•

23 years ago

Keywords: nsbeta1

Kevin McCluskey (gone)

Updated

•

23 years ago

Target Milestone: mozilla0.9 → mozilla0.9.1

doctor__j

Comment 25

•

23 years ago

WFM on Win32 build 2001052404.  Strange...

Eric Hedström

Comment 26

•

23 years ago

5/23 builds were crashing all over here, but 2001052406 on win2k worksforme.

you may need to install cleanly with a new profile, etc.

Vladimir Ermakov

Comment 27

•

23 years ago

This works for me on 2001-05-24-09-trunk windows 98.

Status: REOPENED → RESOLVED

Closed: 23 years ago → 23 years ago

Resolution: --- → FIXED

chris hofmann

Reporter

Comment 28

•

23 years ago

Incident ID 30870242
Trigger Time 2001-05-24 13:14:57
Email Address chofmann@netscape.com
Client IP Address 208.12.37.181
User Comments
 search on ebay crash is back... oh boy...\
 ...about a lucky browser that made the grade
... and though the news was rather sad,
 I just had to laugh having read the booooooook
 I love to turn talk baccckk on!!!!! 

woke up.. got out of bed... ran the

Build ID 2001052409
Product ID MozillaTrunk
Platform ID Win32
Stack Trace
PlaceFrameView
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2516]
nsBlockFrame::PostPlaceLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 4090]
nsBlockFrame::PlaceLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3952]
nsBlockFrame::DoReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3418]
nsBlockFrame::DoReflowInlineFramesAuto
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3269]
nsBlockFrame::ReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3215]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2337]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 813]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableRowFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 888]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1249]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableRowGroupFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 378]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1047]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2945]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1807]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 986]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1530]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
CanvasFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 579]
nsBoxToBlockAdaptor::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxToBlockAdaptor.cpp, line 869]
nsBoxToBlockAdaptor::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxToBlockAdaptor.cpp, line 525]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 985]
nsScrollBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsScrollBoxFrame.cpp, line 379]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 985]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 595]
nsGfxScrollFrameInner::LayoutBox
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1039]
nsGfxScrollFrameInner::Layout
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1149]
nsGfxScrollFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1047]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 985]
nsBoxFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 781]
nsGfxScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 738]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 538]
nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line 145]
PresShell::ProcessReflowCommand
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5712]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5767]
ReflowEvent::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5625]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]

Status: RESOLVED → REOPENED

Resolution: FIXED → ---

Matthias Versen [:Matti]

Comment 29

•

23 years ago

Chris: Is your stack not a dupe of bug 81905 ?

Vladimir Ermakov

Comment 30

•

23 years ago

Interesting... I search for "trash" and "something" no crash, if I search for 
"test" then crash... same build... I was able to reproduce it...

Chris Waterson

Comment 31

•

23 years ago

Matti: yeah, the stack trace pasted above (ending in PostPlaceLine()) looks like
bug 81905.

chris hofmann

Reporter

Comment 32

•

23 years ago

what the man said.  I'll close this and put a comment in bug 81905

that ebay search is another test case, all though that test seems
to generate random crashes.

Status: REOPENED → RESOLVED

Closed: 23 years ago → 23 years ago

Resolution: --- → FIXED

Vladimir Ermakov

Comment 33

•

23 years ago

This isnt fixed, its a duplicate

Status: RESOLVED → REOPENED

Resolution: FIXED → ---

Vladimir Ermakov

Comment 34

•

23 years ago


*** This bug has been marked as a duplicate of 81905 ***

Status: REOPENED → RESOLVED

Closed: 23 years ago → 23 years ago

Resolution: --- → DUPLICATE

Vladimir Ermakov

Comment 35

•

23 years ago

verifying duplicate

Status: RESOLVED → VERIFIED

Eric Pollmann

Assignee

Comment 36

•

23 years ago

In fact, to clarify things, the original bug here was indeed fixed (crash and
nsXULElement::HandleDOMEvent).  The correct resolution is FIXED, and the other
bug (crash in nsBlockFrame) is a separate, unrelated issue, of which the
original bug is not a duplicate.

Status: VERIFIED → REOPENED

Resolution: DUPLICATE → ---

Eric Pollmann

Assignee

Comment 37

•

23 years ago

Fixed (one bug, one issue - makes things easier to track...  :) )

Status: REOPENED → RESOLVED

Closed: 23 years ago → 23 years ago

Hardware: PC → All

Resolution: --- → FIXED

Target Milestone: mozilla0.9.1 → mozilla0.9

Vladimir Ermakov

Comment 38

•

23 years ago

Ok, sounds good to me, verifying

Status: RESOLVED → VERIFIED

Edward Kandrot

Comment 39

•

23 years ago

*** Bug 77249 has been marked as a duplicate of this bug. ***

Nobody; OK to take it and work on it

Updated

•

13 years ago

Crash Signature: [@ nsXULElement::HandleDOMEvent]

Nobody; OK to take it and work on it

Updated

•

5 years ago

Component: HTML: Form Submission → DOM: Core & HTML

patch, ignore recursive calls to submit and reset 23 years ago Eric Pollmann 1.88 KB, patch		Details \| Diff \| Splinter Review
patch, ignore recursive submit/reset, don't call event handlers on form.submit/reset 23 years ago Eric Pollmann 6.33 KB, patch		Details \| Diff \| Splinter Review