102569 - M094 crash on form submission [@ wallet_MapElement::~wallet_MapElement]

Status: VERIFIED WONTFIX

(Core :: DOM: Core & HTML, defect)

Description

[greer]

Windows M094 users are submitting talkback crashes at
wallet_MapElement::~wallet_MapElement. Most comments indicate it was in the
process of submitting a form, but this may need to be reassigned to another
component. 

Here is the stack and user comments:

wallet_MapElement::~wallet_MapElement   22 
Crash data range: 2001-09-20 to 2001-09-30
Build ID range: 2001091311 to 2001091311

Stack Trace: 

         wallet_MapElement::~wallet_MapElement
[d:\builds\seamonkey\mozilla\extensions\wallet\src\wallet.cpp  line 227]
         wallet_Clear  
[d:\builds\seamonkey\mozilla\extensions\wallet\src\wallet.cpp  line 847]
         wallet_InitializeURLList
[d:\builds\seamonkey\mozilla\extensions\wallet\src\wallet.cpp  line 2589]
         wallet_OKToCapture    
[d:\builds\seamonkey\mozilla\extensions\wallet\src\wallet.cpp  line
2740]
         WLLT_OnSubmit 
[d:\builds\seamonkey\mozilla\extensions\wallet\src\wallet.cpp  line 4032]
         nsWalletlibService::Notify
[d:\builds\seamonkey\mozilla\extensions\wallet\src\nsWalletService.cpp  line 214]
         nsFormFrame::OnSubmit 
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsFormFrame.cpp
line 894]
         nsHTMLFormElement::DoSubmitOrReset
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp 
line 518]
         nsHTMLFormElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp 
line 462]
         PresShell::HandleDOMEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5708]
         nsFormControlHelper::DoManualSubmitOrReset
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsFormControlHelper.cpp  line
1002]
         nsImageControlFrame::MouseClicked
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsImageControlFrame.cpp  line
463]
         nsHTMLInputElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp 
line 1265]
         PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5660]
         PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5630]
         nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 2466]
         nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 1552]
         PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5681]
         PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp
line 5585]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp
 line 377]
         nsViewManager::DispatchEvent  
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp
line 2058]
         HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 68]
         nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 732]
         nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 749]
         nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4264]
         ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4514]
         nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3251]
         nsWindow::WindowProc  
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line
997]
         KERNEL32.DLL + 0x3613 (0xbff63613)
         KERNEL32.DLL + 0x248f7 (0xbff848f7)
         0x00688b62
         0x00058f64
 
        Source File : 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/extensions/wallet/src/wallet.cpp
line : 227
     (35945076) URL: pgp.com
     (35945076) Comments: filling in a form
     (35910684) URL: http://www.arschloch.de/anfrage.htm
     (35910684) Comments: submitted the form there
     (35871763) URL: www.mmnews.com
     (35850728) URL: techrepublic.com
     (35850728) Comments: preloading login form
     (35715010) URL: http://www.quest.com
     (35715010) Comments: attempting to fill out a form for an update of the SQL
Navigator product. Produced dump when I clicked the submit button.
     (35705856) Comments: viewing NY Times web site and a jsp app with selects
of ~1000 items

Most of the talkback data is from Win2000 users:

   2 Windows 98  4.10 build 67766446
   2 Windows 98  4.90 build 73010104
   1 Windows NT  4.0 build 1381
  16 Windows NT  5.0 build 2195
   1 Windows NT  5.1 build 2462

Comment 1

[chris hofmann]

this looks like steve (wallet module owner) should investigate as well.

steve, any ideas?

if this is a 0.9.4 regression we might want to get this fixed on the branch for n62

adding nsbranch until we learn more.

Comment 2

[Kevin McCluskey (gone)]

I am not able to reproduce the crash but it looks more like a wallet issue than
a form submission issue, since statcktrace indicates it's crashing in the
destructor of wallet_MapElement.

~wallet_MapElement()
  {
    if (itemList) {
      PRInt32 count = LIST_COUNT(itemList);
      wallet_Sublist * sublistPtr;
      for (PRInt32 i=0; i<count; i++) {
        sublistPtr = NS_STATIC_CAST(wallet_Sublist*, itemList->ElementAt(i));
        delete sublistPtr;
      }
      delete itemList;
    }
    MOZ_COUNT_DTOR(wallet_MapElement);
  }

Comment 3

[Jaime Rodriguez, Jr.]

-->morse

Comment 4

[Stephen P. Morse]

Marking 9.5 maily because I'm out this week and won't be able to focus on it 
until next week.  I will give it top priority when I return.

Comment 5

[Stephen P. Morse]

I sure could use a reproducible test case here.  I've now spent over a day 
studying the code and looking for a weak spot that could cause this crash but I 
haven't been able to spot any.  And although I tried everything I could think 
of, I was not able to demonstrate the crash.

Therefore changing milestone to 1.0, not because I don't think this is important 
but rather because I don't know what I can do about it.

If anyone can provide the following information, it might be helpful:
1. With what build did this crash first start being reported?
2. Is it occuring with later builds?  If not, when did it last occur?
3. Does anybody have a reproducible test case for demonstrating this?

Comment 6

[Peter Trudelle]

Vladimire, can you come up with a reproducible case?  Steve, is there any way to
bulletproof this particular crash without knowing the cause?

Comment 7

[Stephen P. Morse]

No, there's no way to bullet-proof it that I can see.  If there was, I would 
have submitted that patch.

Comment 8

[Peter Trudelle]

okay, changing to nsbranch-, we can't hold for stuff we can't reproduce.

Comment 9

[Vladimir Ermakov]

I cant reproduce this... so I cant make a testcase

Comment 10

[Stephen P. Morse]

Without a reproducible test case, there is nothing that can be done here.  
Marking wont-fix.

Comment 11

[Vladimir Ermakov]

verifying