122511 - crash when running w3 dom testsuite

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect, P1)

Description

[Sivakiran Tummala]

Netscape6/6.2.1+
BuildID:    2001-02-29-10

crashed when running the w3 dom level2 html testsuite. 
Reason: Illegal access of memory.

Stack Trace attached.

nsHTMLSelectElement::SetOptionsSelectedByIndex
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1324]
nsHTMLSelectElement::SetSelectedIndex
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 961]
nsHTMLSelectElement::SelectSomething
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1627]
nsHTMLSelectElement::CheckSelectSomething
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1597]
nsHTMLSelectElement::InsertOptionsIntoList
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 473]
nsHTMLSelectElement::WillAddOptions
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 668]
nsHTMLOptGroupElement::AppendChildTo
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLOptGroupElement.cpp,
line 265]
nsXMLContentSink::HandleStartElement
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLContentSink.cpp, line
1294]
nsExpatDriver::HandleStartElement
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 270]
Driver_HandleStartElement
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 71]
doContent [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 1406]
contentProcessor [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 1101]
doProlog [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 2389]
prologProcessor [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 2243]
prologInitProcessor [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line
2232]
XML_Parse [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 921]
nsExpatDriver::ParseBuffer
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 629]
nsExpatDriver::ConsumeToken
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 740]
nsParser::Tokenize [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2589]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1847]
nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2474]
nsStreamListenerTee::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 57]
nsHttpChannel::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2495]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 203]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 308]
netscp6.exe + 0x1f95 (0x00401f95)
netscp6.exe + 0x1b45 (0x00401b45)
netscp6.exe + 0x3254 (0x00403254)
KERNEL32.DLL + 0x7903 (0x77e87903) 


Reproducible: Sometimes.nsHTMLSelectElement::SetOptionsSelectedByIndex
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1324]
nsHTMLSelectElement::SetSelectedIndex
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 961]
nsHTMLSelectElement::SelectSomething
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1627]
nsHTMLSelectElement::CheckSelectSomething
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1597]
nsHTMLSelectElement::InsertOptionsIntoList
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 473]
nsHTMLSelectElement::WillAddOptions
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 668]
nsHTMLOptGroupElement::AppendChildTo
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLOptGroupElement.cpp,
line 265]
nsXMLContentSink::HandleStartElement
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLContentSink.cpp, line
1294]
nsExpatDriver::HandleStartElement
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 270]
Driver_HandleStartElement
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 71]
doContent [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 1406]
contentProcessor [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 1101]
doProlog [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 2389]
prologProcessor [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 2243]
prologInitProcessor [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line
2232]
XML_Parse [d:\builds\seamonkey\mozilla\expat\xmlparse\xmlparse.c, line 921]
nsExpatDriver::ParseBuffer
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 629]
nsExpatDriver::ConsumeToken
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 740]
nsParser::Tokenize [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2589]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1847]
nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2474]
nsStreamListenerTee::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 57]
nsHttpChannel::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2495]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 203]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 308]
netscp6.exe + 0x1f95 (0x00401f95)
netscp6.exe + 0x1b45 (0x00401b45)
netscp6.exe + 0x3254 (0x00403254)
KERNEL32.DLL + 0x7903 (0x77e87903) 

Steps to Reproduce:
1.load the url http://10.169.102.152/dom/lib/jsunit/testRunner.html
2. Run the DoM level2 HTML suite.
3. Dismiss alerts if any.
4. Crashes.

Comment 1

[Johnny Stenback (:jst)]

John, looks like this one might be yours, could you have a look?

Comment 2

[Sivakiran Tummala]

changing the priority to P2. Visibility is med/low

Comment 3

[Johnny Stenback (:jst)]

Hmm, I get an error from the tests that it can't find 
kajal/dom/build/ecmascript/level2/html/alltests.html, Sivakiran, any ideas?

Comment 4

[Sivakiran Tummala]

fully qualified domain name was required, 

kajal.mcom.com/dom/build/ecmascript/level2/html/alltests.html

Comment 5

[Sivakiran Tummala]

crashed on 02-04 build at Run # 302

Comment 6

[Fabian Guisset]

crash -> Severity: critical. Sending over to HTML Form Controls.

Comment 7

[Kevin McCluskey (gone)]

Marking nsbeta1+. Set Milestone to Moz1.0

Comment 8

[John Keiser (jkeiser)]

*** Bug 123086 has been marked as a duplicate of this bug. ***

Comment 9

[John Keiser (jkeiser)]

Hey, how do I do step 2?

Comment 10

[Sivakiran Tummala]

The url in step 1, explains.

Comment 11

[John Keiser (jkeiser)]

oops, missed that.  It's timing out for both JST and myself.  I'll try again later.

Comment 12

[John Keiser (jkeiser)]

OK, I've narrowed it down to which test, and am currently trying to figure out
how to get the source for that test.  Instead of entering the tests provided,
enter
"kajal.mcom.com/dom/build/ecmascript/level2/html/HTMLSelectElement04.html".  It
fails on the 4th load (whatever that means).

It *only works* when you go to the URL above, not to the one posted originally
in this bug.  I am not certain why this is.

Looking at the file in question, I cannot seem to find the actual tests.

Comment 13

[Sivakiran Tummala]

Jkeiser,
I will create a login on that machine, so that you can access

Comment 14

[John Keiser (jkeiser)]

Great.  Still, the problem is more that I don't understand what the tests are
running against or even which part of the tests are meant to be tests.  I have
been unsuccessful in isolating the tests so far, as well.

Comment 15

[Kevin McCluskey (gone)]

nsbeta1- until we have a minimized reproducible test case. When we have a test
case please clear the -.

Comment 16

[carnold]

Probably stuff that you already have but:

1. Unzip attached file
2. Download JSUnit 1.2.7 from http://jsunit.sourceforge.net
3. Unzip jsunit
4. Load jsunit/testRunner.html
5. Browse to HTMLSelectElement01.html from first zip (02, 03,... etc)
6. Press Run
7. If fixed, bar should be green.  If broken, Mozilla will have crashed.

I also just filed 135627 which is a bug with HTMLOptGroupElement that also 
occurs while running the W3C/NIST DOM L2 HTML test suite.

Comment 17

[Sivakiran Tummala]

carnold: I saw your message in the DOM TS mailing list and was about to add a
comment in here. Thanks for bringing this up carnold.

Kevin, we have a somewhat minimised testcase, i think this should be a nsbeta1+
bug. W3 is planning to release their testsuite pretty soon.

Comment 18

[John Keiser (jkeiser)]

carnold: what is this first zip you are talking about?

Comment 19

[carnold]

Attachment: The missing "first zip file", subset of DOM test suite

Comment 20

[carnold]

In addition, I thought I had tested this with JSUnit 1.2.7, but JSUnit 1.2.7 
doesn't seem to like this test case and does nothing.  

To actually get the bug to occur you need to download a modified version of 
JSUnit 1.2.6 that is part of the DOM L1 Core test suite available at 
http://www.w3.org/DOM/Test/Downloads/DOMTSL1Core-20020213.zip

1. Unzip the missing first zip file attachment

2 [details] [diff] [review]. Load ecmascript/testRunner.html from the DOM test suite

3. Hit the browse button to find one of the HTMLSelectElement??.html files 
that was unzipped in step 1

4. Press run

Comment 21

[Sivakiran Tummala]

Attachment: testcase

the application is crashing only with select and optgroup Element testcases.

Comment 22

[Sivakiran Tummala]

This is happening on branch builds only. This bug is a regression from 6.2RTM,
07-30 trunk and mozilla nightly's.

Comment 23

[John Keiser (jkeiser)]

WFM Linux Mozilla 1.0 branch (Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.1)
Gecko/20020814).  The DOM tests go all the way through.

Comment 24

[Sivakiran Tummala]

i got the new testcases from W3c (updated using CVS). 
comment # 21 is a minimised testcase from W3C which crashed. I am still seeing
this problem

Comment 25

[John Keiser (jkeiser)]

Attachment: Patch

This patch is currently untested but soon will be (and it does compile).  This
fix is zero risk and makes it so that we pass the DOM tests (assuming the
others work, which I will test tonight).

Comment 26

[John Keiser (jkeiser)]

Nominating.  This is DOM testsuite, fairly embarrassing to have.

Comment 27

[Johnny Stenback (:jst)]

Assuming this turns out to fix this crash, and I believe it will, this should be
taken on the 1.0.1 branch for MachV RTM to avoid embarrasement when Mozilla (and
Netscape 7.0), the worlds "most standards compliant browser(s)" can't even run
the official W3C DOM tests w/o crashing. This fix can not regress anything, it's
a matter of adding a simple null check and it fixes a known guaranteed crash and
there's just no way this can break anything.

ADT/drivers, please accept this on the 1.0.1 branch.

Comment 28

[John Keiser (jkeiser)]

This does in fact fix the crash.

Comment 29

[chris hofmann]

Comment on attachment 95360 [details] [diff] [review]
Patch

a=chofmann for 1.0.1

Comment 30

[Syd Logan]

Adding adt1.0.1+ for branch checkin

Comment 31

[scottputterman]

Please check this in as soon as the branch is open.

Comment 32

[Sivakiran Tummala]

We pass all the other DOM tests, so fixing this bug should make us look really
good. We have only 12 failures. 

Comment 33

[Jaime Rodriguez, Jr.]

removing the "+", until we can talk about it in an ADT meeting (with JST and
John) this afternoon. Pls hold off on checking it until that time. thanks!

Comment 34

[Randell Jesup [:jesup] (needinfo me)]

I see no possible danger from allowing this patch; I agree with the
mozilla1.0.1+ designation.  ADT, please approve.

Comment 35

[scottputterman]

adding adt1.0.1+

Comment 36

[John Keiser (jkeiser)]

Checked in on 1.0 branch.

Comment 37

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 95360 [details] [diff] [review]
Patch

r=sicking

Comment 38

[Johnny Stenback (:jst)]

Adding fixed1.0.1 keyword since this was fixed on the branch last night.

Comment 39

[Sivakiran Tummala]

verified on 08-16-07 linux branch, donot crash anymore.