126268 - Crash submitting forms with input type=image when there are other controls in the form

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Chris Petersen]

Build: 2002-02-16-08
Platform: OS X
Expected Results: Form submission should take place after clicking button
What I got: Crash occurs

Steps to reproduce:

1) Open sample url in Mozilla

2) Click on image button to submit

3) Crash occurs


**********

Date/Time:  2002-02-18 12:13:21 -0800
OS Version: 10.1.2 (Build 5P48)
Host:       localhost

Command:    Mozilla
PID:        385

Exception:  EXC_BAD_INSTRUCTION (0x0002)
Code[0]:    0x00000002
Code[1]:    0x0065c558

Thread 0 Crashed:
 #0   0x0065c558 in 0x65c558

Thread 1:
 #0   0x7000497c in syscall
 #1   0x70557600 in BSD_waitevent
 #2   0x70554b80 in CarbonSelectThreadFunc
 #3   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x705593ec in CarbonOperationThreadFunc
 #3   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x70283ea4 in TSWaitOnConditionTimedRelative
 #3   0x7027d748 in TSWaitOnSemaphoreCommon
 #4   0x702c2078 in TimerThread
 #5   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x70250ab0 in TSWaitOnCondition
 #3   0x7027d730 in TSWaitOnSemaphoreCommon
 #4   0x70243d14 in AsyncFileThread
 #5   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7055b884 in CarbonInetOperThreadFunc
 #3   0x7002054c in _pthread_body

Thread 6:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body

PPC Thread State:
  srr0: 0x0065c558 srr1: 0x0208f030                vrsave: 0x00000000
   xer: 0x00000014   lr: 0x0062384c  ctr: 0x0065c548   mq: 0x00000000
    r0: 0x0065c548   r1: 0x73750001   r2: 0x00113cd8   r3: 0x00113cec
    r4: 0x0220bed8   r5: 0xbfffe568   r6: 0x00000000   r7: 0x0220bfe8
    r8: 0x0220bff8   r9: 0x00000001  r10: 0x5f8add32  r11: 0x00000001
   r12: 0x00113ce4  r13: 0x0220bed8  r14: 0x0220e5d0  r15: 0x0231cc88
   r16: 0x040b7e88  r17: 0x001151b0  r18: 0x79490001  r19: 0x51750001
   r20: 0x34070001  r21: 0x022115b8  r22: 0x00000000  r23: 0xbfffefbc
   r24: 0x03e333e0  r25: 0x03ee3a38  r26: 0x00000000  r27: 0x03ee34e8
   r28: 0xbfffe690  r29: 0x0220bed8  r30: 0x00113cec  r31: 0xbfffe60c

**********

Comment 1

[Chris Petersen]

Reassigning to jkeiser

Comment 2

[Chris Petersen]

This problem occurs when the input text element and input image element appear
in the form together. The input element can be hidden or be located after the
image in the form. The crash will still occur.

Comment 3

[Chris Petersen]

Attachment: Input text element is hidden

Crash occurs when image is clicked.

Comment 4

[Chris Petersen]

John,

Here is what I get in the console window (running the debug OS X build)


###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with 
operator->().: 'mRawPtr != 0', file nsCOMPtr.h, line 650

Comment 5

[Chris Petersen]

Attachment: Screen shot from Codewarrior

Comment 6

[John Keiser (jkeiser)]

Attachment: Patch

That was exactly what I needed, thanks!  I haven't run this yet :)  But it
should fix the problem.

Comment 7

[Chris Petersen]

Applied patch to OS X debug build. The crash is nolonger occuring...

Comment 8

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 70160 [details] [diff] [review]
Patch

r=sicking

Comment 9

[John Keiser (jkeiser)]

A word of explanation: the problem before was the line:

nsCOMPtr<nsIContent> parentA(do_QueryInterface(parentA));

(And similar for parentB.)  While this worked in most compilers, it's still
pretty bad practice.  And of course it didn't work on the Mac.

Updating summary to reflect cause (for searchers).

Comment 10

[Benjamin Mucci]

From Bug 125950:  

crash on the "login" form on 

http://entreprisedigitale.fsa.ulaval.ca/ed4/main/edg.asp

TB:
TB3069918Q
TB3069874E
TB3069462M
TB3069432X
TB3069384E

Mozilla 0.9.8+ Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.8+) Gecko/20020218 08

MacOS 8.6

Comment 11

[R.K.Aa.]

*** Bug 126126 has been marked as a duplicate of this bug. ***

Comment 12

[R.K.Aa.]

*** Bug 126255 has been marked as a duplicate of this bug. ***

Comment 13

[R.K.Aa.]

*** Bug 126408 has been marked as a duplicate of this bug. ***

Comment 14

[R.K.Aa.]

*** Bug 126481 has been marked as a duplicate of this bug. ***

Comment 15

[Brendan Eich [:brendan]]

Comment on attachment 70160 [details] [diff] [review]
Patch

sr=[e-mail]

Comment 16

[R.K.Aa.]

*** Bug 126549 has been marked as a duplicate of this bug. ***

Comment 17

[Kevin McCluskey (gone)]

nsbeta1+

Comment 18

[Chris Petersen]

Chnaging QA Contact

Comment 19

[John Keiser (jkeiser)]

fix checked in (last night)

Comment 20

[Chris Petersen]

Marking verified in the Feb 20th OS X build (2002-02-20-03).