131816 - M099 Trunk crash submitting search form [@ 0x80000000 - nsPromiseFlatCString::nsPromiseFlatCString]

Status: VERIFIED WORKSFORME

(Core :: DOM: Core & HTML, defect, P1)

Description

[Jay Patel [:jay]]

Not sure if I got the right component on this one...the stack is pointing to
strings and a frame down it's networking and then security...so not sure exactly
where the problem is, but there have been quite a few of these crashes with
recent MozillaTrunk builds.

Here is the latest info from Talkback:

Count   Offset    Real Signature
[ 11   0x80000000 1287782f - nsPromiseFlatCString::nsPromiseFlatCString ]
[ 1   0x80000000 6756c65c - nsPromiseFlatCString::nsPromiseFlatCString ]
 
     Crash date range: 2002-03-07 to 2002-03-16
     Min/Max Seconds since last crash: 27 - 69391
     Min/Max Runtime: -162 - 69391
     Keyword List :  
     Count   Platform List 
     7   Windows NT 5.1 build 2600
     5   Windows NT 5.0 build 2195
 
     Count   Build Id List 
     5   2002030911
     2   2002031109
     2   2002030705
     1   2002031510
     1   2002030811
     1   2002030710
 
     No of Unique Users         7
 
 Stack trace(Frame) 

	 0x80000000  
	 nsPromiseFlatCString::nsPromiseFlatCString
[d:\builds\seamonkey\mozilla\string\src\nsPromiseFlatString.cpp  line 103] 
	 nsStandardURL::SetScheme
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStandardURL.cpp  line 1059]  
 
     (4126770)	URL: www.google.co.nz
     (4126770)	Comments: the google search page had just finshed loading
     (3920853)	URL: www.download.com
     (3920853)	Comments: I clicked search
     (3920717)	URL: www.google.com
     (3920717)	Comments: i clicked search
     (3905050)	URL: www.comdirect.de
     (3905050)	Comments: click on button "suchen"
     (3857307)	Comments: crashed while clicking on a "form" send button at google.com
     (3856728)	URL: www.nickels.de
     (3856610)	URL: www.tecchannel.de
     (3792652)	Comments: clicking a "SEND" button on a form

Those incidents didn't have much a stack, so here's another set of crashes with
a nice full stack:

Count   Offset    Real Signature
[ 3   0x80000000 8675a012 - nsPromiseFlatCString::nsPromiseFlatCString ]
 
     Crash date range: 2002-03-12 to 2002-03-12
     Min/Max Seconds since last crash: 108 - 1003
     Min/Max Runtime: 837 - 2185
     Keyword List :  
     Count   Platform List 
     3   Windows 98 4.10 build 67766446
 
     Count   Build Id List 
     3   2002031109
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 0x80000000  
	 nsPromiseFlatCString::nsPromiseFlatCString
[d:\builds\seamonkey\mozilla\string\src\nsPromiseFlatString.cpp  line 103] 
	 nsStandardURL::SetScheme
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStandardURL.cpp  line 1040] 
	 nsSecureBrowserUIImpl::GetSSLStatus
[d:\builds\seamonkey\mozilla\security\manager\boot\src\nsSecureBrowserUIImpl.cpp
 line 482] 
	 nsSecureBrowserUIImpl::CheckPost
[d:\builds\seamonkey\mozilla\security\manager\boot\src\nsSecureBrowserUIImpl.cpp
 line 619] 
	 nsSecureBrowserUIImpl::Notify
[d:\builds\seamonkey\mozilla\security\manager\boot\src\nsSecureBrowserUIImpl.cpp
 line 269] 
	 nsHTMLFormElement::NotifySubmitObservers
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp 
line 755] 
	 nsHTMLFormElement::DoSubmit
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp 
line 698] 
	 nsHTMLFormElement::DoSubmitOrReset
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp 
line 635] 
	 nsHTMLFormElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp 
line 601] 
	 PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6052] 
	 PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6020] 
	 nsHTMLInputElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp 
line 1549] 
	 PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6052] 
	 PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6020] 
	 nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 2603] 
	 nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 1686] 
	 PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6073] 
	 PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5975] 
	 nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 2043] 
	 nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 306] 
	 nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 1863] 
	 HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 83] 
	 nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 869] 
	 nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 886] 
	 nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4713] 
	 ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4963] 
	 nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3630] 
	 nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 1131] 
	 KERNEL32.DLL + 0x363b (0xbff7363b)  
	 KERNEL32.DLL + 0x24407 (0xbff94407)  
	 0x00648c16   

I haven't been able to reproduce this one.

Comment 1

[Jay Patel [:jay]]

Adding keywords and nominating for nsbeta1.

Comment 2

[Jay Patel [:jay]]

Adding M099 to summary since this is also a topcrasher with Mozilla 0.9.9.

Comment 3

[Alexandru Savulov]

i'm on it. will ask Kevin to nominate it nsbeta1+.

Comment 4

[Jay Patel [:jay]]

Could Darin's fix for bug 124042 have anything to do with this?  Just curious.

Comment 5

[Jay Patel [:jay]]

cc'ing darin.

Comment 6

[Alexandru Savulov]

list of incidents  with a nice stack from talkback:

ID      BUILD      URL       

4210027 2002031711 http://www.livejournal.com/

4200874            http://www.technosphere.org.uk/

these are searchable if you look for the stack signature "0x80000000 8675a012"
there are 2 sets with this 2 URLs and another set without URL spec. all comming
from the same user.

Comment 7

[Alexandru Savulov]

in this stack appears that 

  nsSecureBrowserUIImpl::CheckPost

calls 

  nsSecureBrowserUIImpl::GetSSLStatus

but the actual implementation of the method CheckPost does not perform a call to
GetSSLStatus.

this is some bogus pointer used in nsHTMLFormElement::NotifySubmitObservers
to notify an object of type nsSecureBrowserUIImpl or a bogus installation or
something. all the reports seem to come from the same user.


nsPromiseFlatCString::nsPromiseFlatCString   
nsStandardURL::SetScheme   
nsSecureBrowserUIImpl::GetSSLStatus
nsSecureBrowserUIImpl::CheckPost   
nsSecureBrowserUIImpl::Notify   
nsHTMLFormElement::NotifySubmitObservers   
nsHTMLFormElement::DoSubmit  

Comment 8

[Darin Fisher]

yeah, the stack is definitely bogus... nsSecureBrowserUIImpl never even calls
nsIURI::SetScheme... in fact, there isn't any code PSM that calls SetScheme.

Comment 9

[Kevin McCluskey (gone)]

nsbeta1-. Please remove the - for nsbeta1 reconsideration if a reproducible test
case can be found. 

Comment 10

[Jay Patel [:jay]]

There haven't been any of these crashes reported since 3/19.  I'll try to
reproduce this a few more times and if I don't see this crash in the next few
days, I'm going to mark this worksforme.

Comment 11

[Jay Patel [:jay]]

It looks like this crash has gone away.  I can't reproduce it and there haven't
been any Talkback incidents since 3/19.  Marking worksforme...if anyone sees
this crash again, please reopen.

Comment 12

[Vladimir Ermakov]

verifying per reporter's coments