135009 - Crash in GKCONTENT.DLL [@ nsXULElement::HandleDOMEvent]

Reporter

Description

•

22 years ago

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.9+) Gecko/20020401
BuildID:    2002040103

When opening this URL, or when trying to run a script in the directory, I get
the crash.

See Talkback ID's TB4752967H, TB4752843Q, TB4752814W, TB4752785Y and TB4752735K.
 The first 3 were when opening URL, the last two were when trying to run a
script inside that directory.

Reproducible: Always
Steps to Reproduce:
1. Open URL
2. Watch Mozilla crash


Actual Results:  Crash

Expected Results:  Actually, what I was trying to do was get a list of drugs
that Cigna Healthcare covers by following a link from
http://www.cigna.com/consumer/services/pharmacy/drug_list.html
I do this by clicking on the "Go" next to "Find by Name" without entering
anything in that field, as per Cigna instructions.

Junk_HbJ

Comment 1

•

22 years ago

Also crashes for me with 2002040103

See TB4753930Z

Shark Daddy (Jonathan L.)

Comment 2

•

22 years ago

*sigh* Confirmed on Win2k/2002033109...how rude; talkback didn't even come
up...no data for you!

NEW.

Status: UNCONFIRMED → NEW

Ever confirmed: true

Adam Hauner

Updated

•

22 years ago

Keywords: crash

OS: Windows 98 → All

Adam Hauner

Comment 3

•

22 years ago

Stephen, should I ask you for TB4752967H, TB4752843Q, TB4752814W, TB4752785Y,
TB4752735K or TB4753930Z?

stephend@netscape.com (gone - use stephen.donner@gmail.com instead)

Comment 4

•

22 years ago

nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3297]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4690]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 693]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3230]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1636]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsHTMLFormElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp,
line 605]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsHTMLSelectElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1798]
nsEventStateManager::DispatchNewEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 4073]
nsEventListenerManager::DispatchEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
2661]
nsDOMEventRTTearoff::DispatchEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 545]
nsHTMLSelectElement::SetOptionsSelectedByIndex
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 1327]
nsHTMLSelectElement::InsertOptionsIntoList
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 467]
nsHTMLSelectElement::WillAddOptions
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 668]
nsHTMLSelectElement::AppendChildTo
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLSelectElement.cpp,
line 377]
SinkContext::FlushTags
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 2147]
HTMLContentSink::BeginUpdate
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 4891]
nsDocument::BeginUpdate
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1628]
nsGenericDOMDataNode::SetText
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericDOMDataNode.cpp, line 1251]
FindChar1 [d:\builds\seamonkey\mozilla\string\obsolete\bufferRoutines.h, line 427]
nsFSURLEncoded::AddRef
[d:\builds\seamonkey\mozilla\content\html\content\src\nsFormSubmission.cpp, line
403]
nsDocument::CloneNode
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3115]
nsDocument::CloneNode
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3115]
nsGenericDOMDataNode::SetText
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericDOMDataNode.cpp, line 1284]
SheetLoadData::AddRef
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 501]
SheetLoadData::AddRef
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 501]
nsSelection::Release
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp, line 1037]
nsSelection::RepaintSelection
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp, line 2940]
nsSelection::GetFrameForNodeOffset
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp, line 2951]
nsSelection::WordMove
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp, line 3090]
0x0775c085

Adam Hauner

Updated

•

22 years ago

Summary: Crash in GKCONTENT.DLL → Crash in GKCONTENT.DLL [@ nsXULElement::HandleDOMEvent]

Matthias Versen [:Matti]

Comment 5

•

22 years ago

-> Dom Events (and CC Hyatt)

Assignee: Matti → joki

Component: Browser-General → DOM Events

QA Contact: imajes-qa → vladimire

David G King

Reporter

Comment 6

•

22 years ago

FWIW, I've just tested this on builds 20020330 and 20020228 and get the same crash.

David G King

Reporter

Comment 7

•

22 years ago

This URL works fine with Netscape 6.2.2, but as that's based on 0.9.4, that
isn't much help. So, I installed Mozilla 0.9.9 (2002031104) and it worked fine
there as well. So this is a regression that happened btw 3/11 and 3/28.

Hmmm, just noticed a typo in comment #6 (the 2/28 in incorrect and should read
3/28).

Keywords: regression

Jay Patel [:jay]

Comment 8

•

22 years ago

This is a topcrasher with recent MozillaTrunk builds.  I was also able to crash
with this stack signature, but not sure if it's the same problem:

 Incident ID 4796521   
Stack Signature  nsXULElement::HandleDOMEvent 0bcd2cdb
Trigger Time 2002-04-03 18:00:18
Email Address jpatel@netscape.com
URL visited http://www.prosavvy.com/members/affiliates/commissions/index.cfm
Build ID 2002040210
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Stack overflow
User Comments crashing loading the page...easy.
Stack Trace
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3296]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULCommandDispatcher::UpdateCommands
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULCommandDispatcher.cpp,
line 381]
GlobalWindowImpl::UpdateCommands
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 2835]
nsFocusController::UpdateCommands
[d:\builds\seamonkey\mozilla\dom\src\base\nsFocusController.cpp, line 138]
nsFocusController::SetFocusedElement
[d:\builds\seamonkey\mozilla\dom\src\base\nsFocusController.cpp, line 111]
nsFocusController::Blur
[d:\builds\seamonkey\mozilla\dom\src\base\nsFocusController.cpp, line 318]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1709]
nsWindowRoot::HandleChromeEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsWindowRoot.cpp, line 182]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 693]
nsXULDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 2449]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3449]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4690]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 693]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3230]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1636]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1630]
nsHTMLInputElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp,
line 1384]
nsEventStateManager::SendFocusBlur
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 3758]
nsEventStateManager::SetContentState
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 3536]
nsHTMLInputElement::Select
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLInputElement.cpp,
line 1073]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2027]
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1267]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2746]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3414]
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1019]
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 182]
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1218]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1737]


If my incident is the same problem, then
http://www.prosavvy.com/members/affiliates/commissions/index.cfm crashes for me
everytime if anyone needs a testcase.  I have a feeling this might be the same
problem we saw in bug 104310...so it might be worth taking a look there for
clues.  Nominating for nsbeta1.

Keywords: nsbeta1, qawanted, topcrash

John Morrison

Comment 9

•

22 years ago

Actually, I think the deal here is that HandleDOMEvent is just a victim in this
case. This is crashing on a stack overflow on an infinite recursion, but 
unfortunately, talkback doesn't show the full stack that lead to this crash. 

I can't actually crash with the URL that was originally reported in a current 
trunk build on win32. I suspect that both the original crash and the second
test url crash (jpatel above) are related, but I'm going to file a separate 
bug for the second crash. I have a simple test case for that crash, and a 
detailed stack trace showing the real recursion (pivoting around 
nsHTMLInputElement::Select -> nsEventStateManager::SetContentState -> 
nsEventStateManager::SendFocusBlur -> ...).

bryner, jkeiser: could one or both of you have a look?

John Morrison

Comment 10

•

22 years ago

filed bug http://bugzilla.mozilla.org/show_bug.cgi?id=135345 for the 
http://www.prosavvy.com url crash.

David G King

Reporter

Comment 11

•

22 years ago

I just tried Mozilla 2002031803 on the reported URL, and got a crash, but this
time in JSDOM.DLL (see Talkback session TB4835688Q). I'm not sure if this is the
same problem, but if it is, then the regression occured somewhere between 3/11
(0.9.9) and 3/18 (0.9.9+).

John Morrison

Comment 12

•

22 years ago

The stack trace above in comment #4 and for the talkback id in comment #11
both go through SinkContext::FlushTags. This is likely a dup of bug 133669.
-> jkeiser, for dup'ing to bug 133669 [I'm not 100% certain].

Assignee: joki → jkeiser

David G King

Reporter

Comment 13

•

22 years ago

Bug #133669 has a patch with r, sr and a. Does anyone know when the patch will
be checked into the tree?

David G King

Reporter

Comment 14

•

22 years ago

I just tested builds 2002-03-12 & 2002-03-14 and they both crash in JSDOM.DLL

lchiang

Updated

•

22 years ago

Keywords: qawanted

John Keiser (jkeiser)

Assignee

Comment 15

•

22 years ago

Well I'll be, maybe it *was* bug 133669 (certainly didn't look like it to me). 
I don't see the crash today on Linux 2002040606, though I don't think I tried to
reproduce before.  Confirmation?  (You'll have to use a build from today, as the
aforementioned crash was not fixed until today.)

David G King

Reporter

Comment 16

•

22 years ago

Using build 2002040603 it works fine for me. Therefore I'm going to mark this as
a dup of bug #133669.

*** This bug has been marked as a duplicate of 133669 ***

Status: NEW → RESOLVED

Closed: 22 years ago

Resolution: --- → DUPLICATE

Vladimir Ermakov

Comment 17

•

22 years ago

verifying

Status: RESOLVED → VERIFIED

Nobody; OK to take it and work on it

Updated

•

13 years ago

Crash Signature: [@ nsXULElement::HandleDOMEvent]

Bugzilla

Quick Search

Crash in GKCONTENT.DLL [@ nsXULElement::HandleDOMEvent]

Categories

(Core :: DOM: Events, defect)

Tracking

()

People

(Reporter: d_king, Assigned: john)

References

(
URL
)

Details

(Keywords: crash, regression, topcrash)

Crash Data

Security

(public)

User Story

Description

Comment 1

Comment 2

Updated

Comment 3

Comment 4

Updated

Comment 5

Comment 6

Comment 7

Comment 8

Comment 9

Comment 10

Comment 11

Comment 12

Comment 13

Comment 14

Updated

Comment 15

Comment 16

Comment 17

Updated