163911 - Crash clicking button

Status: VERIFIED DUPLICATE of bug 163327

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Heikki Toivonen (remove -bugzilla when emailing directly)]

This is a regression caused by the fix to bug 162648. Going to URL and clicking
the button crashes the browser. This is blocking me from testing my fix to bug
83573. The crash happens in PresShell::HandleDOMEventWithTarget() where
aTargetContent is used without checking whether or not it is null.
PresShell::HandleDOMEventWithTarget() is called by
nsHTMLButtonElement::HandleDOMEvent() which was changed in bug 162648:
HandleDOMEvent() used to call HandleEventWithTarget(), now it calls
HandleDOMEventWithTarget(). In the testcase mForm is null in nsHTMLButtonElement.

I can make the crash go away by adding <form> around the button (see file
post2.html in the directory), but the testcase still does not work: a '?' gets
appended to the URLbar, but the page does not update otherwise. It works fine in
NS7.0. Expected behavior is click -> wait 5 seconds -> "@@waiting@@" replaced by
server response. Did forms change too?

Stack trace below:

PresShell::HandleDOMEventWithTarget(PresShell * const 0x04805c88, nsIContent *
0x00000000, nsEvent * 0x0012f1f4, nsEventStatus * 0x0012f220) line 6168 + 27 bytes
nsHTMLButtonElement::HandleDOMEvent(nsHTMLButtonElement * const 0x04850e38,
nsIPresContext * 0x039a3368, nsEvent * 0x0012f36c, nsIDOMEvent * * 0x00000000,
unsigned int 1, nsEventStatus * 0x0012f69c) line 521
PresShell::HandleEventInternal(nsEvent * 0x0012f36c, nsIView * 0x00000000,
unsigned int 1, nsEventStatus * 0x0012f69c) line 6121 + 44 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x04805c88, nsEvent *
0x0012f36c, nsIFrame * 0x04845fec, nsIContent * 0x04850e38, unsigned int 1,
nsEventStatus * 0x0012f69c) line 6090 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const
0x04826be0, nsIPresContext * 0x039a3368, nsMouseEvent * 0x0012f8a4,
nsEventStatus * 0x0012f69c) line 2758 + 63 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x04826be8,
nsIPresContext * 0x039a3368, nsEvent * 0x0012f8a4, nsIFrame * 0x04845fec,
nsEventStatus * 0x0012f69c, nsIView * 0x04845250) line 1761 + 28 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f8a4, nsIView * 0x04845250,
unsigned int 1, nsEventStatus * 0x0012f69c) line 6141 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x04805c8c, nsIView * 0x04845250,
nsGUIEvent * 0x0012f8a4, nsEventStatus * 0x0012f69c, int 0, int & 1) line 6044 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x04844fd0, nsGUIEvent * 0x0012f8a4, int 0)
line 2098
nsView::HandleEvent(nsViewManager * 0x0482c4f0, nsGUIEvent * 0x0012f8a4, int 0)
line 301
nsViewManager::DispatchEvent(nsViewManager * const 0x0482c4f0, nsGUIEvent *
0x0012f8a4, nsEventStatus * 0x0012f7a0) line 1903 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f8a4) line 83
nsWindow::DispatchEvent(nsWindow * const 0x0484508c, nsGUIEvent * 0x0012f8a4,
nsEventStatus & nsEventStatus_eIgnore) line 1034 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f8a4) line 1055
nsWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5125 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, unsigned int 0, nsPoint *
0x00000000) line 5382
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 7667743, long *
0x0012fcf0) line 3856 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x00bf05d8, unsigned int 514, unsigned int 0, long
7667743) line 1303 + 27 bytes
USER32! 77e11b60()
USER32! 77e11cca()
USER32! 77e183f1()
nsAppShellService::Run(nsAppShellService * const 0x010762c8) line 452
main1(int 1, char * * 0x00284b30, nsISupports * 0x00000000) line 1507 + 32 bytes
main(int 1, char * * 0x00284b30) line 1871 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e8d326()

Comment 1

[John Keiser (jkeiser)]

Doh!! I hadn't thought button had regressed too.  This pinpoints why some things
are still crashing, thanks.

*** This bug has been marked as a duplicate of 163327 ***

Comment 2

[Trix Supremo]

verifying dupe