17300 - [CRASH] on JavaScript event

Status: VERIFIED WORKSFORME

(Core :: DOM: Editor, defect, P2)

Description

[blee]

To repro,
Load the URL above and click on any button (Reset, Submit Form, etc.).
==> crash.

blds: Win 10-26-09-M11, Mac 10-26-08-M11, Linux 10-26-08-M11

MacsBug Log >> http://babel/macsbuglogs/stdlog_102699.
Win StackTrace not available on this bld (Talkback malfunction).

Comment 1

[John Bandhauer]

I'm not seeing a crash on this page with my two day old NT mozilla.exe
build. Clicking on the 'Submit Form' button will hit the assert for embedded
zero chars in a unicode string located in nsScanner::Append. But otherwise it
worksforme. Perhaps if my build were two days newer this would not be the case.

The 'Component' choice of 'JavaScript Debugger' was incorrect. The JavaScript
Debugger project for mozilla is just starting and no code for that tool is
checked in. This sounds like a DOM bug so I've changed the Component and am
reassigning to vidur.

There is

Comment 2

[vidur (gone)]

The only crash that I seem to get is on clicking the Reset button. The stack
trace is shown below. Seems like the atom is corrupted. Reassigning to buster
since it looks like a text control issue.

PlaceholderTxn::Merge(PlaceholderTxn * const 0x018fea10, int * 0x0012f024,
nsITransaction * 0x019137e0) line 176 + 15 bytes
nsTransactionManager::EndTransaction() line 1155 + 20 bytes
nsTransactionManager::Do(nsTransactionManager * const 0x018fe240, nsITransaction
* 0x019137e0) line 154 + 14 bytes
nsEditor::Do(nsEditor * const 0x01c0a9c0, nsITransaction * 0x019137e0) line 392
+ 30 bytes
nsEditor::Do(nsEditor * const 0x01c0a9c0, nsITransaction * 0x01913210) line 379
nsEditor::InsertTextImpl(nsEditor * const 0x01c0a9c0, const nsString & {...})
line 1615 + 16 bytes
nsTextEditRules::DoTextInsertion(nsIDOMSelection * 0x0103ca80, int * 0x0012f378,
const nsString * 0x0012f438, TypeInState {...}) line 1179 + 25 bytes
nsTextEditRules::WillInsertText(nsIDOMSelection * 0x0103ca80, int * 0x0012f4d0,
int * 0x0012f564, const nsString * 0x0012f76c, nsString * 0x0012f438,
TypeInState {...}, int -1) line 305 + 34 bytes
nsTextEditRules::WillDoAction(nsTextEditRules * const 0x018fd860,
nsIDOMSelection * 0x0103ca80, nsRulesInfo * 0x0012f4d4, int * 0x0012f4d0, int *
0x0012f564) line 152 + 60 bytes
nsHTMLEditor::InsertText(nsHTMLEditor * const 0x01c0aa24, const nsString &
{...}) line 1281 + 45 bytes
nsHTMLEditorLog::InsertText(nsHTMLEditorLog * const 0x01c0aa24, const nsString &
{...}) line 195 + 13 bytes
nsGfxTextControlFrame::SetTextControlFrameState(const nsString & {...}) line 852
nsGfxTextControlFrame::Reset(nsIPresContext * 0x01c0e030) line 646
nsFormFrame::OnReset(nsFormFrame * const 0x01c228c8, nsIPresContext *
0x01c0e030) line 266
nsHTMLButtonControlFrame::MouseClicked(nsIPresContext * 0x01c0e030) line 293
nsGfxButtonControlFrame::HandleEvent(nsGfxButtonControlFrame * const 0x01c2b7f0,
nsIPresContext & {...}, nsGUIEvent * 0x0012f894, nsEventStatus &
nsEventStatus_eIgnore) line 223
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const
0x01c23e50, nsIPresContext & {...}, nsMouseEvent * 0x0012fcd4, nsEventStatus &
nsEventStatus_eIgnore) line 1047 + 30 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x01c23e50,
nsIPresContext & {...}, nsGUIEvent * 0x0012fcd4, nsIFrame * 0x01c2b7f0,
nsEventStatus & nsEventStatus_eIgnore, nsIView * 0x01c022f0) line 470 + 24 bytes
PresShell::HandleEvent(PresShell * const 0x01bea4e4, nsIView * 0x01c022f0,
nsGUIEvent * 0x0012fcd4, nsEventStatus & nsEventStatus_eIgnore) line 2249 + 43
bytes
nsView::HandleEvent(nsView * const 0x01c022f0, nsGUIEvent * 0x0012fcd4, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834
nsView::HandleEvent(nsView * const 0x01bf8410, nsGUIEvent * 0x0012fcd4, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x01bf84a0, nsGUIEvent * 0x0012fcd4, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x01bef6b0, nsGUIEvent * 0x0012fcd4, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsViewManager::DispatchEvent(nsViewManager * const 0x01bef880, nsGUIEvent *
0x0012fcd4, nsEventStatus & nsEventStatus_eIgnore) line 1739
HandleEvent(nsGUIEvent * 0x0012fcd4) line 63
nsWindow::DispatchEvent(nsWindow * const 0x01bf82d4, nsGUIEvent * 0x0012fcd4,
nsEventStatus & nsEventStatus_eIgnore) line 403 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fcd4) line 424
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3420 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line
3638
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 19595421, long *
0x0012fee4) line 2630 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x0013081c, unsigned int 514, unsigned int 0, long
19595421) line 581 + 27 bytes

Comment 3

[rubydoo123]

since this is a crasher -- I'm setting it to M12

Comment 4

[rubydoo123]

tried this using 1999111108 on win95 and it does not crash. I will test on Mac &
linux to see if this is still a problem

Comment 5

[rubydoo123]

tried this using Mac build 19991111 and it worked fine, also tried linux build
from 19991112 and it worked as well.

Comment 6

[blee]

It still happens. Type some text in form field and click Reset button.
Tried in Win32 11-11-08-M12, Mac 11-11-11-M11, Linux 11-11-08-M12.

Comment 7

[buster]

assigning to joe, because he was playing around with the atom memory model
inside editor.  perhaps this is already fixed.

Comment 8

[Joe Francis]

can anyone reproduce this now?  I can't get it to happen

Comment 9

[leger]

Adding crash keyword

Comment 10

[John Unruh]

Verified worksforme.

Comment 11

[Pulsebot]

Pushed by ffxbld-merge:
https://hg.mozilla.org/releases/mozilla-beta/rev/9d3da629fffb
[fenix] No issue: Update Flank to v21.01.0 (https://github.com/mozilla-mobile/fenix/pull/17300)