180187 - Crash with mis-formed <a href...> JavaScript link [@ PresShell::HandleEventInternal ]

Status: VERIFIED DUPLICATE of bug 179548

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Nathan Silva]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3a) Gecko/20021114 Phoenix/0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3a) Gecko/20021114 Phoenix/0.4

(Tested in Mozilla 2002111408-trunk, Phoenix 20021114)

This site uses a pop-up window to display bus schedules. When you click the
"Close" link in the pop-up window, Mozilla crashes. The link uses mis-formed
HTML like this:

<a href="#javascript:"onMouseDown="closeWindow()" ><b>Close</b></a>

Reproducible: Always

Steps to Reproduce:
1. Go to http://trimet.org.
2. From the menu at left, choose "Riding TriMet" then "Transit Tracker".
3. Click the "Close" link in the Transit Tracker popup window.

Actual Results:  
Mozilla crashes.


I tried to create a minimal testcase using the HTML shown above but I could not
cause a crash using just that code.

I did submit two stacks: TB13938795Q, TB13938901Z.

Comment 1

[Olivier Cahagne]

confirming using Phoenix 2002112 on Linux.
Doesn't crash with a debug build 20021010 on Linux.

Comment 2

[Olivier Cahagne]

I don't crash either using build 2002110710 on Linux.

Comment 3

[Olivier Cahagne]

Phoenix 2002110808 doesn't crash on Win2k.
Phoenix 2002111020 crashes on Win2k.
Will attach testcase.

Comment 4

[Olivier Cahagne]

Attachment: Popup page used by testcase

Comment 5

[Olivier Cahagne]

Attachment: Testcase

Comment 6

[Doron Rosenberg (IBM)]

rigger Reason  Access violation
Source File Name c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp
Trigger Line No. 6230
Stack Trace
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6230]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6135]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2209]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 304]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1949]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 83]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1073]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1090]
nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5283]
ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5538]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 4065]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1339]
USER32.dll + 0x3a68 (0x77d43a68)
USER32.dll + 0x3b37 (0x77d43b37)
USER32.dll + 0x3d91 (0x77d43d91)
USER32.dll + 0x3df7 (0x77d43df7)
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 472]
main1 [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1556]
main [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1904]
WinMain [c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1924]
WinMainCRTStartup()
kernel32.dll + 0x214c7 (0x77e814c7)

Comment 7

[Boris Zbarsky [:bzbarsky]]

The crash happens at:

6228  if (NS_OK == mCurrentEventFrame->GetContentForEvent(mPresContext, aEvent,
&targetContent) && nsnull != targetContent) {
6229   rv = targetContent->HandleDOMEvent(mPresContext, aEvent, nsnull, 
6230                                aFlags | NS_EVENT_FLAG_SYSTEM_EVENT, aStatus);
6231  NS_RELEASE(targetContent);

(gdb) p mCurrentEventFrame
$1 = (nsIFrame *) 0x0

Comment 8

[Boris Zbarsky [:bzbarsky]]

sorry, bryner, this is yours too... I _think_ just bailing out if we have no
content or frame is the way to go...

Comment 9

[Olivier Cahagne]

dupe: bug 179548.
culprit: checkin for bug 124990.

Comment 10

[Olivier Cahagne]

sorry for the spam, latest Mozilla forgets form data these last days.
Resetting correct component.

Comment 11

[Jay Patel [:jay]]

dup of 179548. bryner has a fix for this crash in that bug.

*** This bug has been marked as a duplicate of 179548 ***

Comment 12

[Trix Supremo]

verified dupe