181094 - (sometime) crash if autocomplete in form fields is used

Status: VERIFIED DUPLICATE of bug 184202

(Firefox :: Address Bar, defect)

Description

[Markus Klaffke]

User-Agent:       Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.2b) Gecko/20021029 Phoenix/0.4
Build Identifier: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.2b) Gecko/20021029 Phoenix/0.4

Autocomplete for for web forms sometimes makes Phoenix crash: sometimes if I'm
starting Phoenix and typing in the first character of word which is already
listet in autocomplete, Phoenix craches.

Reproducible: Sometimes

Steps to Reproduce:
1. Start Phoenix.
2. Surf to a web site with a web form, for example a discussion forum.
3. Start to type (in a web form field) a word which is already listed in
autocomplete.
4. Sometime, but too often, Phoenix craches.
Actual Results:  
Phoenix crashes and needs to be restartet. After restarting, all the
website-icons are deleted.

Comment 1

[André Dahlqvist]

Please try to reproduce this with the newest nightly build from
(http://ftp.mozilla.org/pub/phoenix/nightly/ ) and install that into a cresh
directory. Please also create a new profile though phoenix.exe -ProfileManager
before running the new build. Report back here your results.

Comment 2

[Markus Klaffke]

Hi,

thanks for help .;) I created a fresh directory and a new prfile, also using the
standard theme).
But: Ths problem still exists, Phoenix crashes. Here are some screenshots:

<li><a href="http://fakuh.de/img/phoe1.jpg" target="_blank">Phoenix 1</a>
<li><a href="http://fakuh.de/img/phoe2.jpg" target="_blank">Phoenix 2</a>
<li><a href="http://fakuh.de/img/phoe3.jpg" target="_blank">Phoenix 3</a>
<li><a href="http://fakuh.de/img/phoe4.jpg" target="_blank">Phoenix 4</a>

Regards, Markus

Comment 3

[Ryuichi KUBUKI]

I had those crashes more than a few times, on 20021119 WinXP.
Its call stack:

	00000000()	
 	gklayout.dll!01df29dd() 	
 	xpc3250.dll!01001c02() 	
 	xpc3250.dll!01004fe1() 	
 	js3250.dll!0103aace() 	
 	js3250.dll!0103fbd5() 	
 	js3250.dll!0103ab0b() 	
 	js3250.dll!0103ad64() 	
 	js3250.dll!010247bc() 	
 	jsdom.dll!01803da7() 	
 	jsdom.dll!0181e517() 	
 	gkcontent.dll!011df695() 	
 	gkcontent.dll!011e21b0() 	
 	gkcontent.dll!011e1cd7() 	
 	gkcontent.dll!011ae133() 	
 	gklayout.dll!01d4a199() 	
 	gklayout.dll!01d4a00b() 	
 	gkview.dll!01e67923() 	
 	gkview.dll!01e612dd() 	
 	gkview.dll!01e61b4a() 	
 	gkwidget.dll!01341eb5() 	
 	gkwidget.dll!013457a0() 	
 	gkwidget.dll!01345b8a() 	
 	gkwidget.dll!013423d7() 	
 	user32.dll!_InternalCallWinProc@20()  + 0x1b	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7	
 	user32.dll!_DispatchMessageWorker@8()  + 0xd8	
 	user32.dll!_DispatchMessageW@4()  + 0xb	
 	gkwidget.dll!01348d2a() 	
 	appshell.dll!01327384() 	
 	phoenix.exe!00401bfc() 	
 	phoenix.exe!0040105b() 	
 	phoenix.exe!00401087() 	
 	kernel32.dll!_BaseProcessStart@4()  + 0x23	

Hope it helps.

Comment 4

[Asa Dotzler [:asa]]

Lost website icons are the result of the crash and shouldn't be discussed in
this bug. We're either going to need a full stacktrace (made from a debug build
with symbols) or specific steps where we can reproduce. If we can't reproduce it
and then we can't get a stack to debug. 

Comment 5

[Tom Lichti]

I have a 100% reproducible method of getting Phoenix .5 to crash under Windows
98 using the auto-complete memory drop-down feature. Email me for details (I
need to give you private access to a section of my site). tom at redpepperracing.com

Tom

Comment 6

[Nathan Kurz]

Attachment: Test case to cause browser crash

With help from Tom Lichti I was able to build a test case.  
Instructions included in the HTML.

Comment 7

[Nathan Kurz]

Attachment: Backtrace of crash with method 4(a)

Here is a backtrace of the crash using the test case in the first attachment.
At least under Linux, the backtrace is rather hard to get since the crash
freezes 
the window manager.  Solution was to "DISPLAY=:0.0 phoenix -g" from a virtual
terminal.

Comment 8

[Nathan Kurz]

I just realized that my test case should be saved as local file in order to
work.  This is not because the relevant to the crashing bug, but because
bugzilla is trying to handle the form submit which is necessary to produce the
bug. There's probably a better way to write the test case so this isn't necessary. 

I should also note that the form in my test case is a bare-bones example that
has been condensed to require only one HTML page.  This is not necessary in
principle, and none of the paramaters or names I've chosen seem relevant.  It
does seem relevant, though, that a popup or new page is created.

Comment 9

[Christian Bell]

This is cross-listed as bug #184202 for Phoenix
(http://bugzilla.mozilla.org/show_bug.cgi?id=184202)

Comment 10

[pand]

I have experienced this same problem in every build of Phoenix (including the
latest nightly builds).  I started with version 04.  I have experienced this on
Google for example.  However it seems to occur only after I have been surfing
awhile.  Does not occur right after starting up the browser.  I am using Win 98.
Here is a dump:

PHOENIX caused an invalid page fault in
module <unknown> at 0000:01bb036a.
Registers:
EAX=00000000 CS=0167 EIP=01bb036a EFLGS=00010202
EBX=00e9b702 SS=016f ESP=00dbe648 EBP=00dbe680
ECX=01bb1bac DS=016f ESI=02754170 FS=5e4f
EDX=0090ba8c ES=016f EDI=00000000 GS=0000
Bytes at CS:EIP:
01 00 00 01 00 01 00 00 00 00 00 00 00 00 01 01 
Stack dump:
00726bc9 02754170 00000000 028b56a0 007264ca 028b56a0 00000000 00dbe83c 00dbe6a4
00e9b702 1003cbf1 028b56a0 00000000 00dbe83c 00dbe820 00419137 

Comment 11

[pand]

Better dump.

PHOENIX caused an invalid page fault in
module PHOENIX.EXE at 017f:00726d87.
Registers:
EAX=00000000 CS=017f EIP=00726d87 EFLGS=00010213
EBX=00e9b802 SS=0187 ESP=00dbe64c EBP=00dbe680
ECX=00000000 DS=0187 ESI=027235b0 FS=0fef
EDX=0090ba8c ES=0187 EDI=00000000 GS=0000
Bytes at CS:EIP:
ff 51 58 33 c0 5e c2 08 00 55 8b ec 51 8b 4d 10 
Stack dump:
027235b0 00000000 02bd46c0 0072668b 02bd46c0 00000000 00dbe83c 00dbe6a4 00e9b802
1003cbf1 02bd46c0 00000000 00dbe83c 00dbe820 0041914d 02bd46c0 

Comment 12

[Erik]

This bug is a duplicate one of bug #184202... 

*** This bug has been marked as a duplicate of 184202 ***

Comment 13

[Simon Paquet [:sipaq]]

Mass verifying of old bugs.