Closed Bug 183181 Opened 22 years ago Closed 18 years ago

Textarea with Javascript - strange behaviour and crash

Categories

(Core :: Layout: Form Controls, defect, P2)

Product:
Core
Component:
Layout: Form Controls
Platform:
x86
All
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Milestone:
Future

People

(Reporter: gizz, Unassigned)

Details

(Keywords: crash, hang, testcase)

Attachments

(4 files)

reporter's testcase
785 bytes, text/html
Details
Talkback incidents (2)
2.60 KB, text/plain
Details
stacktrace with symbols
10.02 KB, text/plain
Details
minimal testcase
437 bytes, text/html
Details 
User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.0.3705)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2.1) Gecko/20021130

Mozilla shows odd behaviour when editing a textarea box with a JavaScript which 
checks the length of the text.
Mozilla crashes if you continue typing.


Reproducible: Always

Steps to Reproduce:
1. open page
2. type some text
3. type more text until crash

Actual Results:  
After a few lines of text, mozilla shows very strange behaviour in the text 
box. If you continue typing (about 150 characters) mozilla crashes.


Example Page:
--- start here ---

<html>
<script language=JavaScript>

<!--

function CheckLen(Target) {

        StrLen = Target.value.length

        if (StrLen == 1 && Target.value.substring(0,1) == ' ') {

        Target.value = ''

        StrLen = 0 }

        if (StrLen > 160) {

        Target.value = Target.value.substring(0,160)

        CharsLeft = 0 }

else {

CharsLeft = 160 - StrLen }

document.form.anzahl.value = CharsLeft }

//-->

</script>

<FORM ACTION='index3.php' METHOD='post' NAME='form'>


  <TEXTAREA COLS='25' NAME='text' onChange=CheckLen(this) onFocus=CheckLen
(this) onKeyDown=CheckLen(this) onKeyUp=CheckLen(this) ROWS='4' 
STYLE='OVERFLOW: hidden' WRAP='VIRTUAL'></TEXTAREA>


   <INPUT TYPE='TEXT' NAME='anzahl' SIZE='3' VALUE='160' MAXLENGTH='3' 
DISABLED></FONT>


</FORM>
</html>
I see the strange behaviour, but I get no crash (1.2.1 20021130, win95). Please
try with a talkback enabled build and report the talkback ID here.
Talkback ID is TB14661325H
Reproducable with 1.2.1, 20021130, Linux. Talkback ID TB14661713Z
Confirming due to comment 2, also changing some parameters.
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Windows 2000 → All
Whiteboard: TB14661325H, TB14661713Z
Version: Trunk → Other Branch
Attached file reporter's testcase — 

    
    

    
  
probably not javascript engine
==> Form Controls
Assignee: rogerl → form
Component: JavaScript Engine → Layout: Form Controls
QA Contact: pschwartau → tpreston

    
    

    
  

      
      
      
      

        Attached file
          
        Talkback incidents (2)
        — 
      

    


  

    
    

    
  
Testcase caused a hang with 1.3a build 20021126/win98

    
  
Keywords: crash, 
          
            hang
Whiteboard: TB14661325H, TB14661713Z

    
    

    
  
I have seen something similar in Linux, reported via Talkbacks TB16616133G and
TB16673310Q (both Linux trunk 2003012522).  No JavaScript is involved.  Not
easily reproducible, but like all crashes occurring at the most inopportune
moments.  (See also bug 176257.)

    
    

    
  
Maybe this is also related:
I produce a crash every time when I scroll with mouse button inside a textarea
(it uses a lot of css formating and a javascript function focus()).

This has been happening since 1.1, maybe also before that, and is still visible
in 1.3b under Win98.

Look at bug 176257 and bug 172298 also, maybe there is a connection.

    
    

    
  
It has occurred in Mozilla 1.3 and later bugs, but I haven't seen any crash. 
What I have seen is that once the limit has been reached, Mozilla quits
responding to any keys within the box.  
Reproducible:  always.
Test case:  http://www.javascriptkit.com/script/script2/enforceform.shtml


    
    

    
  


  
debug build asserts once the caret goes below the textarea:
###!!! ASSERTION: running past end: 'mCurrent != mListLink', file nsLineBox.h,
line 562

and then when the counter hits 0:
###!!! ASSERTION: strange continuation: 'checkParent != flow', file
nsBlockFrame.cpp, line 5037
###!!! ASSERTION: whoops, continuation without a parent: 'nsnull != flow', file
nsBlockFrame.cpp, line 5047

    
    

    
  

      
      
      
      

        Attached file
          
        minimal testcase
        — 
      

    


  

    
  
Keywords: testcase
Version: Other Branch → Trunk
Priority: -- → P2
Target Milestone: --- → Future

    
    

    
  
(In reply to comment #11)
> It has occurred in Mozilla 1.3 and later bugs, but I haven't seen any crash. 
> What I have seen is that once the limit has been reached, Mozilla quits
> responding to any keys within the box.  
> Reproducible:  always.
> Test case:  http://www.javascriptkit.com/script/script2/enforceform.shtml
> 

I can confirm this comment, NO CRASH. The JavaScript just prevents me from
entering anymore into the textarea (in the first testcase from this bug)
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040316

    
    

    
  
I can confirm this bug with a similar page. I get the problem when I'm in the
textarea and I'm trying to use TAB to go to the next field (which is the
chars-left-counter). Mozilla hangs completely and crashes after some (~30) secs.
As it happens when I enter the chars-left-counter I think it maybe the blur()
function. (I remember having some weird problems some time ago when using blur()
with NS 4.x). If I'm not tabbing over the chars-left-counter everything works fine!

---- copied from source view ----
<tr>
<td>Text</td>
<td colspan="3" valign="top">
<textarea cols="36" rows="5" name="ADTEXT" wrap="virtual"
onkeydown="document.frmAnz.leftchars.value= 188 -
document.frmAnz.ADTEXT.value.length-document.frmAnz.ADPRICE.value.length-8"
onkeyup="document.frmAnz.leftchars.value= 188 -
document.frmAnz.ADTEXT.value.length-document.frmAnz.ADPRICE.value.length-8"
onchange="document.frmAnz.leftchars.value= 188 -
document.frmAnz.ADTEXT.value.length-document.frmAnz.ADPRICE.value.length-8"></textarea>
<br></td>
</tr>
<script language="javascript"><!--
document.write('<tr><td>&nbsp;</td><td colspan=3><span class="textsmall">Ihnen
bleiben noch <INPUT NAME=leftchars VALUE="180" SIZE=3
onFocus="document.frmAnz.leftchars.blur();"> Zeichen</span></td></tr>');
//--></script><tr><td>&nbsp;</td><td colspan="3"><span class="textsmall">Ihnen
bleiben noch <input name="leftchars" value="180" size="3"
onfocus="document.frmAnz.leftchars.blur();"> Zeichen</span></td></tr>
---- end copy ----

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

    
    

    
  
Testcases do not crash for me using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060529 Minefield/3.0a1 ID:2006052910 [cairo]

    
    

    
  
this seems to have been fixed since Mozilla 1.5
resolving WFM
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → WORKSFORME

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: