207094 - Hang while backspacing password fields

Status: RESOLVED WORKSFORME

(Core :: Layout: Form Controls, defect, P1)

Description

[Jason Barnabe (np)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030525
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030525

If you entered a (for example) 10 character word in a password field, then
backspaced and replaced the 10th character, then tried to remove to the 9th
character, Mozilla will hang.

Reproducible: Always

Steps to Reproduce:
1. Load the test case
2. Enter something into the first input field
3. Tab to the second field then go back to the first
4. Delete/backspace the last character in the password field and replace it
5. Tab to the second field then go back to the first
6. Delete or backspace the second last character
Actual Results:  
Mozilla hangs

Expected Results:  
Deleted the second last character

This also occurs on Win2000, same build. It began happening recently.

Comment 1

[Jason Barnabe (np)]

Attachment: Testcase

Comment 2

[Andrew Schultz]

Attachment: stacktrace

nsStrPrivate::GrowCapacity() (aDest=@0x8762544, aNewLength=4294967295) at 
   nsStr.cpp:149

Comment 3

[Andrew Schultz]

confirmed with linux trunk 20030524
this regressed between linux trunk builds 2003010805 and 2003010905
bug 88049 (or maybe bug 105397) looks like the culprit.

==> editor:core

Comment 4

[Andrew Schultz]

==> editor:core for real

Comment 5

[David D. Kilzer (ddk)]

FWIW: Confirmed in Mozilla 1.3.1 on Win NT 4.0sp6a:

Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.3.1) Gecko/20030425

Mozilla stops responding (consuming 100% CPU) on my NT4 box after
this happens.

Comment 6

[kinmoz]

I'm having a hard time reproducing this bug in my TRUNK 07/02/2003 Win32 debug
build.

> Steps to Reproduce:
> 1. Load the test case
> 2. Enter something into the first input field

Does the length of what you enter matter? I'm entering 10 random chars as
mentioned above.


> 3. Tab to the second field then go back to the first


When you say "then go back", how are you doing that? Shift-Tab? Tab? Clicking
with the mouse? I'm also assuming that after this step, the caret is blinking
after the last char in the password field.

> 4. Delete/backspace the last character in the password field and replace it
> 5. Tab to the second field then go back to the first

Once again, I need details on  how you are going back, and where the caret is
placed.

> 6. Delete or backspace the second last character
> Actual Results:  
> Mozilla hangs

Comment 7

[Jason Barnabe (np)]

>Does the length of what you enter matter?

No.

>When you say "then go back", how are you doing that? Shift-Tab? Tab? Clicking
with the mouse? 

Shift-tab. Clicking with the mouse doesn't seem to do it. 

>I'm also assuming that after this step, the caret is blinking
after the last char in the password field.

Yes. 

>Once again, I need details on  how you are going back, and where the caret is
placed.

Shift-tab. It all looks normal, but it crashes.

When trying different lengths, it seems to sometimes crash on the third last
instead of the second last. But it always crashes.

Comment 8

[Jason Barnabe (np)]

Here are the exact keystrokes:

(starting on the first text field)

1. *type any 10 characters*
2. tab
3. shift-tab
4. right arrow (positions caret at the end of text field)
5. backsapce
6. *type any character*
7. tab
8. shift-tab
9. right arrow (again, for the caret)
10. backspace
11. backspace

And then it crashes.

Comment 9

[u60234]

*** Bug 213052 has been marked as a duplicate of this bug. ***

Comment 10

[Andrew Schultz]

*** Bug 221703 has been marked as a duplicate of this bug. ***

Comment 11

[u60234]

*** Bug 242659 has been marked as a duplicate of this bug. ***

Comment 12

[Jason Barnabe (np)]

Works now in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2)
Gecko/20050326 Firefox/1.0+