214011 - Scrolling in textarea with css and js crashes Mozilla

Status: RESOLVED WORKSFORME

(Core :: Layout: Form Controls, defect)

Description

[Miha Psenica]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5a) Gecko/20030718
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5a) Gecko/20030718

HTML form, that has a TEXTAREA and SELECT fields, is nested in two tables. The
page also uses Javascript and css from external files. If a cursor is positioned
to the textare and scroller of a mouse moved, Mozilla crashes.

I have created a testcase of such page at http://www.psenica.com/mozilla/bad.htm

I am using Mozilla 1.5a (but the bug is present at least one year), Win98,
Modern Theme.

Reproducible: Always

Steps to Reproduce:
1. Go to http://www.psenica.com/mozilla/bad.htm
2. Click on the textarea
3. Use your scroller on the mouse and scroll

Actual Results:  
Mozilla crashed.

Expected Results:  
The textarea should be scrolled.

Some Talkback crash IDs: TB22223683Y, TB22223758Y, TB22224146Q, TB22224264W,...

Comment 1

[Boris Zbarsky [:bzbarsky]]

According to caillon, none of those talkback reports includes a useful stack...
(most are blank, one has a single frame, which is an nsCOMPtr destructor)

Comment 2

[Andrew Schultz]

Attachment: stacktrace

debug build asserts when mousing over (and out of) the textarea and again when
attempting to scroll (before crashing):

###!!! ASSERTION: RemovedAsPrimaryFrame called after PreDestroy: 'PR_FALSE',
file nsTextControlFrame.cpp, line 1327

Comment 3

[Andrew Schultz]

Attachment: testcase

Comment 4

[Andrew Schultz]

regression between linux trunk 2002102808 and 2002103010

==> form controls ?

Comment 5

[Miha Psenica]

I have tried the testcase and the browser crashes only when I try to scroll up,
not down. I have produced Talkback crash ID TB22231701Y.

Comment 6

[Andrew Schultz]

Attachment: valgrind log

it seems to be consistently attempting to access an already-freed nsView

when running with valgrind, Mozilla doesn't crash, but it asserts:
###!!! ASSERTION: mViewManager is null!: 'mViewManager', file nsView.cpp, line
522

Comment 7

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: another stack trace

Comment 8

[Mats Palmgren (inactive)]

WFM, 2003-11-08-05 trunk Linux

Comment 9

[Andrew Schultz]

I still crash on the testcase with linux trunk 20031106.  I had to mouse-scroll
up and down a bit, but it did eventually crash.

Comment 10

[Anders Pedersen]

Crash confirmed on testcase.

talkbackid: TB9557E

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040331
Microsoft Windows 2000 Professional 5.00.2195 SP4

Comment 11

[Miha Psenica]

I don't see this bug anymore in version 2004081709 (1.8a3), but I've experienced
it in previous versions.