Closed
Bug 216714
Opened 23 years ago
Closed 19 years ago
M17x FF10x stack overflow crash [@ nsXULElement::HandleDOMEvent] when event is dispatched into an infinite loop [@ nsEventListenerManager::HandleEvent][@ nsDocument::DispatchEvent]
Categories
(Core :: DOM: UI Events & Focus Handling, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: matthijs.wensveen, Assigned: jst)
References
Details
(Keywords: crash)
Crash Data
Attachments
(2 files)
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030815
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030815
when an event is dispatched into an infinite loop with
elmt.onkeypress = myHandler;
function myHandler(evt) {
elmt.dispatchEvent(evt);
}
mozilla crashes.
While this is silly for a script programmer to do, it can (and thus will)
happen. A crash is the result.
Reproducible: Always
Steps to Reproduce:
1.
2.
3.
|
Reporter | |
Comment 1•23 years ago
|
||
testcase.
WARNING TESTCASE MIGHT CRASH YOUR BROWSER
|
||
Comment 2•23 years ago
|
||
|
|
||
Comment 3•23 years ago
|
||
confirming (and wait 2-5 years before this gets fixed :-( )
|
|
||
Updated•23 years ago
|
Summary: crash when event is dispatched into an infinite loop → crash when event is dispatched into an infinite loop [@nsXULElement::HandleDOMEvent]
|
|
||
Updated•23 years ago
|
Summary: crash when event is dispatched into an infinite loop [@nsXULElement::HandleDOMEvent] → crash when event is dispatched into an infinite loop [@ nsXULElement::HandleDOMEvent]
|
||
Comment 4•23 years ago
|
||
I'm not crashing with a debug Linux build circa 20030730. Does it crash with 1.4 ?
|
|
Reporter | |
Comment 5•23 years ago
|
||
Yes. Downloaded 1.4 (zip), and it crashed on windows XP.
I still have 1.5 alpha installed, I don't know how GRE works or if that matters.
That's why I downloaded the zip.
I also sent a talkback report with my email address filled in (I normally don't
fill in my email address when I don't have to)
It crashes on the latest firebird build too (20030823).
BTW, you have to insert a character to make it crash, you did do that, right?
|
|
||
Comment 6•23 years ago
|
||
wfm 2003082005 Linux, hangs when typing chars, but 5 seconds later, Mozilla is
usable. Doesn't seem to crash Mozilla on Linux.
|
|
||
Comment 7•23 years ago
|
||
I still see the crash with a 1 day old win2k build. It crashes after you put the
cursor in the form and if I try to type one char
|
||
Comment 8•22 years ago
|
||
unable to reproduce crash with 1.7 beta on windows XP
Status: NEW → RESOLVED
Closed: 22 years ago
Resolution: --- → WORKSFORME
|
|
Reporter | |
Comment 9•22 years ago
|
||
Still crashes on Windows 2000, Mozilla (20040331)
Can't test on Windows XP right now, but works for Asa apparently.
Status: RESOLVED → REOPENED
OS: Windows XP → Windows 2000
Resolution: WORKSFORME → ---
|
|
||
Comment 10•22 years ago
|
||
wfm too using FF 20040328 on Win2k and FF 20040401 on Linux.
|
||
Comment 11•22 years ago
|
||
I was able to reproduce this crash with MozillaTrunk 2004040413 and Mozilla 1.7
beta on Windows XP.
Incident ID: 12050
Stack Signature nsXULElement::HandleDOMEvent 8bb7b039
Email Address jay@mozilla.org
Product ID Mozilla1.7
Build ID 2004031615
Trigger Time 2004-04-04 16:23:41.0
Platform Win32
Operating System Windows NT 5.1 build 2600
Module gklayout.dll + (00165066)
URL visited http://bugzilla.mozilla.org/show_bug.cgi?id=216714
User Comments test case for bug 216714
Since Last Crash null sec
Total Uptime null sec
Trigger Reason Stack overflow
Source File Name
c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp
Trigger Line No. 2675
Stack Trace
nsXULElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2675]
nsXULElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2831]
nsXULElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2831]
nsXULElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2831]
nsXULElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2831]
nsXULElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2831]
nsXULElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2831]
nsXULElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2831]
nsXULElement::HandleChromeEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3995]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 886]
nsDocument::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 3682]
nsGenericElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1918]
nsGenericElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1911]
nsGenericElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1911]
nsHTMLFormElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLFormElement.cpp,
line 722]
nsGenericElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1911]
nsHTMLTextAreaElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp,
line 686]
nsEventStateManager::DispatchNewEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 4455]
nsEventListenerManager::DispatchEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1812]
nsDOMEventRTTearoff::DispatchEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 667]
XPTC_InvokeByIndex
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2029]
XPC_WN_CallMethod
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1288]
js_Invoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 943]
js_Interpret
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2963]
js_Invoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 959]
js_InternalInvoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1036]
JS_CallFunctionValue
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3591]
nsJSContext::CallEventHandler
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1269]
nsJSEventListener::HandleEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 181]
nsEventListenerManager::HandleEventSubType
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1435]
nsEventListenerManager::HandleEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1512]
nsGenericElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1959]
nsHTMLTextAreaElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp,
line 686]
nsEventStateManager::DispatchNewEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 4455]
nsEventListenerManager::DispatchEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1812]
nsDOMEventRTTearoff::DispatchEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 667]
XPTC_InvokeByIndex
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2029]
XPC_WN_CallMethod
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1288]
js_Invoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 943]
js_Interpret
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2963]
js_Invoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 959]
js_InternalInvoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1036]
JS_CallFunctionValue
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3591]
nsJSContext::CallEventHandler
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1269]
nsJSEventListener::HandleEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 181]
nsEventListenerManager::HandleEventSubType
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1435]
nsEventListenerManager::HandleEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1512]
nsGenericElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1959]
nsHTMLTextAreaElement::HandleDOMEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp,
line 686]
nsEventStateManager::DispatchNewEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 4455]
nsEventListenerManager::DispatchEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1812]
nsDOMEventRTTearoff::DispatchEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 667]
XPTC_InvokeByIndex
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2029]
XPC_WN_CallMethod
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1288]
js_Invoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 943]
js_Interpret
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2963]
js_Invoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 959]
js_InternalInvoke
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1036]
JS_CallFunctionValue
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3591]
nsJSContext::CallEventHandler
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1269]
nsJSEventListener::HandleEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 181]
Also, any chance this might be related to bug 77271 ?
Summary: crash when event is dispatched into an infinite loop [@ nsXULElement::HandleDOMEvent] → M17beta crash [@ nsXULElement::HandleDOMEvent] when event is dispatched into an infinite loop
|
|
Reporter | |
Comment 12•22 years ago
|
||
Related to bug #77271 most certainly. Probably even duplicate. This is all about
recursive events so...
|
|
||
Comment 13•22 years ago
|
||
I am no longer crashing with Mozilla 1.7rc1. I think this might be worth a
worksforme if noone else can reproduce this with the latest milestone or Trunk
builds.
Also, after A LOT of crashes with Mozilla 1.7beta, I don't see any incidents
with rc1 or Trunk builds in Talkback data.
Matti: Are you still crashing with your test case? If not, should we mark this
worksforme?
Keywords: topcrash
|
|
Reporter | |
Comment 14•22 years ago
|
||
It doesn't crash with firefox 20040402, can't test with mozilla right now.
Oh, Matti != Matthijs, sorry :D
|
|
||
Comment 15•22 years ago
|
||
wfm with a one day old Mozilla cvs on win2k
Status: REOPENED → RESOLVED
Closed: 22 years ago → 22 years ago
Resolution: --- → WORKSFORME
|
|
||
Comment 16•21 years ago
|
||
Looks like like this crash is back. It showed up in the topcrash list for
Firefox 1.0.3 and is not the #4 topcrasher for Firefox 1.0.4. Looks like a
regression, so marking it so and making it topcrash+ to get some traction.
Here is a link to all current crashes for nsXULElement::HandleDOMEvent:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsXULElement%3A%3AHandleDOMEvent&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
After very little crashes since 1.0, this stack signature spiked with Firefox
1.0.4 (MozillaOrgFirefox10Win322005051112). Here is a recent incident:
Incident ID: 6496458
Stack Signature nsXULElement::HandleDOMEvent d4a044d1
Product ID Firefox10
Build ID 2005051112
Trigger Time 2005-06-08 09:54:30.0
Platform Win32
Operating System Windows NT 5.1 build 2600
Module firefox.exe + (0017c97f)
URL visited start.mozilla.org
User Comments opened firefox via the quickstart icon, opens momentarily then
closes on it's own. Has done this NUMEROUS times.
Since Last Crash 158 sec
Total Uptime 158 sec
Trigger Reason Stack overflow
Source File, Line No.
d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2662
Stack Trace
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2662]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleChromeEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3988]
GlobalWindowImpl::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 916]
nsDocument::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3742]
nsEventStateManager::DispatchNewEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 4588]
nsDocument::DispatchEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3841]
nsDocument::EndLoad
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 1831]
nsHTMLDocument::EndLoad
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1011]
nsJSContext::ScriptEvaluated
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1771]
nsEventListenerManager::HandleEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1516]
GlobalWindowImpl::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 927]
nsXULDocument::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1268]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2864]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleChromeEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3988]
GlobalWindowImpl::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 954]
nsDocument::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3753]
nsEventStateManager::DispatchNewEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 4588]
nsDocument::DispatchEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3841]
nsDocument::EndLoad
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 1831]
nsHTMLDocument::EndLoad
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1011]
nsJSContext::ScriptEvaluated
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1771]
nsEventListenerManager::HandleEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1516]
GlobalWindowImpl::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 927]
nsXULDocument::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1268]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2864]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleChromeEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3988]
GlobalWindowImpl::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 954]
nsDocument::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3753]
nsEventStateManager::DispatchNewEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 4588]
nsDocument::DispatchEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3841]
nsDocument::EndLoad
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 1831]
nsHTMLDocument::EndLoad
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1011]
nsJSContext::ScriptEvaluated
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1771]
nsEventListenerManager::HandleEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1516]
GlobalWindowImpl::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 927]
nsXULDocument::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1268]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2864]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleChromeEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3988]
GlobalWindowImpl::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 954]
nsDocument::HandleDOMEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3753]
nsEventStateManager::DispatchNewEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 4588]
nsDocument::DispatchEvent
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3841]
nsDocument::EndLoad
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 1831]
nsHTMLDocument::EndLoad
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1011]
The testcase doesn't crash for me with 1.0.4, but based on Talkback data, we
should look into this.
|
|
Reporter | |
Comment 17•21 years ago
|
||
I've been trying to crash FF on this, but so far I am unsuccesful.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050517 Firefox/1.0.4
(Debian package 1.0.4-2)
|
|
||
Comment 18•21 years ago
|
||
Though this hasn't seen much action lately, Chofmann thinks we need to take a
look at this to make sure it doesn't become a major topcrasher for 1.0.5. We
have a testcase and I have been able to reproduce, so let's see if we can get a
quick handle on this. A link to all current crashes can be found in comment #16.
Flags: blocking-aviary1.0.5+
|
|
||
Updated•21 years ago
|
Summary: M17x FF104 crash [@ nsXULElement::HandleDOMEvent] when event is dispatched into an infinite loop → M17x FF10x crash [@ nsXULElement::HandleDOMEvent] when event is dispatched into an infinite loop
|
|
||
Updated•21 years ago
|
Assignee: saari → jst
Status: REOPENED → NEW
|
||
Comment 19•21 years ago
|
||
*** Bug 299333 has been marked as a duplicate of this bug. ***
|
|
||
Comment 20•21 years ago
|
||
Not making 1.0.5
Flags: blocking-aviary1.0.6?
Flags: blocking-aviary1.0.5-
Flags: blocking-aviary1.0.5+
|
|
||
Updated•21 years ago
|
Flags: blocking-aviary1.0.6-
|
||
Comment 21•21 years ago
|
||
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716
Firefox/1.0.6
I installed a number of extensions (including google toolbar, forecastfox,
imageview...all of which pop up configuration dialogues after restarting) w/o
restarting ff between each install. when I did restart ff, she crashed:
TB7887928Q
after the crash, starting ff resulted in the google toolbar's options dialogue
box popping up. I selected the options I wanted, then clicked OK...then ff crashed:
TB7887968G
Though the stack signature is different, the stack trace appears similar to the
1st crash.
After 2nd crash, I fired up ff, only to see her crash again:
TB7887992G (same stack sig & trace as 2nd crash)
After the next two crashes:
TB7888018M (again, like crashes 2 & 3)
TB7888051Q (different stack signature than crash 1 and/or 2)
...starting up ff worked. :\
|
|
||
Comment 22•21 years ago
|
||
this just bit me again, i think.
talkback TB8010317Z
if it weren't for session saver, i think i would have gone crazy by now...
|
|
||
Comment 23•21 years ago
|
||
Might as well throw mine on the pile, they're all older, and I can't say for
sure what exactly caused it as I often have multiple tabs open and it never
seems to happen on any certain particular site.
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB7985060Y
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB7782312Y
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB7731694G
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB7730425G
Summary: M17x FF10x crash [@ nsXULElement::HandleDOMEvent] when event is dispatched into an infinite loop → js_InternalInvoke] [@ js_Interpret] [@ js_Invoke] [@ nsDOMEventRTTearoff::DispatchEvent] [@ nsDocument::HandleDOMEvent] [@ nsEventListenerManager::DispatchEvent] [@ nsEventListenerManager::HandleEvent] [@ nsEventListenerManager::HandleEventSubType] [@ nsE…
|
|
||
Comment 24•21 years ago
|
||
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716
Firefox/1.0.6
saw this again. viewed a news feed that "required" real player, so I let plugin
finder install real player 10.5. After real player installed, it started going
through the registration process. At this point, the plugin finder said that
installation was complete and said ff would need to be restarted, so I did. I
canceled the real player registration (which caused real player to crash). when
I started ff, I was asked about a cookie for a site that was opening
(ocr.microsoft.com, iirc) but ff crashed soon afterward.
TB8828914Q
|
|
||
Comment 25•20 years ago
|
||
somebody emailed me about citing my build id, so this bug is getting a bump:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB11954377Q
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB12151565M
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB11540549E
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB11379863G
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Cheers.
|
||
Comment 26•20 years ago
|
||
renominate for the branches if there's a safe fix.
Flags: blocking-aviary1.0.8? → blocking-aviary1.0.8-
|
||
Comment 27•20 years ago
|
||
crashers in talkback stop at builds dated 20050915
Summary: M17x FF10x crash [@ nsXULElement::HandleDOMEvent] when event is dispatched into an infinite loop [@ GlobalWindowImpl::HandleDOMEvent] [@ JS_CallFunctionValue] [@ XPCWrappedNative::CallMethod] [@ XPC_WN_CallMethod] [@ XPTC_InvokeByIndex] [@ → M17x FF10x stack overflow crash [@ nsXULElement::HandleDOMEvent] when event is dispatched into an infinite loop [@ GlobalWindowImpl::HandleDOMEvent] [@ JS_CallFunctionValue] [@ XPCWrappedNative::CallMethod] [@ XPC_WN_CallMethod] [@ XPTC_InvokeByIndex] [@
|
||
Comment 28•20 years ago
|
||
This still seems to be present on the 1.8 branch with "232 crashes found where the Stack Signature contains 'nsxulelement::handledomevent' and the Deployment ID looks like 'MozillaOrgFirefox15%%'".
Keywords: topcrash+
OS: Windows 2000 → All
Hardware: PC → All
Summary: js_InternalInvoke] [@ js_Interpret] [@ js_Invoke] [@ nsDOMEventRTTearoff::DispatchEvent] [@ nsDocument::HandleDOMEvent] [@ nsEventListenerManager::DispatchEvent] [@ nsEventListenerManager::HandleEvent] [@ nsEventListenerManager::HandleEventSubType] [@ M17… → stack overflow crash when event is dispatched into an infinite loop [@ nsXULElement::HandleDOMEvent]
Version: Trunk → 1.8 Branch
|
|
||
Updated•20 years ago
|
Summary: stack overflow crash when event is dispatched into an infinite loop [@ nsXULElement::HandleDOMEvent] → js_InternalInvoke] [@ js_Interpret] [@ js_Invoke] [@ nsDOMEventRTTearoff::DispatchEvent] [@ nsDocument::HandleDOMEvent] [@ nsEventListenerManager::DispatchEvent] [@ nsEventListenerManager::HandleEvent] [@ nsEventListenerManager::HandleEventSubType] [@ nsE…
|
||
Comment 29•20 years ago
|
||
*** Bug 307546 has been marked as a duplicate of this bug. ***
|
|
||
Comment 30•19 years ago
|
||
So... the original bug here is FIXED (by disallowing redispatch of events that are in dispatch).
The last couple of stacks/dups are fixed by the patch for bug 295983 (and had nothing to do with this bug).
Note that you can probably still cause a problem if you create and dispatch your own event instead of trying to redispatch the existing one... :(
But that should be filed as a separate bug (esp. since it's not clear how to fix that without violating the DOM spec).
Status: NEW → RESOLVED
Closed: 22 years ago → 19 years ago
Resolution: --- → FIXED
Summary: js_InternalInvoke] [@ js_Interpret] [@ js_Invoke] [@ nsDOMEventRTTearoff::DispatchEvent] [@ nsDocument::HandleDOMEvent] [@ nsEventListenerManager::DispatchEvent] [@ nsEventListenerManager::HandleEvent] [@ nsEventListenerManager::HandleEventSubType] [@ M17… → M17x FF10x stack overflow crash [@ nsXULElement::HandleDOMEvent] when event is dispatched into an infinite loop [@ nsEventListenerManager::HandleEvent][@ nsDocument::DispatchEvent]
|
||
Updated•15 years ago
|
Crash Signature: [@ nsXULElement::HandleDOMEvent]
[@ nsEventListenerManager::HandleEvent]
[@ nsDocument::DispatchEvent]
|
|
||
Updated•7 years ago
|
Component: Event Handling → User events and focus handling
You need to log in
before you can comment on or make changes to this bug.
Description
•