2234 - Calling a form submission through JS crashes the viewer

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[ernie]

1/05,1/07 builds on NT

When I submit a form through a JS function call (using DOM),
it crashes the viewer.  If I submit the form manually via
a submit button, no crash occurs.

Here are some code snippets:

<script>
function submitResults()
{
  document.forms.item(0).submit();
}
</script>

<form name="results" action="/ernie/cgi-bin/writeresults.cgi" method="post">
...
<input type=button onClick=submitResults() value=submitResults()>
<input type=submit>
</form>

Comment 1

[Eric Pollmann]

Well, we're dereferencing null there alright...  Seems that we're explicitly
passing in nsnull to a function that then does a QI on it:

In nsHTMLFormElement::Submit() we do:
result = formMan->OnSubmit(context, nsnull);

http://cvs-mirror.mozilla.org/webtools/lxr/source/layout/html/content/src/nsHTMLFormElement.cpp#291


Then in nsFormFrame::OnSubmit(aPresContext, aFrame) we do:
aFrame->QueryInterface(kIFormControlFrameIID, (void**)&fcFrame);

http://cvs-mirror.mozilla.org/webtools/lxr/source/layout/html/forms/src/nsFormFrame.cpp#468

I passed in the current frame being submitted and that stopped the crash, but I
don't know if that's "the right thing" so I'm holding back until I learn more...

Comment 2

[ernie]

Talkback Tracking ID (via 1/08 build on NT):
AHQ45BLR

Comment 3

[Eric Pollmann]

Checked in a fix.

Comment 4

[rubydoo123]

assigning Gerardo as QA Assigned

Comment 5

[rubydoo123]

using 2/03/99 build, loading the page, selecting each of the buttons does not
crash on win95. Need to verify on linux and mac.

Gerardo -- please verify on linux
Greg -- please verify on mac

thanks

Comment 6

[glynn]

Feb 3 Mac - initial button pressing not working properly, 1st button does not
create text in the field, typing causes text to appear overlapping the Back
Forward buttons, the second and third buttons, submitresults and submitquery
contact the server but then nothing happens.  When I try to quit by clicking
the close box, the app hangs.  Trying to Macsbug out the first time resulted in
crashing my entire machine. Me thinks we still have a problem here.

Comment 7

[Eric Pollmann]

The CGI on snorkel encounters a server error when running, which may be
partially to blame for this crash.  (It's returning an error code to viewer)

I set up a functioning test case on blueviper:
http://blueviper/forms/submit.html

This worked for me on Windows and Linux.  Does it work on mac?

If the Mac browser is crashing on a server HTTP error code, that may a bug that
in netlib.  ???

Comment 8

[glynn]

Ok, the crash is caused by something else.  In Feb 4 Seamonkey with new test case
this appears to be ok.  The rendering of text in the wrong place is a layout
problem separate from this bug as well.  Marking this as fixed for Mac.

Comment 9

[glynn]

Verified Linux as well with Feb 4.  More layout problems than Mac and same hang
on close box but submission is working.