232368 - [FIX] Hang when tab into input element with onBlur handler

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[J. Carlos Navea]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113

Using "Spiffy DHTML Popup Calendar" from :
http://www.geocities.com/bazillyo/spiffy/calendar/
 I've created a page which best demostrates this issue:

http://scott.telnetd.com/loco/moz/calbug.php

When the focus is changed to the calendar control displayed on the page, the
browser stops responding. I'm not sure if it's bug in the dhtml itself more than
the browser.


Reproducible: Always
Steps to Reproduce:
1. place cursor on the sample text box
2. hit tab
3.

Actual Results:  
Browser stops responding. The process needs to be killed in order to terminate

Expected Results:  
Good question, as I stated above, I'm not sure if it's a bug with the DHML
itself (infinite loop? ). Going by the results from other browsers, It should
set focus on the control without the user being able to edit it.

Comment 1

[logan]

Confirmed in:

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040113
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7a) Gecko/20040127

Unaffected:

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4.1) Gecko/20031008
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031007 Firebird/0.7

This sounds like bug 232348, however I could not reproduce the problem in that URL.

Comment 2

[Andrew Schultz]

Attachment: testcase

testcase.  Just load and hit tab.
linux trunk 2004012708 hangs.

Comment 3

[J. Carlos Navea]

(In reply to comment #2)
> Created an attachment (id=140029)
> testcase
> 
> testcase.  Just load and hit tab.
> linux trunk 2004012708 hangs.

Ah! thanks, That's a lot cleaner. 

Confirming testcase crash in: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.6) Gecko/20040113

Comment 4

[Andrew Schultz]

confirmed with linux trunk 2004012708

this regressed between linux trunk 2003110605 and 2003110705, indicating bug
118685, which just landed on 1.4 branch...

==> Mats/Event Handling

Comment 5

[Andrew Schultz]

Attachment: stacktrace

Comment 6

[Andrew Schultz]

*** Bug 232348 has been marked as a duplicate of this bug. ***

Comment 7

[Andrew Schultz]

*** Bug 229302 has been marked as a duplicate of this bug. ***

Comment 8

[Martin Creutziger [:MMx]]

I can confirm the bug both with the testcase as well as with original URL using
the following Mozillas:

Mozilla/5.0 (Windows; U; Windows NT 5.0; de-DE; rv:1.6) Gecko/20040120 Firebird/0.7+
(also in Windows 98SE)

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; de-AT; rv:1.6) Gecko/20040113
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; de-DE; rv:1.6) Gecko/20040127
Firebird/0.7+ (MMx2000)

So I guess it's not PC specific.
Neither is it "trunk", using FIREBIRD_0_8_BRANCH here.

Comment 9

[Max Spicer]

Attachment: Test case

I can confirm the current testcase on Mozilla/5.0 (X11; U; Linux i686; en-US;
rv:1.6b) Gecko/20031217 Firebird/0.7+.	However, I don't believe the subject of
this bug is correct.  I've attached a testcase with an onblur handler to a text
box and it doesn't trigger the bug.  However, the testcase also gives a text
box with an onfocus handler that does effectively hang the browser.  The actual
behaviour is slightly different, but I believe is the same issue.  This test
case causes no problems on Firebird 0.7.

Comment 10

[Andrew Schultz]

Comment on attachment 140060 [details]
Test case

alert() totally changes the landscape.	for instance, the second textbox with
onfocus="alert('bob')" hangs Mozilla builds from before this bug regressed

Comment 11

[HARUNAGA Hirotoshi]

dup of Bug 230813.

Comment 12

[Andrew Schultz]

*** Bug 230813 has been marked as a duplicate of this bug. ***

Comment 13

[Mats Palmgren (inactive)]

I'm looking into this...

Comment 14

[Mats Palmgren (inactive)]

*** Bug 233413 has been marked as a duplicate of this bug. ***

Comment 15

[Mats Palmgren (inactive)]

This is indeed a regression from bug 118685, the lines that trigger the problem
(from bug 147927) got checked in during the review so I missed it.
The problem is an infinite loop of calls to ShiftFocusInternal().

Comment 16

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

This fixes the URL + testcase and all duplicates.  I have also verified that
it doesn't break bug 118685 and bug 147927.

Comment 17

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 140908 [details] [diff] [review]
Patch rev. 1

r=bzbarsky

Comment 18

[Mats Palmgren (inactive)]

*** Bug 233551 has been marked as a duplicate of this bug. ***

Comment 19

[Boris Zbarsky [:bzbarsky]]

*** Bug 233566 has been marked as a duplicate of this bug. ***

Comment 20

[Boris Zbarsky [:bzbarsky]]

Patch checked in to 1.7a.

Comment 21

[R.K.Aa.]

*** Bug 233864 has been marked as a duplicate of this bug. ***

Comment 22

[Andrew Schultz]

isn't this also needed for 1.4.2?

bug 118685 made it into 1.4.2.  however, there have been no 1.4 branch nightlies
since Oct (except for OS/2), so I can't actually test it (without building from
1.4 CVS).

Comment 23

[Boris Zbarsky [:bzbarsky]]

Andrew, see bug 118685 comment 54 and bug 147927 comment 23 

Comment 24

[R.K.Aa.]

*** Bug 235111 has been marked as a duplicate of this bug. ***

Comment 25

[logan]

*** Bug 236265 has been marked as a duplicate of this bug. ***

Comment 26

[Andrew Schultz]

*** Bug 236437 has been marked as a duplicate of this bug. ***

Comment 27

[Bill Mason]

*** Bug 236931 has been marked as a duplicate of this bug. ***

Comment 28

[Bill Mason]

*** Bug 245827 has been marked as a duplicate of this bug. ***

Comment 29

[Andrew Schultz]

*** Bug 245834 has been marked as a duplicate of this bug. ***