240703 - Firefox segfaults on ANY Form submission

Status: VERIFIED DUPLICATE of bug 240702

(Firefox :: General, defect)

Description

[Alexander Ewering]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.4.1) Gecko/20020508 Netscape6/6.2.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040207 Firefox/0.8

Very old bug, exists since an ancient Mozilla Firebird version.

Some random day, Mozilla suddenly decides that HTML FORM submission is evil, and
trying to submit one leads to an instant segfault. It doesn't matter which page
(works on Google "Start Search" or on my online-banking account, etc.), or what
form data is filled in. Pressing the "SUBMIT" button crashes Firefox. 
This behaviour then appears EVERY TIME ANY FORM is submitted. In other words,
the browser becomes completely unusable - form submission becomes impossible.

It seems the ONLY way to clear this bug is to completely delete all of
~/.mozilla or /usr/lib/mozilla (can't remember). "Clear all information" in
Preferences doesn't help, nor does using another user profile.

Here's a gdb bt:

Thread 1 (Thread 1024 (LWP 420)):
#0  0x0873ea81 in nsGenericElement::SetDocument(nsIDocument*, int, int) ()
#1  0x0878d991 in nsGenericHTMLElement::SetDocument(nsIDocument*, int, int) ()
---Type <return> to continue, or q <return> to quit---
#2  0x088dad47 in nsHTMLFormElement::SetDocument(nsIDocument*, int, int) ()
#3  0x40976260 in NSGetModule () from /usr/lib/mozilla/components/libwallet.so
#4  0x4096907f in NSGetModule () from /usr/lib/mozilla/components/libwallet.so
#5  0x088db4e0 in nsHTMLFormElement::NotifySubmitObservers(nsIURI*, int*) ()
#6  0x088db13a in nsHTMLFormElement::SubmitSubmission(nsIPresContext*,
nsIFormSubmission*) ()
#7  0x088daffb in nsHTMLFormElement::DoSubmit(nsIPresContext*, nsEvent*) ()
#8  0x088daf32 in nsHTMLFormElement::DoSubmitOrReset(nsIPresContext*, nsEvent*, int)
    ()
#9  0x088dae9b in nsHTMLFormElement::HandleDOMEvent(nsIPresContext*, nsEvent*,
nsIDOMEvent**, unsigned, nsEventStatus*) ()
#10 0x086a1b41 in PresShell::HandleDOMEventWithTarget(nsIContent*, nsEvent*,
nsEventStatus*) ()
#11 0x088e5b08 in nsHTMLInputElement::HandleDOMEvent(nsIPresContext*, nsEvent*,
nsIDO
MEvent**, unsigned, nsEventStatus*) ()
#12 0x086a1b41 in PresShell::HandleDOMEventWithTarget(nsIContent*, nsEvent*,
nsEventStatus*) ()
#13 0x088e57fc in nsHTMLInputElement::HandleDOMEvent(nsIPresContext*, nsEvent*,
nsIDOMEvent**, unsigned, nsEventStatus*) ()
#14 0x086a19b4 in PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned,
nsEventStatus*) ()
#15 0x086a16fe in PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*,
int, int&) ()
#16 0x08819151 in nsViewManager::HandleEvent(nsView*, nsGUIEvent*, int) ()
#17 0x08818b95 in nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) ()
#18 0x08812d9e in HandleNumbers(nsString const&, nsString&) ()
#19 0x0868b5a4 in nsWidget::DispatchEvent(nsGUIEvent*, nsEventStatus&) ()
#20 0x0868b4d0 in nsWidget::DispatchWindowEvent(nsGUIEvent*) ()
#21 0x08689c46 in nsWidget::OnKey(nsKeyEvent&) ()
#22 0x08687c47 in handle_key_press_event(_GtkObject*, _GdkEventKey*, void*) ()
#23 0x086880fa in handle_gdk_event(_GdkEvent*, void*) ()
#24 0x08687faa in handle_gdk_event(_GdkEvent*, void*) ()
#25 0x402ef047 in gdk_wm_protocols_filter () from /usr/lib/libgdk-1.2.so.0
#26 0x4031d258 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
---Type <return> to continue, or q <return> to quit---
#27 0x4031d863 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#28 0x4031d9fc in g_main_run () from /usr/lib/libglib-1.2.so.0
#29 0x4023f707 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#30 0x08681aac in nsAppShell::Run() ()
#31 0x08a44b0f in nsAppShellService::Run() ()
#32 0x08bcc12b in getCountry(nsAString const&, nsAString&) ()
#33 0x08bcc998 in xre_main(int, char**, nsXREAppData const&) ()
#34 0x084be4b1 in main ()
#35 0x405c617d in __libc_start_main (main=0x84be454 <main>, argc=1, 
    ubp_av=0xbffff614, init=0x84b59ac <_init>, fini=0x8be5af0 <_fini>, 
    rtld_fini=0x4000a534 <_dl_fini>, stack_end=0xbffff60c)
    at ../sysdeps/generic/libc-start.c:129

(The other threads have not been interesting)


Reproducible: Always
Steps to Reproduce:
1. Install Mozilla
2. Wait a few months
3. Submit a form

Actual Results:  
Mozilla crashed :)

Expected Results:  
Not crash

Comment 1

[Bill Mason]

*** This bug has been marked as a duplicate of 240702 ***