243432 - crash if i choose a remembered form field value between page loads - FF09x [@ nsFormFillController::OnTextEntered]

Status: RESOLVED WORKSFORME

(Toolkit :: Form Manager, defect)

Description

[Jason Grunstra]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

When typing into form text fields, if Firefox has previous used values it will
give you a 'virtual drop down' list of past values to choose from. 

If you click on a link on a website, and before the next page has time to load
you start typing in the text field, by the time the next page does load the
'virtual drop down' still appears. If you then try to select one of the values,
the browser will crash.

I've only tried it on one site www.versiontracker.com, but I'm pretty sure it's
not site specific

Reproducible: Always
Steps to Reproduce:
1. Go to http://www.versiontracker.com/windows/
2. In the SEARCH FOR SOFTWARE text field search for something like postguard
(for example) and hit enter to search.
3. Now on the results page, click on a link on the site for example the MacOS
navigation item
4. immediatly start typing 'postguard' in the search field again, you only need
to first few characters to get the virtual drop down
5. Now once the MacOS page has loaded choose the postguard value that still
shows up in the virtual drop down. 
6. The browser should crash

Note: it may be hard to replicate on a fast connection since page loads will be
quick

Actual Results:  
browser crashes

Expected Results:  
the virutal drop down should not appear after going to a new page

Comment 1

[Charles Fenwick]

Have you tried to reproduce this on a recent nightly?  (I would try myself, but
as I cannot reproduce this on 0.8, I will pass.)

Comment 2

[Matthew Imakyure]

I can reproduce with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a)
Gecko/20040512 Firefox/0.8.0+ on Windows 2000

Comment 3

[Asa Dotzler [:asa]]

->firefox

Comment 4

[David Nelson]

Can reproduce with Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7)
Gecko/20040728 Firefox/0.9.1

Comment 5

[Adam Hauner]

David Nelson: Could you provide TalkBack incident ID of your crash?

Comment 6

[David Nelson]

Talkback Incident ID: TB477140Y

Comment 7

[Adam Hauner]

TB477140Y:
nsFormFillController::OnTextEntered() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp,
line 710]
nsAutoCompleteController::EnterMatch() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp,
line 65]
nsAutoCompleteController::HandleEnter() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp,
line 239]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2026]
XPC_WN_CallMethod() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 2972]
js_Invoke() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 958]
js_InternalInvoke() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 1035]
JS_CallFunctionValue() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsapi.c,
line 3607]
nsJSContext::CallEventHandler() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1296]
nsJSEventListener::HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 177]
nsXBLPrototypeHandler::ExecuteHandler() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp,
line 456]
nsXBLEventHandler::HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/content/xbl/src/nsXBLEventHandler.cpp,
line 84]
nsEventListenerManager::HandleEventSubType() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 710]
nsEventListenerManager::HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1525]
nsXULElement::HandleDOMEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2841]
PresShell::HandleEventInternal() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6035]
PresShell::HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5928]
nsViewManager::HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/view/src/nsViewManager.cpp,
line 710]
nsViewManager::DispatchEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/view/src/nsViewManager.cpp,
line 96]
HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/view/src/nsView.cpp,
line 243]
nsCommonWidget::DispatchEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsCommonWidget.cpp,
line 215]
nsWindow::OnButtonReleaseEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsWindow.cpp,
line 1449]
button_release_event_cb() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsWindow.cpp,
line 3277]

Jay, another topcrasher? There are 389 incidents on aviary branch (and only one
is in something different):
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsFormFillController%3A%3AOnTextEntered&vendor=All&product=Firefox10&platform=All&buildid=&sdate=&stime=00%3A00%3A00&edate=&etime=23%3A59%3A59
I found also incident TB476697 on most recent build, so this is still live; it
also affects Linux and Mac.
Asa, shouldn't this block aviary1.0?

Comment 8

[Jay Patel [:jay]]

Yes, this is a topcrasher.  It was lower down in the rankings for 0.9.2 (~ 40),
but there are definitely enough crashes across the last few releases to get this
on the radar.

I could not reproduce the crash with FF 0.9.3, but saw some weird behavior. 
After step 5 from the original steps to reproduce, if i click the down arrow key
to select from the pulldown, the item is selected and the pulldown keeps it's
position in the window while the rest of the page scrolls down.  Anyone else see
this?

Comment 9

[Adam Hauner]

BTW, Sairuh entered bug 254307 with same signature and maybe bug 253709 should
be related.

Comment 10

[Jay Patel [:jay]]

*** Bug 254307 has been marked as a duplicate of this bug. ***

Comment 11

[Jay Patel [:jay]]

Bug 253709 definitely looks related to the weird behavior I was seeing when I
tried to reproduce the crash.

Comment 12

[:deanis74]

Bug 253709 looks like a dupe, but it looks to have more info than this bug.

Comment 13

[sairuh (rarely reading bugmail)]

here's the recipe that works reliably for me on linux and windows:

1. install a firefox build into a unique folder: I've seen this with today's and
y'day's aviary1.0 branch builds (eg, 2004080408-0.9+ on linux).

2. launch firefox (I tend to see this with existing profiles).

3. click on a link in a web page.

results: in the upper-left of my desktop a chromeless window appears containing
a list of items --kind of like a displaced autofill menulist.

4. click to select one of the menulist items.

results: Firefox crashes.

http://hal.mozilla.org/reports/incidenttemplate.cfm?bbid=476697

Comment 14

[Jay Patel [:jay]]

Let's leave this open for the crasher and deal with the other behavior in Bug
253709 (unless someone can verify that it is directly related to this crash).

Comment 15

[Jay Patel [:jay]]

There haven't been any crashes like this in Talkback data since 8/10.  Any
changes recently that might have fixed this?  Has anyone been able to reproduce
this with a recent nightly after 8/10?

Comment 16

[Ben Goodger (use ben at mozilla dot org for email)]

+ing so we can at least verify that this has disappeared. 

Comment 17

[sairuh (rarely reading bugmail)]

fwiw, I haven't encountered this with recent builds --at least using the recipe
in comment 13.

Comment 18

[Jay Patel [:jay]]

I don't see any problems in the latest branch build either:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040817
Firefox/0.9.1+ StumbleUpon/1.995

No crash and no weird behavior.

Comment 19

[:deanis74]

Now that bug 253709 is fixed, I don't think we'll hit this bug any more. 
Marking WFM.

Comment 20

[:Gavin Sharp [email: [e-mail]]]

*** Bug 242012 has been marked as a duplicate of this bug. ***