263609 - Crash if I scroll combobox with a lot of values (while loading or not) [@ nsComboboxControlFrame::ShowDropDown]

Status: RESOLVED WORKSFORME

(Core :: Layout: Form Controls, defect)

Description

[Maxim Shpakov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10.1

In the page at http://love.mail.ru/, there is a choice in combobox that opens a
javascript popup window => http://love.mail.ru/search_city.phtml  There then I
choose Russia as country, it begin to load City select combobox. If I actively
scroll  this combo while loading or after it completes Firfox crashes.

Reproducible: Always
Steps to Reproduce:
1.http://love.mail.ru/
2.Choose last value in the combo near submit button. It will open js popup , to
choose country\city
3.In the popup choose second value.
4. Try to scroll new combo actively. It crashes faster while loading.

Actual Results:  
FireFox crashes and  TalkBack agent is started.

Expected Results:  
Allow me to select needed value

Sorry, the site is in Russian :(

Comment 1

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20041009
Firefox/0.10

WFM

if you use the TBE/TBP extension , disable it and see if it's still a problem

Comment 2

[Maxim Shpakov]

(In reply to comment #1)
> Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20041009
> Firefox/0.10
> 
> WFM
> 
> if you use the TBE/TBP extension , disable it and see if it's still a problem

I've uninstalled FireFox.
Delete all program files\firefox stuff
Delete all profile related things from application data etc..
And cleanly installed FireFox PR 1.0  without latest patch. it seems that it
makes no sens with this.. as it fixes download manager security.
Pure Firefox. without extensions and translation\localisation of any kind.
And it generates the same crash.

AppName: firefox.exe	 AppVer: 0.10.0.0	 ModName: msvcrt.dll
ModVer: 7.0.2600.2180	 Offset: 000372e3

Talkback incident ID TB1208848E

Comment 3

[Nickolay_Ponomarev]

I reproduced it two times on a clean profile.

* You need to click the combo next to the button at love.mail.ru, select the
last entry there. 
  A popup wil open.
* There, select the secon entry in dropdown.
  The document in the popup will reload
* Open the second dropdown.
  A long list of cities will open
* Scroll it with scrollwheel, by dragging the scrollbar and with keyboard.
Optionally, click outside the popup. It will crash.

Confirming, 
->General
(I don't feel like trying to reproduce it on Mozilla)

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041008
Firefox/0.10

Comment 4

[timeless]

msvcrt.dll + 0x372e3 (0x77c372e3)

care to crash again?

Comment 5

[Nickolay_Ponomarev]

fwiw, it also crashes Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5)
Gecko/20041008, but I can't send the incident because of some weird talkback
problem.

Comment 6

[Tobias Brox]

Did not manage to reproduce it.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041229

(Serious bug in the page itself - my town (Tromsø, Northern Norway) was not
listed  ... though, it doesn't matter, I'm married anyway ;-)

Comment 7

[Maxim Shpakov]

Agreed, the page doesn't crash for me more. 
Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.7.5) Gecko/20041108 Firefox/1.0

Comment 8

[adam]

(In reply to comment #0)
> User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3)
Gecko/20040913 Firefox/0.10.1
> Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3)
Gecko/20040913 Firefox/0.10.1
> 
> In the page at http://love.mail.ru/, there is a choice in combobox that opens a
> javascript popup window => http://love.mail.ru/search_city.phtml  There then I
> choose Russia as country, it begin to load City select combobox. If I actively
> scroll  this combo while loading or after it completes Firfox crashes.
> 
> Reproducible: Always
> Steps to Reproduce:
> 1.http://love.mail.ru/
> 2.Choose last value in the combo near submit button. It will open js popup , to
> choose country\city
> 3.In the popup choose second value.
> 4. Try to scroll new combo actively. It crashes faster while loading.
> 
> Actual Results:  
> FireFox crashes and  TalkBack agent is started.
> 
> Expected Results:  
> Allow me to select needed value
> 
> Sorry, the site is in Russian :(

I experience a similar scenario when selecting any value from the top-right
combobox in this URL:
http://irc.tapuz.co.il/chat_new/index.asp?regUser=no&room=%EC%E5%E1%E9&f=
Firefox just hangs...!
Constantly reproduced.
----------------------
Windows XP SP1
Firefox version 1.7.5: 2004110711

Comment 9

[Jeff F.]

(In reply to comment #8)
> (In reply to comment #0)
> > User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3)
> Gecko/20040913 Firefox/0.10.1
> > Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3)
> Gecko/20040913 Firefox/0.10.1
> > 
> > In the page at http://love.mail.ru/, there is a choice in combobox that opens a
> > javascript popup window => http://love.mail.ru/search_city.phtml  There then 
> > choose Russia as country, it begin to load City select combobox. If I actively
> > scroll  this combo while loading or after it completes Firfox crashes.
> > 
> > Reproducible: Always
> > Steps to Reproduce:
> > 1.http://love.mail.ru/
> > 2.Choose last value in the combo near submit button. It will open js popup , to
> > choose country\city
> > 3.In the popup choose second value.
> > 4. Try to scroll new combo actively. It crashes faster while loading.
> > 
> > Actual Results:  
> > FireFox crashes and  TalkBack agent is started.
> > 
> > Expected Results:  
> > Allow me to select needed value
> > 
> > Sorry, the site is in Russian :(
> 
> I experience a similar scenario when selecting any value from the top-right
> combobox in this URL:
> http://irc.tapuz.co.il/chat_new/index.asp?regUser=no&room=%EC%E5%E1%E9&f=
> Firefox just hangs...!
> Constantly reproduced.
> ----------------------
> Windows XP SP1
> Firefox version 1.7.5: 2004110711

Me too

Comment 10

[Jeff F.]

Attachment: Breif HTm File with problem

Ok the problem ONLY occers on two situations, one the option dir has got to be
filled example dir="rtl" AND the scroll bar must be present, or FF works fineif
there are not enough to create a scrollbar its fine.

Comment 11

[Nickolay_Ponomarev]

Could you post talkback IDs of the crash?

Comment 12

[Jeff F.]

(In reply to comment #11)
> Could you post talkback IDs of the crash?

sorry hangs 4 me

Comment 13

[Bernd]

I dont see a hang/crash with a recent nightly winxp 2005040805

Comment 14

[Jeff F.]

seems resolved.

Comment 15

[Xanthor Sccas]

Still hangs for me with Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2)
Gecko/20050510 :¬/

Comment 16

[Maxim Shpakov]

Sorry, still crash for me with FF 1.0.3 ru

TB5765116Y

Comment 17

[Maxim Shpakov]

(In reply to comment #16)
> Sorry, still crash for me with FF 1.0.3 ru
> 
> TB5765116Y

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=5765116

Comment 18

[Nickolay_Ponomarev]

Stack Signature	 nsComboboxControlFrame::ShowDropDown 0de8a744
Product ID	Firefox10
Build ID	2005041420
Trigger Time	2005-05-11 22:56:56.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	FIREFOX.EXE + (0023e6d7)
URL visited	http://love.mail.ru
User Comments	
Since Last Crash	268356 sec
Total Uptime	268356 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp,
line 1694
Stack Trace 	
nsComboboxControlFrame::ShowDropDown 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp,
line 1694]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1318]
USER32.dll + 0x8734 (0x77d38734)
USER32.dll + 0x8816 (0x77d38816)
USER32.dll + 0x89cd (0x77d389cd)
USER32.dll + 0x8a10 (0x77d38a10)
nsAppShell::Run 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppShellService::Run 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 19

[chris hofmann]

jay, can you dig some more in the talkback data and track down a good owner?

Comment 20

[Jay Patel [:jay]]

Not too many crashes in Talkback data and a lot of WFMs, so marking - until we
get a better understanding of this crash and can consistently reproduce.

Comment 21

[Boris Zbarsky [:bzbarsky]]

Is this still a problem on trunk?

Comment 22

[Jesse Ruderman on Windows]

The testcase in comment 10 works fine for me on Vista.  The web page referenced in comment 0 is not as described in 2004.  So, WFM.