289507 - Crash when closing tab with a form

Status: RESOLVED DUPLICATE of bug 289379

(SeaMonkey :: UI Design, defect)

Description

[kmike]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050407
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050407

While attempting to track down form loss bug, I found that closing a tab with a
form crashes my build. It appears to be broken ever since 20050118 (oldest build
I have).

Reproducible: Always

Steps to Reproduce:
1. Open browser, load testcase: http://12.156.2.37/~external/1.htm
2. Open another tab, load any page (not testcase) into it
3. Switch to the first tab, press "CTRL-W" to close it


Actual Results:  
Browser crashes.

Expected Results:  
Close a tab and continue.


It appears pressing "close tab" button doesn't trigger this bug, only "CTRL-W" does.
The testcase was taken from www.zmail.ru webmail interface, but I found that
closing a tab with bugzilla query page or new bug report page crashes, too,
though I have to load some other page in the tab, then go back to a page with a
form and then close it to trigger crash.

XP Apps component is my wild guess, sorry if I'm wrong.

I don't have a debug build, so stack trace is rather non-descript:

#0  0x00000038 in ?? ()
#1  0x400546bf in nsQueryInterface::operator() ()
   from /home/mike/mozilla/libxpcom_core.so
#2  0x400547fb in nsCOMPtr_base::assign_from_qi ()
   from /home/mike/mozilla/libxpcom_core.so
#3  0x450e2d36 in NSGetModule ()
   from /home/mike/mozilla/components/libeditor.so
#4  0x41c371e1 in NSGetModule ()
   from /home/mike/mozilla/components/libgklayout.so
....
#13 0x417d0db5 in NSGetModule ()
   from /home/mike/mozilla/components/libwidget_gtk2.so
#14 0x417d0b40 in NSGetModule ()
   from /home/mike/mozilla/components/libwidget_gtk2.so
#15 0x417c9ba5 in ?? () from /home/mike/mozilla/components/libwidget_gtk2.so
#16 0x083300b8 in ?? ()
#17 0x08128430 in ?? ()
#18 0xbfffdf1c in ?? ()
#19 0x417c5531 in ?? () from /home/mike/mozilla/components/libwidget_gtk2.so
#20 0x083300b8 in ?? ()
#21 0x082e77d0 in ?? ()
#22 0x083300b8 in ?? ()
#23 0x41dfbab4 in ?? () from /home/mike/mozilla/components/libgklayout.so
#24 0x083461f8 in ?? ()
#25 0xbfffdf54 in ?? ()
#26 0xbfffdfbc in ?? ()
#27 0x41d41b62 in NSGetModule ()
   from /home/mike/mozilla/components/libgklayout.so
#28 0x41d41b62 in NSGetModule ()
   from /home/mike/mozilla/components/libgklayout.so
#29 0x400b6329 in XPTC_InvokeByIndex ()
   from /home/mike/mozilla/libxpcom_core.so
#30 0x40d3fe3c in NSGetModule ()
   from /home/mike/mozilla/components/libxpconnect.so
#31 0x40d463b7 in NSGetModule ()
   from /home/mike/mozilla/components/libxpconnect.so
#32 0x40123acb in js_Invoke () from /home/mike/mozilla/libmozjs.so
#33 0x4011019a in js_fun_toString () from /home/mike/mozilla/libmozjs.so
#34 0x40123acb in js_Invoke () from /home/mike/mozilla/libmozjs.so
#35 0x4011b271 in js_Interpret () from /home/mike/mozilla/libmozjs.so
#36 0x40123d50 in js_Invoke () from /home/mike/mozilla/libmozjs.so
#37 0x40123ff3 in js_InternalInvoke () from /home/mike/mozilla/libmozjs.so
#38 0x400ecd69 in JS_CallFunctionValue () from /home/mike/mozilla/libmozjs.so
#39 0x41d34821 in NSGetModule ()
   from /home/mike/mozilla/components/libgklayout.so
#40 0x41d40612 in NSGetModule ()
   from /home/mike/mozilla/components/libgklayout.so
#41 0x41d407a0 in NSGetModule ()
   from /home/mike/mozilla/components/libgklayout.so
#42 0x400a03dc in nsTimerImpl::Fire () from /home/mike/mozilla/libxpcom_core.so
#43 0x400a0474 in handleTimerEvent () from /home/mike/mozilla/libxpcom_core.so
#44 0x4009bb67 in PL_HandleEvent () from /home/mike/mozilla/libxpcom_core.so
#45 0x4009c3c4 in PL_ProcessPendingEvents ()
   from /home/mike/mozilla/libxpcom_core.so
#46 0x4009da95 in nsEventQueueImpl::CheckForDeactivation ()
   from /home/mike/mozilla/libxpcom_core.so
#47 0x417cef05 in ?? () from /home/mike/mozilla/components/libwidget_gtk2.so
#48 0x080dc400 in ?? ()
#49 0x082f0bf8 in ?? ()
#50 0xbfffed58 in ?? ()
#51 0x405f59c7 in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#52 0x405f59c7 in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#53 0x405d17bb in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#54 0x405d3242 in g_main_context_acquire () from /usr/lib/libglib-2.0.so.0
#55 0x405d34ef in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#56 0x402e2f97 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#57 0x417cf6ca in ?? () from /home/mike/mozilla/components/libwidget_gtk2.so
#58 0x08135528 in ?? ()
#59 0x08058218 in ?? ()
#60 0xbfffeed8 in ?? ()
#61 0x4005464c in nsCOMPtr_base::assign_with_AddRef ()
   from /home/mike/mozilla/libxpcom_core.so
#62 0x416e1cd4 in NSGetModule ()
   from /home/mike/mozilla/components/libappcomps.so
#63 0x0804ca61 in ?? ()
#64 0x08136858 in ?? ()
#65 0x08050927 in nsICmdLineService::GetIID()::iid ()
#66 0xbffff048 in ?? ()
#67 0x08050b60 in nsIProfile::GetIID()::iid ()
#68 0x4002de79 in ?? () from /home/mike/mozilla/libxpcom_core.so
#69 0x00000000 in ?? ()

Sometimes stacktrace begins differently:
#0  0x08676897 in ?? ()
#1  0x40054759 in nsCOMPtr_base::assign_from_helper ()
   from /home/mike/mozilla/libxpcom_core.so
#2  0x450e7de2 in NSGetModule ()
   from /home/mike/mozilla/components/libeditor.so
#3  0x450e2d96 in NSGetModule ()
   from /home/mike/mozilla/components/libeditor.so
#4  0x41c371e1 in NSGetModule ()
   from /home/mike/mozilla/components/libgklayout.so
...
and then goes like previous one.

Comment 1

[William Price]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050407
Firefox/1.0+

WFM Win32...
will attempt to test on a Linux box later.

Comment 2

[Tarmo Järvalt]

Testcase crashes every time with Ctrl+W but only if focus is one of the
input/text boxes.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050407

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment 2 si definitely bug 289379, but the original bug filed here is not...

Reporter, can you possibly retest in tomorrow's build?  If you still see the
crash, any chance of a talkback incident id or stack from a build with symbols?

Comment 4

[kmike]

Just updated my tree and rebuilt, the crash is still here.
What makes it similar to bug 289430 is that cursor must be in textfield to
repdoruce a crash. When focus is out, I can't trigger it.

I'll have to free some gig or more to be able to do a debug build... most
probably not today. Do nightly builds have talkback enabled? If yes, I can
download one and test.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Yes, nightly builds should have talkback enabled.

Comment 6

[kmike]

Well, the only GTK2 nightly installer build after bug 289379 checkin is
corrupted, so I tried gtk1 build and it didn't experience the crash.
I then re-pulled the tree, rebuilt and the crash is gone! I probably got mozilla
dirs tangled up before... Sory for the spam, seems like it IS a duplicate of the
bug 289379, after all.


*** This bug has been marked as a duplicate of 289379 ***