323297 - crash when I press enter in a form (<input>) that has display: none set [@ GetScreenOrigin]

Status: VERIFIED FIXED

(Toolkit :: Form Manager, defect)

Description

[Wójciak]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.8) Gecko/20051111 Firefox/1.5

A form contains:
-input of type image that does not submit the form, but only shows/hides a text input field (onclick="if (blah.style.display=='none') blah.style.display=''; else blah.style.display = 'none';return false;")
-text input field, that submits a form if enter is pressed (onkeydown="if (event.keyCode == 13) submit();")

If you press enter in the text field, browser crashes most of the times.

Reproducible: Always

Steps to Reproduce:
See details.

Actual Results:  
Browser crashes.

Expected Results:  
Form submission.

I tried it on a few different mashines and operating systems. The problem always occurs.
The circumstances of the problem may be wider.

Comment 1

[Frank Wein [:mcsmurf]]

Do you now see this bug with Firefox 1.5 or Mozilla (if yes, which version)?

Comment 2

[Adam Guthrie]

Could you install with talkback and get a talkback ID for the crash? http://kb.mozillazine.org/Talkback

Comment 3

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060107 SeaMonkey/1.5a
Firefox 1.5 BuildID: 2005122404 TB13912437M
Firefox 1.5 BuildID: 2005111116 TB13912195Y: 

Linux Incident ID: 13234510
MacOSX Incident ID: 13379675

TB13912195Y:
GetScreenOrigin  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp, line 149]
nsFormFillController::SetPopupOpen  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp, line 241]
nsAutoCompleteController::OpenPopup  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp, line 851]
nsAutoCompleteController::ProcessResult  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp, line 1085]
nsAutoCompleteController::OnSearchResult  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp, line 587]
nsFormFillController::StartSearch  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp, line 514]
nsAutoCompleteController::StartSearch  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp, line 899]
nsAutoCompleteController::Notify  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp, line 600]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
KERNEL32.DLL + 0x1b537 (0xbff8b537)
KERNEL32.DLL + 0x1b3e9 (0xbff8b3e9)
KERNEL32.DLL + 0x19dac (0xbff89dac)

64 crashes mostly MozillaOrgFirefox15Win322005111116: getscreenorigin
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=GetScreenOrigin&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 4

[Hermann Schwab]

maybe related: Bug 216434
autocomplete dropdown covers textbox when textbox is near bottom of screen

Comment 5

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051220 Firefox/1.6a1

doesn't crash, but shows the submitted text in the title bar.

Comment 6

[Martijn Wargers (dead)]

Attachment: testcase

Testcase from url.

Comment 7

[Martijn Wargers (dead)]

I think this is fixed somehow in current trunk builds.
I can't reproduce it anymore in current trunk build.
It also crashes in Firefox2.0 2006-05-13 build.
This seems to have been fixed between 2005-08-22 and 2005-08-23:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-08-22+08&maxdate=2005-08-23+09&cvsroot=%2Fcvsroot
Maybe fixed by bug 296036?

Comment 8

[Adam Guthrie]

*** Bug 348453 has been marked as a duplicate of this bug. ***

Comment 9

[Martijn Wargers (dead)]

Attachment: patch

This fixes the crash for me. This is only needed for branch.
The trunk already has this kind of check: http://lxr.mozilla.org/seamonkey/source/toolkit/components/satchel/src/nsFormFillController.cpp#143
I think this is also safe enough for 1.8.0.x branches.

Comment 10

[Martijn Wargers (dead)]

With the patch applied, the autocomplete popup opens in the top left of the screen.
Not pretty, but no crash and this is in fact also what current trunk builds are doing.

Comment 11

[Adam Guthrie]

Checking the result there seems pretty useful anyway since that function is always going to return NS_OK regardless of whether we can get the frame or not. http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/nsPresShell.cpp&rev=3.852.2.16&mark=5690#5685

I think you should just use:

presShell->GetPrimaryFrameFor(content, &frame);
if (!frame)
  return rect;

Comment 12

[Adam Guthrie]

Arg, I meant to say "useless" above.

Comment 13

[Martijn Wargers (dead)]

Attachment: patch2

Yeah, you're right, thanks for the info.

Comment 14

[Mike Connor [:mconnor]]

Comment on attachment 236781 [details] [diff] [review]
patch2

r+a=me

thanks!

Comment 15

[Martijn Wargers (dead)]

Checking in nsFormFillController.cpp;
/cvsroot/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp,v  <--
 nsFormFillController.cpp
new revision: 1.51.4.15; previous revision: 1.51.4.14
done

Checked in on the 1.8.1 branch.
Leaving bug open for 1.8.0.8 approval.

Comment 16

[Adam Guthrie]

Verified FIXED using Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1b2) Gecko/20060912 BonEcho/2.0b2 and the testcase from comment 6.

Comment 17

[Daniel Veditz [:dveditz]]

Bug is fixed on trunk/1.8 branch, shouldn't leave open for 1.8.0 branch.

Comment 18

[Daniel Veditz [:dveditz]]

Comment on attachment 236781 [details] [diff] [review]
patch2

approved for 1.8.0 branch, a=dveditz for drivers

Comment 19

[Martijn Wargers (dead)]

Checking in nsFormFillController.cpp;
/cvsroot/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp,v  <--
 nsFormFillController.cpp
new revision: 1.51.8.4; previous revision: 1.51.8.3
done

Checked in on the 1.8.0.x branch.

Comment 20

[juan becerra [:juanb]]

Verified fixed on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.9pre) Gecko/20061128 Firefox/1.5.0.9pre using testcase from comment #6