333209 - Firefox will crash when a javascript event listener redirects submit on a webform, and user clicks remember password [@ IsChildOfDomWindow]

Status: RESOLVED DUPLICATE of bug 332324

(Toolkit :: Password Manager, defect)

Description

[Josh Lange]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

Firefox will crash when a user clicks remember password on a login form. javascript event listener, connected to a submit button on a login form, calls window.stop() and sets top.location.href to a new page. 

Although this seems like it may be a useless exercise, it becomes very useful when making userscripts for greasemonkey, where you may want to execute a function in place of submitting under certain conditions, or want to preserve all the characteristics of submit (save password, press [enter] to submit, etc), which is not possible if the button is replaced my a standard button via the userscript (javascript).

any site with this type of code could crash your browser.

Reproducible: Always

Steps to Reproduce:
1. goto http://www.csc.calpoly.edu/~jhlange/crashfox/bug.html
2. enter any random user information
3. click submit
4. the page should refresh to google, and a remember password field should be present.
5. click remember password

Actual Results:  
firefox crashes and a send report window appears.

Expected Results:  
firefox should be at google, and the users password should be remembered.

This bug effects every system I have tested

I dont really consider this bug critical, but it allows any site to crash firefox, which fits under the listed descripion for critical (the software crashes).

Comment 1

[Ria Klaassen (not reading all bugmail)]

TB17332439K  TB17332380Z  TB17332366Y
I see this also in trunk.
Firefox 1.0.7 does not offer to remember the password and does not crash.

Incident ID: 17332380
Stack Signature	nsUIContext::~nsUIContext 41631d8f
Product ID	FirefoxTrunk
Build ID	2006040704
Trigger Time	2006-04-08 02:56:01.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0045d271)
URL visited	
User Comments	
Since Last Crash	26 sec
Total Uptime	23906 sec
Trigger Reason	Access violation
Source File, Line No.	c:\builds\tinderbox\fx-trunk-cairo\winnt_5.2_depend\mozilla\security\manager\boot\src\nssecurebrowseruiimpl.cpp, line 1385
Stack Trace 	
nsUIContext::~nsUIContext   nsSecureBrowserUIImpl::ConfirmMixedMode   nsHTMLFormElement::CompareNodes   nsHTMLFormElement::SubmitSubmission   0x0012f9d0

Comment 2

[Ria Klaassen (not reading all bugmail)]

Oh well, the previous one was an hourly, sorry. In the latest trunk nightly (2006-04-07) I get a somewhat different one and then it looks like this:

Incident ID: 17333013
Stack Signature	IsChildOfDomWindow 586c91fd
Product ID	FirefoxTrunk
Build ID	2006040704
Trigger Time	2006-04-08 03:30:50.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0045d70e)
URL visited	
User Comments	
Since Last Crash	47 sec
Total Uptime	24354 sec
Trigger Reason	Access violation
Source File, Line No.	c:\builds\tinderbox\fx-trunk-cairo\winnt_5.2_depend\mozilla\security\manager\boot\src\nssecurebrowseruiimpl.cpp, line 311
Stack Trace 	
IsChildOfDomWindow   nsSecureBrowserUIImpl::Notify   nsHTMLFormElement::NotifySubmitObservers   nsHTMLFormElement::SubmitSubmission   0x0012f9d0

Comment 3

[Phil Ringnalda (:philor)]

*** This bug has been marked as a duplicate of 332324 ***