37261 - [crash] winfiles.com crashes

Status: VERIFIED DUPLICATE of bug 36558

(Core :: Layout: Form Controls, defect, P3)

Description

[Doron Rosenberg (IBM)]

winfiles.com crashes when it starts to get loaded. putting into browser-general
till we find where it belongs. Seen with today's (April 26's) nightly on win98
and winy2k.

Comment 1

[Doron Rosenberg (IBM)]

adding crash keyword

Comment 2

[Blake Ross]

repro on 2000042608 win98. 

GPF info is as follows:
MOZILLA executed an invalid instruction in
module <unknown> at 0141:00000017.
Registers:
EAX=01f39950 CS=0167 EIP=00000017 EFLGS=00010203
EBX=0285b320 SS=016f ESP=0068f2f0 EBP=0068f30c
ECX=18f36800 DS=016f ESI=01f39c20 FS=1a97
EDX=01f39c20 ES=016f EDI=01f39da4 GS=0000
Bytes at CS:EIP:
f0 73 96 00 f0 53 ff 00 f0 00 00 6b 05 28 00 56 
Stack dump:
0068f2f4 01f3016f 01a949a4 01f39c20 0068f318 020b5600 0285b320 0068f354 
01a8df13 0285b320 01f39da4 00000000 020b5600 01b2a50d 020b5600 0285b320 

Talkback picked it up, and I sent the data - lmk if anyone wants some of it 
posted here.  bumping up severity.

Comment 3

[Blake Ross]

I have taken the source from winfiles.com and reduced it down to the absolute 
bare minimum that would still crash the browser with the same error.  Removing 
any of the tags in the HTML file that I'll include in a sec will cause it to 
work correctly and not crash.  

Also, before anyone mentions it (because I know someone will) -- the crash that 
the attached HTML file produces has nothing to do with the missing </SELECT> 
tag.  You can put that back in and achieve the same results, but I figured I'd 
remove it in order to keep the testcase to the absolute minimum needed to repro 
the crash.

Comment 4

[Blake Ross]

Attachment: testcase [minimum required to repro same crash]

Comment 5

[Blake Ross]

To make it easier to study, here's the source behind the testcase:

<FONT><TABLE></TABLE><NOBR><FORM><INPUT TYPE="hidden" VALUE=""><SELECT></FORM>

Comment 6

[Asa Dotzler [:asa]]

sending to Form Controls for a first look.

Comment 7

[Blake Ross]

hmm..this is interesting...i could've sworn that earlier when i tried removing 
any one of those HTML tags, the browser no longer crashed.

Now I'm finding that just the simple code <FORM><SELECT><FORM> can crash the 
browser, whereas <FORM><SELECT></SELECT><FORM> will not (hasn't something to 
this effect been reported before?)   However, now I'm not sure if we have two 
different situations here.  After all, the original testcase I reported still 
crashes if you include the </SELECT>.  

cc'ing rickg to see if he can shed some light on the situation

Comment 8

[Jesse Ruderman]

this might be related to recently fixed bug 35934.

Comment 9

[rods (gone)]

It may be related to 35934, but it isn't a duplicate of it. The attachment still 
crashes, but with my pending fixes it works and after looking at the stack its a 
dup of 36558

*** This bug has been marked as a duplicate of 36558 ***

Comment 10

[ckritzer (gone)]

Marking VERIFIED DUPLICATE on:
- LinuxRH62 2000-09-13-08-M18 Commercial
- Win98     2000-09-13-08-M18 Mozilla
- MacOS86   2000-09-13-04-M18 Commercial