38269 - Several events crash the browser

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[ckritzer (gone)]

I may have to break this out into different bugs.  In that event (pun intended), 
I'll make this bug a tracking bug...

Overview: The events 'onUnload', 'onFocus', 'onSubmit', 'onReset', and 
'onChange' crash the browser when fired.

Steps to Reproduce:
1) Load the above page or the attached testcases
2) Follow the directions on the page/testcase
3) Crash, crash, crash...

Actual Result: Crash and burn, baby...

Expected Result:  Event will fire and you will see the notification on the page

Platforms Tested on:
 - MacOS9 2000-05-04-08-M16 Commercial Build
 - Linux6 2000-05-04-08-M16 Commercial Build
 - Win98 2000-05-04-09-M16 Commercial Build

Additional Comments:  n/a

Comment 1

[ckritzer (gone)]

Setting self as QAContact.

Comment 2

[ckritzer (gone)]

Attachment: onchange event testcase

Comment 3

[ckritzer (gone)]

Attachment: onfocus event testcase

Comment 4

[ckritzer (gone)]

Attachment: onreset event testcase

Comment 5

[ckritzer (gone)]

Attachment: onsubmit event testcase

Comment 6

[ckritzer (gone)]

Attachment: onload event testcase part 'a'

Comment 7

[ckritzer (gone)]

Attachment: onunload event testcase part 'b'

Comment 8

[ckritzer (gone)]

Sorry, the "05/05/00 06:52 onload event testcase part 'a'" should actually be
*onunload*, not onload...

More coffee please...

Comment 9

[ckritzer (gone)]

Nominating for nsbeta2 based on:
- Key functionality broken (HIGH visibility)

Comment 10

[R. Saravanan]

Bugs very similar to these are causing the xmlterm extension to crash badly.
So I'm voting for this bug.

Comment 11

[leger]

Adding crash keyword

Comment 12

[leger]

Putting on [nsbeta2+] radar for beta2 fix. 

Comment 13

[joki (gone)]

Okay, the onchange was fixed before 5/16 due to a dupe bug.

Fixes just checked in for the remaining crashes.

One note on the unload event crash.  The crash was due to recursive firing of 
the unload event by setting the page location during on unload event.  The crash 
is fixed but the page still behaves differently than in 4.x.  In 4.x the loading 
page would flash and then the js-set location would come up.  In mozilla this is 
reversed, the js-set location flashes and then the new page loads.  I discussed 
this with vidur and we both agree that the 4.x behavior was incidental and not 
designed so we're not going out of our way to be compatible with it.  The crash 
is still fixed though so this bug is still closing.

Marking fixed.

Comment 14

[ckritzer (gone)]

Marking VERIFED FIXED on:
- MacOS9 2000-06-01-20-M16 Commercial Build
- Linux6 2000-06-01-20-M16 Commercial Build
- Win98  2000-06-01-21-M16 Commercial Build