Closed
Bug 387968
Opened 19 years ago
Closed 18 years ago
[FIX]Crash [@ nsDocShell::DoURILoad] with submit, onbeforunload and alert
Categories
(Core :: DOM: Navigation, defect, P1)
Tracking
()
VERIFIED
FIXED
mozilla1.9alpha8
People
(Reporter: martijn.martijn, Assigned: bzbarsky)
References
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(2 files)
|
837 bytes,
text/html
|
Details | |
|
1.14 KB,
patch
|
jst
:
review+
jst
:
superreview+
|
Details | Diff | Splinter Review |
See testcase, to reproduce the crash:
- Click the alert away
- Click on the submit button.
The iframe content consists of this:
<html><head></head>
<body><script>
var counter = 0;
window.onfocus = function(e) {
counter++;
if (counter <=1)
alert(counter);
}
</script>
<form>
<input type="submit" style="width: 100px; height: 100px;"/>
</form>
</body>
</html>
http://crash-stats.mozilla.com/report/index/94fb4e0c-30ca-11dc-b43c-001a4bd43e5c
0 @0x25f5ab8
1 nsDocShell::DoURILoad(nsIURI *,nsIURI *,int,nsISupports *,char const *,nsIInputStream *,nsIInputStream *,int,nsIDocShell * *,nsIRequest * *,int)
2 nsDocShell::InternalLoad(nsIURI *,nsIURI *,nsISupports *,unsigned int,unsigned short const *,char const *,nsIInputStream *,nsIInputStream *,unsigned int,nsISHEntry *,int,nsIDocShell * *,nsIRequest * *)
3 nsWebShell::OnLinkClickSync(nsIContent *,nsIURI *,unsigned short const *,nsIInputStream *,nsIInputStream *,nsIDocShell * *,nsIRequest * *)
4 nsFormSubmission::SubmitTo(nsIURI *,nsAString_internal const &,nsIContent *,nsILinkHandler *,nsIDocShell * *,nsIRequest * *)
5 nsHTMLFormElement::SubmitSubmission(nsIFormSubmission *)
6 nsHTMLFormElement::DoSubmit(nsEvent *)
7 nsHTMLFormElement::DoSubmitOrReset(nsEvent *,int)
8 nsHTMLFormElement::PostHandleEvent(nsEventChainPostVisitor &)
9 nsEventTargetChainItem::PostHandleEvent(nsEventChainPostVisitor &)
This seems to have regressed between 2006-05-29 and 2006-06-01:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-05-29+09&maxdate=2006-06-01+09&cvsroot=%2Fcvsroot
Can this be a regression from bug 336699, somehow?
|
Reporter | |
Comment 1•19 years ago
|
||
It can be that you have to repeat the steps to reproduce a few times, to get the crash.
Because the testcase, is on bugzilla, you get a security warning inbetween. It might interfere with the ability to crash. Otherwise, save the page to your computer and try it there to get the crash.
|
Assignee | |
Comment 2•19 years ago
|
||
Yep. The OnLinkClickSync code is violating COM rules, and was being saved before by the docshell and document (and channel!) holding pointers to the same URI object. Now they don't, so the document's URI dies when you write into it, and then we try to use that URI as a referrer.
Assignee: nobody → bzbarsky
Blocks: 336699
Priority: -- → P1
Summary: Crash [@ nsDocShell::DoURILoad] with alert, onbeforunload and alert → [FIX]Crash [@ nsDocShell::DoURILoad] with alert, onbeforunload and alert
Target Milestone: --- → mozilla1.9beta1
|
|
Assignee | |
Comment 3•19 years ago
|
||
Attachment #272106 -
Flags: superreview?(jst)
Attachment #272106 -
Flags: review?(jst)
|
||
Updated•18 years ago
|
Attachment #272106 -
Flags: superreview?(jst)
Attachment #272106 -
Flags: superreview+
Attachment #272106 -
Flags: review?(jst)
Attachment #272106 -
Flags: review+
|
|
Assignee | |
Comment 4•18 years ago
|
||
Fixed.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
|
|
Reporter | |
Comment 5•18 years ago
|
||
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a7pre) Gecko/2007071905 Minefield/3.0a7pre
Status: RESOLVED → VERIFIED
|
|
Reporter | |
Updated•18 years ago
|
Summary: [FIX]Crash [@ nsDocShell::DoURILoad] with alert, onbeforunload and alert → [FIX]Crash [@ nsDocShell::DoURILoad] with submit, onbeforunload and alert
|
||
Updated•18 years ago
|
Flags: in-testsuite?
|
||
Updated•15 years ago
|
Crash Signature: [@ nsDocShell::DoURILoad]
You need to log in
before you can comment on or make changes to this bug.
Description
•