search on e-bay gets reproducable crash - Trunk [@ nsXULElement::HandleDOMEvent]

VERIFIED FIXED in mozilla0.9

Status

()

Core
HTML: Form Submission
VERIFIED FIXED
17 years ago
7 years ago

People

(Reporter: chris hofmann, Assigned: Eric Pollmann)

Tracking

({crash, top100, topcrash})

Trunk
mozilla0.9
crash, top100, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: important to mozilla0.9?, crash signature, URL)

Attachments

(2 attachments)

(Reporter)

Description

17 years ago
go to ebay
enter somthing in the search field..  hit search... boom!

Incident ID 29333426 
 Trigger Time                 2001-04-19 10:51:46 
 Email Address                 chofmann@netscape.com 
 User Comments                 search on e-bay 
 Build ID                2001041906 
 Platform ID                Win32 

nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3529] 
nsXULElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
3654] 
nsXULElement::HandleChromeEvent 
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 
4631] 
GlobalWindowImpl::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 569] 
nsDocument::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 2817] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1492] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1486] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line
429] 
nsHTMLFormElement::Submit 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 342] 
HTMLFormElementSubmit 
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLFormElement.cpp, line 427] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1034] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1590] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1506] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line
429] 
nsHTMLFormElement::Submit 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 342] 
HTMLFormElementSubmit 
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLFormElement.cpp, line 427] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1034] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1590] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1506] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line
429] 
nsHTMLFormElement::Submit 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 342] 
HTMLFormElementSubmit 
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLFormElement.cpp, line 427] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1034] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 
1590] 
nsGenericElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1506] 
nsHTMLFormElement::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line
429] 
nsHTMLFormElement::Submit 
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLFormElement.cpp, 
line 342] 
HTMLFormElementSubmit 
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLFormElement.cpp, line 427] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 815] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2707] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 831] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 903] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3336] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 943] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 155]
(Reporter)

Comment 1

17 years ago
adding dr to cc list.  latest changes in the code 
around the area at the top of the stack are:

1.331 <dr@netscape.com> 03 Apr 2001 13:39
 fix for 40105. r=jst, sr=hyatt

I'm going to put this on the 0.9 radar since it 
may be highly visable for folks that might want 
to ship betas of the 0.9 milestone.   

let me know if thats dumb..

hyatt if this isn't your bug can you pass to the right 
person quickly?  thanks
Target Milestone: --- → mozilla0.9
(Reporter)

Comment 2

17 years ago
*** Bug 76453 has been marked as a duplicate of this bug. ***
(Reporter)

Updated

17 years ago
Keywords: crash, top100
From bug 76453:

Seeing this on Linux build 2001-04-17-08 too.

Reading the JS, here's what's happening.  The form has a onSubmit handler that
does some parsing of the data in the form and unless it fits some _very_ narrow
constraints calls form.submit()

This gets us into an infinite recursion and eventually we just blow the runtime
stack.

For an even simpler testcase, try this:

<form onsubmit="this.submit(); return false;">

So it would seem that the right thing is to prevent a form from being submitted
from its own onsubmit handler... would that make sense?

What NS4.x seems to be doing is completely bypassing the onsubmit handler if
form.submit() is called inside the onsubmit handler.

OS: Windows 98 → All

Comment 4

17 years ago
choffman: my change to generic element was just for xbl anonymous content. seems
like bzbarsky is onto something, though... this probably isn't hyatt's bug.
who's the default owner for form submission?
*** Bug 76735 has been marked as a duplicate of this bug. ***
Yes more wisdom from the ages lost to the next generation! ;-)

http://lxr.mozilla.org/classic/source/lib/libmocha/lm_form.c#640

Reassigning to pollmann, cc'ing jst.

/be
Assignee: hyatt → pollmann
(Assignee)

Comment 7

17 years ago
Created attachment 31528 [details] [diff] [review]
patch, ignore recursive calls to submit and reset
Looks good to me, r=brendan@mozilla.org.

Putting on drivers' radar.

/be
Keywords: mozilla0.9
Whiteboard: important to mozilla0.9?
(Assignee)

Comment 9

17 years ago
This patch fixes the crash but the ebay form no longer submits.  The failure to
submit is due to part of my checkin for bug 64702.  I will also have to back out
half of that patch to fix this problem.  Update coming...
Status: NEW → ASSIGNED
(Assignee)

Comment 10

17 years ago
Created attachment 31756 [details] [diff] [review]
patch, ignore recursive submit/reset, don't call event handlers on form.submit/reset
Pollman: have you absorbed the libmocha wisdom fully, and protected against all
such event recursion?  It looks like that patch just checks for submit.

*** Bug 77216 has been marked as a duplicate of this bug. ***
(Assignee)

Comment 13

17 years ago
Mike, yes, this only checks for submit (and reset) recursion, it does not check
for mouse click, key press, ...  That seems like it would require a hash table
or at least a list and quite a bit more interesting logic (since event types are
no longer bits in a mask, having fun values like 1302), and nsHTMLFormElement is
certainly not the only element that is susceptible to that problem - the fix
should probably be made in a more generic place.

I reasoned that a change like that would be more time-consuming and risky than
needed for 0.9, and also fixed the source of the recursion, by backing out the
part of my old checkin that caused it.
(Assignee)

Comment 14

17 years ago
Rod said: "r=rods@netscape.com"
I'll sr=brendan@mozilla.org on the last patch, provided you file a sequel bug
(cite it here via bug#) to generalize the recursion stopper per shaver's comment
-- deal?

/be

Comment 16

17 years ago
Added topcrash keyword and Trunk [@ nsXULElement::HandleDOMEvent] to summary for 
tracking.  This a topcrasher according to Talkback for recent Trunk builds.  
Here is some info from today's report:

nsXULElement::HandleDOMEvent   23 
     First BBID :29179844
     Last BBID  :29474025
     Min Runtime :37
     Max Runtime :36442
     First Appearance Date : 2001-04-16
     Last Appearance Date : 2001-04-22
     First BuildID : 2001041606
     Last BuildID : 2001042122

Stack Trace:
I didn't want to paste the stack here since it's identical to the one already 
posted. 

Source File :      
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xul/content/src/nsXU
LElement.cpp line : 3529

User Comments and URLS:
     (29462411) URL: www.aol.com
     (29462411) Comments: Tried to sign on to AOL Anywhere.  After entering 
password and clicking on GO
     (29462411) Comments: EBX=005933e4 SS=016f ESP=00591f44 
EBP=005920a0ECX=01d87da4 DS=016f ESI=014b2ab0 FS=0f67EDX=00592230 ES=016f 
EDI=00000000 GS=0000Bytes at CS:EIP:53 8b 5d 10 56 8b 75 08 57 33 ff f6 45 18 01 
89 Stack dump:00000000 00000000 00000000 00000000
     (29462411) Comments:  00000000 00000000 00000000 00000000 00000000 00000000 
00000000 00000000 00000000 00000000 00000000 00000000 
     (29448732) Comments: using a search textfield at zdnet
     (29443304) Comments: trying ebay search.
     (29386491) URL: http://www.ebay.com
     (29386491) Comments: Typed search text into the seach text entry area and 
hit the return key. Instant core/bus fault.
     (29333426) Comments: search on e-bay
     (29326952) Comments: checking merrill lynch account
     (29293361) URL: www.rational.com/accountink
     (29237713) URL: www.ebay.com
     (29237713) Comments: Attempting to search for an item from the main page
     (29179844) Comments: trying to set a bug ID on cylcone
Keywords: topcrash
Summary: search on e-bay gets reproducable crash → search on e-bay gets reproducable crash - Trunk [@ nsXULElement::HandleDOMEvent]
(Assignee)

Comment 17

17 years ago
I filed a new bug for the generic event recursion problem as bug 77271.  (Thanks
for the r=/sr=!)

Comment 18

17 years ago
a= asa@mozilla.org for checkin to 0.9
*** Bug 77267 has been marked as a duplicate of this bug. ***
(Assignee)

Comment 20

17 years ago
Fix checked in.  To verify, type a search term in to the main search form at
http://ebay.com, then click Search.  This should not cause a crash.  Thanks!
Status: ASSIGNED → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → FIXED

Comment 21

17 years ago
Verifying on windows 98 build 2001-04-24-04-trunk
Status: RESOLVED → VERIFIED

Comment 22

17 years ago
*** Bug 77504 has been marked as a duplicate of this bug. ***
*** Bug 78049 has been marked as a duplicate of this bug. ***

Comment 24

17 years ago
Tested on Win98 (05_24_06) and Mac (05_24_05). Still crashing. Reopening bug. Is 
this a dup of 77249?
Status: VERIFIED → REOPENED
Resolution: FIXED → ---

Updated

17 years ago
Keywords: nsbeta1

Updated

17 years ago
Target Milestone: mozilla0.9 → mozilla0.9.1

Comment 25

17 years ago
WFM on Win32 build 2001052404.  Strange...

Comment 26

17 years ago
5/23 builds were crashing all over here, but 2001052406 on win2k worksforme.

you may need to install cleanly with a new profile, etc.

Comment 27

17 years ago
This works for me on 2001-05-24-09-trunk windows 98.
Status: REOPENED → RESOLVED
Last Resolved: 17 years ago17 years ago
Resolution: --- → FIXED
(Reporter)

Comment 28

17 years ago
Incident ID 30870242
Trigger Time 2001-05-24 13:14:57
Email Address chofmann@netscape.com
Client IP Address 208.12.37.181
User Comments
 search on ebay crash is back... oh boy...\
 ...about a lucky browser that made the grade
... and though the news was rather sad,
 I just had to laugh having read the booooooook
 I love to turn talk baccckk on!!!!! 

woke up.. got out of bed... ran the

Build ID 2001052409
Product ID MozillaTrunk
Platform ID Win32
Stack Trace
PlaceFrameView
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2516]
nsBlockFrame::PostPlaceLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 4090]
nsBlockFrame::PlaceLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3952]
nsBlockFrame::DoReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3418]
nsBlockFrame::DoReflowInlineFramesAuto
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3269]
nsBlockFrame::ReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3215]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2337]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 813]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableRowFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 888]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1249]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableRowGroupFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 378]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1047]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableFrame::ReflowChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2945]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1807]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 986]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1530]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
573]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
343]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2960]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2223]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2027]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 795]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
CanvasFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 579]
nsBoxToBlockAdaptor::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxToBlockAdaptor.cpp, line 869]
nsBoxToBlockAdaptor::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxToBlockAdaptor.cpp, line 525]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 985]
nsScrollBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsScrollBoxFrame.cpp, line 379]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 985]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 595]
nsGfxScrollFrameInner::LayoutBox
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1039]
nsGfxScrollFrameInner::Layout
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1149]
nsGfxScrollFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1047]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 985]
nsBoxFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 781]
nsGfxScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 738]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 745]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 538]
nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line 145]
PresShell::ProcessReflowCommand
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5712]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5767]
ReflowEvent::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5625]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072] 
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Chris: Is your stack not a dupe of bug 81905 ?

Comment 30

17 years ago
Interesting... I search for "trash" and "something" no crash, if I search for 
"test" then crash... same build... I was able to reproduce it...

Comment 31

17 years ago
Matti: yeah, the stack trace pasted above (ending in PostPlaceLine()) looks like
bug 81905.
(Reporter)

Comment 32

17 years ago
what the man said.  I'll close this and put a comment in bug 81905

that ebay search is another test case, all though that test seems
to generate random crashes.
Status: REOPENED → RESOLVED
Last Resolved: 17 years ago17 years ago
Resolution: --- → FIXED

Comment 33

17 years ago
This isnt fixed, its a duplicate
Status: RESOLVED → REOPENED
Resolution: FIXED → ---

Comment 34

17 years ago

*** This bug has been marked as a duplicate of 81905 ***
Status: REOPENED → RESOLVED
Last Resolved: 17 years ago17 years ago
Resolution: --- → DUPLICATE

Comment 35

17 years ago
verifying duplicate
Status: RESOLVED → VERIFIED
(Assignee)

Comment 36

17 years ago
In fact, to clarify things, the original bug here was indeed fixed (crash and
nsXULElement::HandleDOMEvent).  The correct resolution is FIXED, and the other
bug (crash in nsBlockFrame) is a separate, unrelated issue, of which the
original bug is not a duplicate.
Status: VERIFIED → REOPENED
Resolution: DUPLICATE → ---
(Assignee)

Comment 37

17 years ago
Fixed (one bug, one issue - makes things easier to track...  :) )
Status: REOPENED → RESOLVED
Last Resolved: 17 years ago17 years ago
Hardware: PC → All
Resolution: --- → FIXED
Target Milestone: mozilla0.9.1 → mozilla0.9

Comment 38

17 years ago
Ok, sounds good to me, verifying
Status: RESOLVED → VERIFIED

Comment 39

17 years ago
*** Bug 77249 has been marked as a duplicate of this bug. ***
Crash Signature: [@ nsXULElement::HandleDOMEvent]
You need to log in before you can comment on or make changes to this bug.