83810 - crashes tabbing between form controls M091 Trunk[@ PresShell::GetSubShellFor]

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There are a bunch of crashes at PresShell::GetSubShellFor.  Most of the useful
user comments mention tabbing between form controls or something related.

The stack is (with all line numbers the line after, since it's Windows talkback):

PresShell::GetSubShellFor
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 5067]
nsEventStateManager::FindContentForDocShell
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 4215]
nsEventStateManager::FindContentForDocShell
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 4230]
nsEventStateManager::FindContentForDocShell
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 4230]
nsEventStateManager::FindContentForDocShell
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 4230]
nsEventStateManager::FindContentForDocShell
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 4230]
nsEventStateManager::FindContentForDocShell
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 4230]
nsEventStateManager::FindContentForDocShell
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 4230]
nsEventStateManager::FigureOutKindOfDoc
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 4329]
nsEventStateManager::ShiftFocus
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 2628]
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 1683]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 5535]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 5441]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 377]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 350]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 350]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp line 2051]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 68]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 716]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 733]
nsWindow::DispatchKeyEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 2381]
nsWindow::OnChar [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp
line 2504]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 3470]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 980]
...

Comment 1

[Shiva Thirumazhusai]

Here is initial results from M091 release

Stack Trace: 

         PresShell::GetSubShellFor      
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5067]
         nsEventStateManager::FindContentForDocShell    
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
4215]
         nsEventStateManager::FindContentForDocShell    
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
4230]
         nsEventStateManager::FindContentForDocShell    
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
4230]
         nsEventStateManager::FindContentForDocShell    
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
4230]
         nsEventStateManager::FindContentForDocShell    
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
4230]
         nsEventStateManager::FindContentForDocShell    
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
4230]
         nsEventStateManager::FindContentForDocShell    
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
4230]
         nsEventStateManager::FigureOutKindOfDoc        
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
4329]
         nsEventStateManager::ShiftFocus        
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
2628]
         nsEventStateManager::PostHandleEvent   
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp  line 
1683]
         PresShell::HandleEventInternal 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5535]
         PresShell::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5441]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  
line 377]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  
line 350]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  
line 350]
         nsViewManager::DispatchEvent   
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 2051]
         HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 
68]
         nsWindow::DispatchEvent        
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 716]
         nsWindow::DispatchWindowEvent  
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 733]
         nsWindow::DispatchKeyEvent     
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 2381]
         nsWindow::OnChar       
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 2504]
         nsWindow::ProcessMessage       
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3470]
         nsWindow::WindowProc   
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 980]
         USER32.DLL + 0x48dc (0x77e148dc)
         USER32.DLL + 0x4aa7 (0x77e14aa7)
         USER32.DLL + 0x166fd (0x77e266fd)
         nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 418]
         main1  [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  
line 1159]
         main   [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  
line 1453]
         WinMain        
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1471]
         WinMainCRTStartup()
         KERNEL32.DLL + 0x192a6 (0x77e992a6)
 
        Source File : 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsPresS
hell.cpp line : 5067
     (31499612) Comments: shift tab
     (31498290) URL: 
http://www.spacebattles.com/forums/showthread.php?s=a9eb3d6723b9afdab10e5f3dcaa5
f60e&threadid=7693
     (31498290) Comments: Reading a forum thread. Seems to occur after a certain 
set period of time.
     (31497742) URL: http://www.mail.com
     (31497742) Comments: tabbing to get to the login text box results in a 
crash.
     (31497600) URL: http://www.google.com/
     (31497600) Comments: simply clearing the address box to type in a new url.
     (31496941) URL: http://www.antisocial.com/
     (31496941) Comments: i was typing my login name
     (31491227) URL: http://www.google.com
     (31491227) Comments: I typed a keyword into the google search editbox and 
used the tab key to jump to the search button in order to press the spacebar to 
activate the button. I'm not sure if it crashed while I was tabbing or when I 
pressed the spacebar.
     (31489537) URL: https://mail.yahoo.com
     (31489537) Comments: Entered UserID/Password and it crashed
     (31485903) URL: slashdot.org
     (31485903) Comments: Just entered username and press tab to enter password.
     (31484366) URL: www.ebay.com
     (31484366) Comments: Logging into my account.
     (31483346) URL: http://slashdot.org/
     (31483346) Comments: typing my name into the login box
     (31482187) URL: https://www.thermixx.ca
     (31482187) Comments: Entering data into an order form
     (31482004) Comments: crashed on yahoo.com login page..when I hit TAB after 
typing username.
     (31479118) URL: www.excite.fr
     (31479118) Comments: I just pressed the "TAB" key...
     (31478021) URL: http://www.bofa.com
     (31478021) Comments: Go to online banking
     (31476669) URL: mp3.com -- lo fi mp3 play
     (31476669) Comments: I was tabbing through a form
     (31474571) URL: https://rex.ann.com
     (31474571) Comments: changing between input boxes with tab key (seems this 
bug has been reported already:)
     (31472884) URL: my.netscape.com
     (31472884) Comments: clicked webmail
     (31472586) URL: slashdot.org
     (31472586) Comments: Logging in using dialog on right hand side of web page
     (31472507) Comments: attempting to log on to yahoo webmail
     (31470817) URL: http://lc1.law5.hotmail.passport.com/cgi-bin/login
     (31470817) Comments: Typed in my username and just as I click on the box 
for password
     (31470460) URL: www.everything2.com
     (31470460) Comments: I tabbed from one textbox to another in the login page 
for www.everything2.com
     (31469593) URL: slashdot.org
     (31469593) Comments: trying to enter username/password to login to 
slashdot.org
     (31467491) Comments: SSL login to eBay
     (31466995) URL: www.wellsfargo.com
     (31466995) Comments: entering secure site
     (31466695) Comments: I hit yahoo chat. it died while resizing the window.  
I had several browsers open at the time
     (31465486) URL: www.mail.com
     (31465486) Comments: typing in my user name and password  in www.mail.comI 
did not finish typing in the user name when it failed.  

Comment 2

[greer]

Repro steps on M091 build:

1. Go to www.thermixx.ca 
2.click on "Purchase" 
3.enter a name in the first form space 
4.hit tab

That should be sufficient to cause a crash.

Comment 3

[Oliver Klee]

*** Bug 85791 has been marked as a duplicate of this bug. ***

Comment 4

[Oliver Klee]

*** Bug 85441 has been marked as a duplicate of this bug. ***

Comment 5

[Oliver Klee]

Comments from duplicate bug 85441:

------- Additional Comments From [e-mail] 2001-06-12 10:56 -------

WFM on Win32 build 2001061206.



------- Additional Comments From Greg Breland 2001-06-12 11:24 -------

I am still seeing this on:

Linux 2001061208
Win2K 2001061204

I am pulling the build numbers from the application titlebar and I could not
find a Win32 build any newer than the one above.

Comment 6

[Greg Breland]

The above test case did not work for me with the nightlies, but this one does.

Steps to reproduce:
--------------------
1) Kill your profile directory (rm ~/.mozilla) or eq on windows.
2) Start Mozilla and create/convert a new profile
3) Go to a web page that has a text input control.  I used bugzilla.mozilla.org
4) Focus on the text field and then press the tab key.


What Happens:
--------------
On both Win2K and Linux Mozilla crashes.


Marking OS:All as I can reproduce on Linux and Win2K with a new profile.

Comment 7

[Madhur Bhatia]

QA contact updated

Comment 8

[shrirang khanzode]

anyone working on this 1 ?  cc: Lisa. 

Comment 9

[lchiang]

I assume joki is working on this since it's a topcrash for 0.9.2.  joki?

Comment 10

[joki (gone)]

I'm working on it but I'm having trouble reproducing it on Win2K

Comment 11

[shrirang khanzode]

what i observed is if you do a bit of surfing (news.com, msn.com, 
news.yahoo.com) and then go to mail.yahoo.com or hotmail.com...sometimes....this
happens. Does not happen right away if that's the first thing I try to do.

Comment 12

[Filip Uram]

I am able to reproduce it directly after the start of browser, the only 
condition is to switch off the side bar
If I let the sidebar on, the browser won't crash

Comment 13

[joki (gone)]

I think Filip is correct, the crucial bit is turning off the sidebar.  It 
reliably crashes then.  Anyone seeing this with the sidebar on?  The tabbing 
code is wandering into a bad pointer left where the sidebar would be.

Comment 14

[joki (gone)]

Attachment: proposed patch

Comment 15

[Eric Pollmann]

Looks great to me, r=[e-mail]

(There appears to be a slight indentation problem in ~nsHTMLFrameInnerFrame, but
that is a nit and does not impact the r=)

Comment 16

[Johnny Stenback (:jst)]

sr=jst, but please do fix the indentation problem pollmann pointed out before
checking in.

Comment 17

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

a=dbaron for trunk checkin (on behalf of drivers)

Comment 18

[joki (gone)]

Fix checked in.

Comment 19

[John Morrison]

*** Bug 86011 has been marked as a duplicate of this bug. ***

Comment 20

[joki (gone)]

*** Bug 84089 has been marked as a duplicate of this bug. ***

Comment 21

[jerone]

Verified build 2001070604 win95 

Comment 22

[luis rincon]

verified on build 2001-07 -10