Closed Bug 326468 Opened 19 years ago Closed 18 years ago

Possibility of crash [@ nsFormFillController::OnTextEntered] when autocomplete is open, document is reloaded and then autocomplete is clicked

Categories

(Toolkit :: Autocomplete, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

See upcoming testcase, follow the steps in the testcase.
Sometimes this causes a crash, talkback ID TB14799109Q:

nsFormFillController::OnTextEntered  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp, line 458]
nsAutoCompleteController::EnterMatch  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp, line 1027]
nsAutoCompleteController::HandleEnter  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp, line 278]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_CallMethod  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1230]
js_Interpret  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3794]
js_Invoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1254]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1331]
JS_CallFunctionValue  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4170]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1424]
nsJSEventListener::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsXBLPrototypeHandler::ExecuteHandler  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp, line 507]
nsXBLEventHandler::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLEventHandler.cpp, line 86]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1653]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1760]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1885]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6055]
PresShell::HandlePositionedEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5936]
PresShell::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5747]
nsViewManager::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1675]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1628]
HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 176]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1169]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6096]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6275]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1358]
USER32.dll + 0x27b17 (0x77d37b17)
USER32.dll + 0x2cdce (0x77d3cdce)
USER32.dll + 0x4435 (0x77d14435)
USER32.dll + 0x9611 (0x77d19611)
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 162]
main  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x1eb69 (0x77e5eb69)

Bug 320659 has the same backtrace, it might be the same issue.
Attached file Testcase (deleted) —
1. Double-click on the input to open the autocomplete popup (you need to have autocomplete entries at google for this)
2. Wait a second or two (the document should have reloaded by then), then click on the autocomplete popup<br>
Sometimes this results in a crash.
What I would have expected is that the autocomplete popup disappears as soon as the document unloads.
Hmm, apparently the autocomplete popup disappears when the document unloads.
However, when the mouse is over the autocomplete popup while the document unloads, the autocomplete popup doesn't disappear.

The code that (should) handles this is here, I think:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/toolkit/components/satchel/src/nsFormFillController.cpp&rev=1.59#861
This was added with bug 257354.
Attached patch patch (deleted) — Splinter Review
This works on the testcase (apparently because of the if (!eventDoc) check), but it isn't any good, because it makes autocomplete popups collapse in an environment where iframes are constantly reloading.
Summary: Possibility of crash when autocomplete is open, document is reloaded and then autocomplete is clicked → Possibility of crash [@ nsFormFillController::OnTextEntered] when autocomplete is open, document is reloaded and then autocomplete is clicked
This is worksforme now on trunk. Now the autocomplete popup disapears when the new page is loading.
Fixed between 2006-03-07 and 2006-03-08:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-03-07+04&maxdate=2006-03-08+11&cvsroot=%2Fcvsroot
Maybe fixed by bug 329335?
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → WORKSFORME
*** Bug 320659 has been marked as a duplicate of this bug. ***
No longer blocks: 320659
(In reply to comment #6)
> > Maybe fixed by bug 329335?
> 
> or possibly bug #356007?

Well, that bug wasn't in the regression range in which my bug became worksforme, but that surely would have helped also.
Crash Signature: [@ nsFormFillController::OnTextEntered]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: