205548 - crash when doing multiple redo commands [nsHTMLEditor::CheckResizingState]

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P1)

Description

[sairuh (rarely reading bugmail)]

found using 2003.05.13.08 comm builds on Mac OS X 10.2.6. so far i cannot repro
this on win2k or linux rh8.0.

1. open a new editor window.
2. enter a line of text, hit Return.
3. create a list, add three or so list items.
4. hit Return twice, to end the list and add two new lines.
5. add a table (taking default values is fine), hit Return.
6. enter six or so lines of text, hitting Return after each one.
7. hold down command key and hit Z (cmd+Z) to undo everything (including the
removal of the first line of text in step 2).
8. now hold down both shift and command key and hit Z to *redo* the changes from
step 7.

results: some time during step 8, the app will crash.

crash report coming up.

Comment 1

[sairuh (rarely reading bugmail)]

Attachment: crash report in nsHTMLEditor::CheckResizingState(nsISelection*)

Comment 2

[sairuh (rarely reading bugmail)]

looks like this regressed sometime btwn the 2003.03.31 build and 2003.04.16
build. will narrow down some more.

also, this can be reproduced by accessing the commands from the Edit menu (ie,
not limited to keyboard shortcuts).

Comment 3

[Joe Francis]

Is this yours, Daniel?

Comment 4

[Greg K.]

Seems to WorkForMe using FizzillaMach/2003-05-07-14-1.4b. Tried several
undo/redo cycles.

Comment 5

[sairuh (rarely reading bugmail)]

narrowed this down: works with 2003.04.15.08 build, but broken in 2003.04.16.09.

Comment 6

[Kathleen :Brade]

Sairuh--are you sure you didn't resize the table in your steps?
Daniel--is this code supposed to be triggered only during resize or on a
mousedown or ?

I have doubts that this is really platform-specific...

Comment 7

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

Confirming and taking.

Comment 8

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

I see major errors in transactions when doing this undo/redo.
Furthermore, there is no checkin related to resizing between 14-april and
17-april.... I suspect that the crash in my code is a side effect of a big
bug somewhere else.

Comment 9

[sairuh (rarely reading bugmail)]

got it to crash on today's linux build (odd that it didn't occur y'day after
numerous attempts, eh well).

i don't think i did any resizing --the resize handles didn't appear around the
table in the builds where i got the crash. (unless it isn't necessary for the
handles to appear in order to initiate resizing behavior.)

Comment 10

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

Sairuh: right. I have narrowed the bug, it is caused by a VERY big bug in
transactions and undo/redo. In some cases, type a line of text, insert a table
(sometimes, the caret is not placed inside the 1st cell but after the table,
that's the case we're looking for), type another line. 
undo 5 times, start redoing and redoing. At some point, we hit a big action
nesting problem and THAT causes my code to crash. I am adding some constraints
so it won't crash any more BUT it exposes the bug above.

Comment 11

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

As I said above:

An error occurred executing the cmd_redo command
An error occurred updating the cmd_paragraphState command:
[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE)
[nsICommandController.getCommandStateWithP
arams]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://editor/content/ComposerCommands.js :
: goUpdateCommandState :: line 256"  data: no]
An error occurred updating the cmd_fontFace command:
[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE)
[nsICommandController.getCommandStateWithP
arams]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://editor/content/ComposerCommands.js :
: goUpdateCommandState :: line 256"  data: no]
An error occurred updating the cmd_fontColor command:
[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE)
[nsICommandController.getCommandStateWithP
arams]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://editor/content/ComposerCommands.js :
: goUpdateCommandState :: line 256"  data: no]
An error occurred updating the cmd_backgroundColor command:
[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE)
[nsICommandController.getCommandStateWithP
arams]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://editor/content/ComposerCommands.js :
: goUpdateCommandState :: line 256"  data: no]
An error occurred updating the cmd_highlight command:
[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE)
[nsICommandController.getCommandStateWithP
arams]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://editor/content/ComposerCommands.js :
: goUpdateCommandState :: line 256"  data: no]
An error occurred updating the cmd_align command:
[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE)
[nsICommandController.getCommandStateWithP
arams]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://editor/content/ComposerCommands.js :
: goUpdateCommandState :: line 256"  data: no]
An error occurred executing the cmd_redo command

Comment 12

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

Attachment: fix for crasher

WARNING: this fixes the crasher; the original bug causing my code to fail
is ***very*** old. I have downloaded 1.3b and have reproduced the "nesting
actions" error there, it is impossible to undo/redo totally in the test case
described above.

Comment 13

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

we should _not_ crash here; nominating 1.4 blocker

Comment 14

[Kathleen :Brade]

Comment on attachment 123388 [details] [diff] [review]
fix for crasher

r=brade
seeking 1.4final approval for this fix.  It is simply adding a null check so we
don't crash.

Comment 15

[Simon Fraser [no longer active]]

I'm sure joe and kin would like to hear about txnmgr problems.

Comment 16

[(not reading, please use [e-mail] instead)]

Comment on attachment 123388 [details] [diff] [review]
fix for crasher

a=sspitzer

Comment 17

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

Simon: I am going to check that code first, and that will allow to expose the
txn bug without crashing. Again, this is an old bug, I can reproduce it with
builds from the beginning of february.

Comment 18

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

checked in (trunk)

Comment 19

[Simon Fraser [no longer active]]

Did you file a bug on the underlying transaction manager problems?

Comment 20

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

bug 205949 spun off from the current one.

Comment 21

[sairuh (rarely reading bugmail)]

using 2003.05.19.08 comm builds, i no longer crash.

however, i do see strange redo behavior --see bug 205949 comment 2 for details.

marking this verified.