70696 - Crashed in set caret

Status: VERIFIED WORKSFORME

(Core :: DOM: Editor, defect, P1)

Description

[Syd Logan]

Was using the editor (in IM compose), and crashed here. Can't imagine it is an 
editor problem at first glance.

nsCaret::DrawCaret() line 787 + 28 bytes
nsCaret::StartBlinking() line 431
nsCaret::SetCaretVisible(nsCaret * const 0x07bcd0d0, int 1) line 193 + 8 bytes
PresShell::SetCaretEnabled(PresShell * const 0x07beca50, int 1) line 2595 + 33 
bytes
nsHTMLEditRules::AfterEdit(nsHTMLEditRules * const 0x081878f4, int 8, 
nsIEditor::EDirection ePrevious) line 295
nsHTMLEditor::EndOperation(nsHTMLEditor * const 0x081cad00) line 2876 + 61 bytes
nsAutoRules::~nsAutoRules() line 125
nsPlaintextEditor::DeleteSelection(nsPlaintextEditor * const 0x081cad00, 
nsIEditor::EDirection ePrevious) line 975 + 22 bytes
nsHTMLEditorLog::DeleteSelection(nsHTMLEditorLog * const 0x081cad00, 
nsIEditor::EDirection ePrevious) line 142 + 13 bytes
nsTextEditorKeyListener::KeyPress(nsIDOMEvent * 0x0baee264) line 226
nsEventListenerManager::HandleEvent(nsIPresContext * 0x0770f580, nsEvent * 
0x0012f890, nsIDOMEvent * * 0x0012f5c8, nsIDOMEventTarget * 0x076e1a4c, unsigned 
int 2, nsEventStatus * 0x0012f7fc) line 1168 + 23 bytes
nsDocument::HandleDOMEvent(nsDocument * const 0x076e1a20, nsIPresContext * 
0x0770f580, nsEvent * 0x0012f890, nsIDOMEvent * * 0x0012f5c8, unsigned int 2, 
nsEventStatus * 0x0012f7fc) line 2783
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x076f8570, 
nsIPresContext * 0x0770f580, nsEvent * 0x0012f890, nsIDOMEvent * * 0x0012f5c8, 
unsigned int 1, nsEventStatus * 0x0012f7fc) line 1452 + 39 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f890, nsIView * 0x081c33e0, 
unsigned int 1, nsEventStatus * 0x0012f7fc) line 4867 + 47 bytes
PresShell::HandleEvent(PresShell * const 0x07beca44, nsIView * 0x081c33e0, 
nsGUIEvent * 0x0012f890, nsEventStatus * 0x0012f7fc, int 0, int & 1) line 4802 + 
25 bytes
nsView::HandleEvent(nsView * const 0x081c33e0, nsGUIEvent * 0x0012f890, unsigned 
int 8, nsEventStatus * 0x0012f7fc, int 0, int & 1) line 372
nsView::HandleEvent(nsView * const 0x081c1800, nsGUIEvent * 0x0012f890, unsigned 
int 8, nsEventStatus * 0x0012f7fc, int 0, int & 1) line 345
nsView::HandleEvent(nsView * const 0x07bedcd0, nsGUIEvent * 0x0012f890, unsigned 
int 28, nsEventStatus * 0x0012f7fc, int 1, int & 1) line 345
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x07bed6d0, nsGUIEvent * 
0x0012f890, nsEventStatus * 0x0012f7fc) line 1424
HandleEvent(nsGUIEvent * 0x0012f890) line 68
nsWindow::DispatchEvent(nsWindow * const 0x081c27f4, nsGUIEvent * 0x0012f890, 
nsEventStatus & nsEventStatus_eIgnore) line 687 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f890) line 708
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 8) 
line 2300 + 15 bytes
nsWindow::OnChar(unsigned int 8, unsigned int 8, unsigned char 1) line 2424
nsWindow::ProcessMessage(unsigned int 258, unsigned int 8, long 917505, long * 
0x0012fc44) line 2838 + 51 bytes
nsWindow::WindowProc(HWND__ * 0x00040174, unsigned int 258, unsigned int 8, long 
917505) line 923 + 27 bytes
USER32! 77e7124c()

Comment 1

[John Morrison]

I was trying to figure out how nsCaret was not editor, but, lo, aaronl was 
last to touch the affected lines (but, it's a pretty innocuous change). 
cc: sfraser

Syd, is their any way to reproduce this that you know of?

Comment 2

[Syd Logan]

"It just happened"

Comment 3

[Simon Fraser [no longer active]]

This may indicate that someone is leaking pres shells. If the caret outlives the 
window, bad things happen.

Comment 4

[Aaron Leventhal]

My changes to the caret code only take affect when the pref
accessibility.browsewithcaret is set to true.

Comment 5

[Peter Trudelle]

who should get this?

Comment 6

[Simon Fraser [no longer active]]

kin: does this look like the frames/content out of sync type of thing?

Can anyone reproduce this?

Comment 7

[kinmoz]

I don't think so, I just pulled nsCaret.cpp revs 1.66 - 1.68 which are from
around the time this bug was filed and line 787 is always around mRendContext
drawing calls.

Comment 8

[Peter Trudelle]

Since steps to reproduce do not involve setting accessibility.browsewithcaret to
true, I'm assuming this has nothing to do with Aaron's changes. ->Editor

Comment 9

[rubydoo123]

handing this to simon for debug, simon if you can talk with syd and find out 
anything on how to repro then great, moving to 9.2 based on reproducible 
testcase

Comment 10

[Simon Fraser [no longer active]]

Unless someone can repro this, I'm gonna make it worksforme

Comment 11

[Simon Fraser [no longer active]]

Non-reproducible.

Comment 12

[sujay]

verified.