Closed Bug 90521 Opened 23 years ago Closed 23 years ago

Crash while undoing after splitting a nested inline

Categories

(Core :: DOM: Editor, defect, P1)

defect

Tracking

()

VERIFIED DUPLICATE of bug 84645
mozilla0.9.3

People

(Reporter: kinmoz, Assigned: waterson)

Details

(Keywords: crash)

Attachments

(2 files)

If I load the following HTML into composer:

<html><body><i>Line 1<br>Line 2 <b>bold text</b></i></body></html>

and follow these steps, I crash:

1. Load sample file in composer.
2. Click after "bold text" to place the caret at the end of the line.
3. Hit the return key.
4. Type a word. (Notice that what you typed is bold)
5. Select the word you typed.
6. Hit the bold button on the tool bar to unbold the selection.
7. Ctrl-Z to undo. (Notice that what you typed and "bold text" disappear?)
8. Ctrl-Z to undo again.

You should now crash!
Keywords: crash
Priority: -- → P1
Target Milestone: --- → mozilla0.9.3
Attached file Test case.
Status: NEW → ASSIGNED
Severity: major → critical
nsBranch -- need to get a fix in the trunk as quick as possible
Keywords: nsBranch
I just attatched a JS test case that reproduces the crash without an Editor! 
Just press the buttons in the test case to reproduce the crash. Use the "Dump 
Contents" button, at any point before you crash, to see what the current dom 
tree looks like.

Step 1 is basically changing this:

    <i><b>bold text<br></b>more text<b><br></b></i>

to this:

    <i><b>bold text<br>more text<br></b></i>

You'll notice that after Step 1, new frames are not created for the portion of 
the doc that changed, so it looks like the content disappears. But it's actually 
there in the DOM tree.

If you then try to modify any portion of the dom tree we modified in step 1, you 
will crash! (Step 2)
Assignee: kin → attinasi
Status: ASSIGNED → NEW
waterson said he'd like to take a look at this one.

I'm thinking bug 90528 might also be caused by whatever is causing this bug.
Assignee: attinasi → waterson
This is caused by the same basic problem that is causing bug 84645. We need to
fix up |parentFrame| in ContentInserted() if we're inserting beneath a continuation.

*** This bug has been marked as a duplicate of 84645 ***
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → DUPLICATE
v
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: