Closed Bug 140256 Opened 22 years ago Closed 21 years ago

OVERFLOW: hidden field + Select all + Backspace hangs Browser

Categories

(Core :: Layout: Form Controls, defect, P1)

Product:
Core
Component:
Layout: Form Controls
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED DUPLICATE of bug 175896
Milestone:
Future

People

(Reporter: juergen, Assigned: kinmoz)

References

Details

(Keywords: hang, testcase)

Attachments

(2 files)

Testcase from the reporter
128 bytes, text/html
Details
same testcase with overflow:-moz-hidden-unscrollable
146 bytes, text/html
Details 
Put the HTML below into a file and load it. Type into the text field until it is
full and continue typing until the cursor goes out of the field. Select all with
CTRL-A. Type Backspace. Browser does not react any more, grabs all the CPU time
and has to be killed with task manager.


<html>
<form>
<textarea COLS='25' NAME='text'  ROWS='4' STYLE='OVERFLOW: hidden'
WRAP='VIRTUAL'></textarea>
</form>
</html>
Unable to reproduce. Build ID 2002042410 win2k.
Build ID ?

wfm with win2k build 20020425..

OK, do like this: Select my first description (from "Put" to "manager") and
paste it into the text field.
Type

BS BS BS ^A BS BS BS BS
Keywords: hang
Getting the behaviour with win98 2002042608 following #3
Note that after pasting the text the cursor jumps outside the text field
reproduced on 2002041711/Linux ...

confirming with win2k build 20020425..

open testcase, copy+paste the reporters first decription, type a few random
chars, CTRL+A and backspace

-> HTML Form Controls
Assignee: Matti → rods
Status: UNCONFIRMED → NEW
Component: Browser-General → HTML Form Controls
Ever confirmed: true
QA Contact: imajes-qa → tpreston
-->
Assignee: rods → kin
I'm not sure if this is related -- and I haven't been unable to come up with a
testcase to reproduce it -- but I've seen some weirdness with Backspace and
forms in build 2002-04-29-branch on WinNT.

I was filing a bug comment (much like this one!).  I typed a multiline entry,
then tried to backspace from the very end of the last line -- the cursor jumped
to the "end" of the previous line and deleted from there?!  I fixed that line,
used the arrow keys to jump down again, and it did it again.  I found that there
was an extra half-space (hidden EOL character?) at the end of the bottom line
and using the left-arrow key to skip it allowed Backspace to work properly...
Tony, that's a totally different problem. If you can come up with a
reproduceable test case please file a bug against me and I'll look into it.

Following the steps in comment 3 above, I can recreate the hang on Win32. It's
an infinite loop in nsBlockFrame::DoRemoveFrame() because the following vars
have these values:


    aDeletedFrame != null
    line == line_end
    flow == null


aDeletedFrame is an nsContinuingTextFrame containing this text fragment:


  "full and continue typing until the cursor goes out of the field. Select all with"


Here's what the stack looks like:


nsBlockFrame::DoRemoveFrame(nsIPresContext * 0x05926ce0, nsIFrame * 0x0592b70c)
line 4886
nsBlockFrame::RemoveFrame(nsBlockFrame * const 0x0595ca68, nsIPresContext *
0x05926ce0, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x0592b3ac)
line 4808 + 16 bytes
FrameManager::RemoveFrame(FrameManager * const 0x059248e0, nsIPresContext *
0x05926ce0, nsIPresShell & {...}, nsIFrame * 0x0595ca68, nsIAtom * 0x00000000,
nsIFrame * 0x0592b3ac) line 1015
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x059227b8,
nsIPresContext * 0x05926ce0, nsIContent * 0x0596a770, nsIContent * 0x056654c8,
int 0, int 0) line 9676 + 58 bytes
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x059225c0, nsIPresContext *
0x05926ce0, nsIContent * 0x0596a770, nsIContent * 0x056654c8, int 0) line 1529
PresShell::ContentRemoved(PresShell * const 0x05922990, nsIDocument *
0x058a9208, nsIContent * 0x0596a770, nsIContent * 0x056654c8, int 0) line 5224 +
53 bytes
nsDocument::ContentRemoved(nsDocument * const 0x058a9208, nsIContent *
0x0596a770, nsIContent * 0x056654c8, int 0) line 2021
nsHTMLDocument::ContentRemoved(nsHTMLDocument * const 0x058a9208, nsIContent *
0x0596a770, nsIContent * 0x056654c8, int 0) line 1391
nsGenericHTMLContainerElement::RemoveChildAt(nsGenericHTMLContainerElement *
const 0x0596a770, int 0, int 1) line 4110
nsGenericElement::doRemoveChild(nsIDOMNode * 0x056654e4, nsIDOMNode * *
0x0012eb28) line 2555 + 18 bytes
nsGenericHTMLContainerElement::RemoveChild(nsGenericHTMLContainerElement * const
0x0596a770, nsIDOMNode * 0x056654e4, nsIDOMNode * * 0x0012eb28) line 582
nsHTMLDivElement::RemoveChild(nsHTMLDivElement * const 0x0596a798, nsIDOMNode *
0x056654e4, nsIDOMNode * * 0x0012eb28) line 64 + 23 bytes
DeleteElementTxn::DoTransaction(DeleteElementTxn * const 0x042b2450) line 111 +
77 bytes
EditAggregateTxn::DoTransaction(EditAggregateTxn * const 0x041f4490) line 70 +
23 bytes
DeleteRangeTxn::DoTransaction(DeleteRangeTxn * const 0x041f4490) line 160 + 9 bytes
EditAggregateTxn::DoTransaction(EditAggregateTxn * const 0x05641db8) line 70 +
23 bytes
nsTransactionItem::DoTransaction() line 181 + 18 bytes
nsTransactionManager::BeginTransaction(nsITransaction * 0x05641db8) line 1076 +
11 bytes
nsTransactionManager::DoTransaction(nsTransactionManager * const 0x0596bbd8,
nsITransaction * 0x05641db8) line 137 + 18 bytes
nsEditor::Do(nsEditor * const 0x0596a7d8, nsITransaction * 0x05641db8) line 492
+ 30 bytes
nsEditor::DeleteSelectionImpl(nsEditor * const 0x0596a7d8, short 2) line 4325 +
16 bytes
nsPlaintextEditor::DeleteSelection(nsPlaintextEditor * const 0x0596a7d8, short
2) line 941 + 20 bytes
nsTextEditorKeyListener::KeyPress(nsTextEditorKeyListener * const 0x0596c268,
nsIDOMEvent * 0x041a6e80) line 241
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x05967350,
nsIPresContext * 0x05926ce0, nsEvent * 0x0012f988, nsIDOMEvent * * 0x0012f564,
nsIDOMEventTarget * 0x042c8b00, unsigned int 7, nsEventStatus * 0x0012f7d4) line
1648 + 41 bytes
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x05961628,
nsIPresContext * 0x05926ce0, nsEvent * 0x0012f988, nsIDOMEvent * * 0x0012f564,
unsigned int 1, nsEventStatus * 0x0012f7d4) line 1665
nsHTMLTextAreaElement::HandleDOMEvent(nsHTMLTextAreaElement * const 0x05961628,
nsIPresContext * 0x05926ce0, nsEvent * 0x0012f988, nsIDOMEvent * * 0x00000000,
unsigned int 1, nsEventStatus * 0x0012f7d4) line 773 + 29 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f988, nsIView * 0x0595cdd8,
unsigned int 1, nsEventStatus * 0x0012f7d4) line 6098 + 44 bytes
PresShell::HandleEvent(PresShell * const 0x0592298c, nsIView * 0x0595cdd8,
nsGUIEvent * 0x0012f988, nsEventStatus * 0x0012f7d4, int 1, int & 1) line 6021 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x0595cdd8, nsGUIEvent * 0x0012f988, int 0)
line 2030
nsView::HandleEvent(nsViewManager * 0x05922080, nsGUIEvent * 0x0012f988, int 0)
line 306
nsViewManager::DispatchEvent(nsViewManager * const 0x05922080, nsGUIEvent *
0x0012f988, nsEventStatus * 0x0012f8f8) line 1881 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f988) line 83
nsWindow::DispatchEvent(nsWindow * const 0x0595cea4, nsGUIEvent * 0x0012f988,
nsEventStatus & nsEventStatus_eIgnore) line 865 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f988) line 886
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 8,
long 0) line 2659 + 15 bytes
nsWindow::OnChar(unsigned int 8, unsigned int 8, unsigned char 1) line 2810
nsWindow::ProcessMessage(unsigned int 258, unsigned int 8, long 917505, long *
0x0012fda8) line 3442 + 52 bytes
nsWindow::WindowProc(HWND__ * 0x038505a0, unsigned int 258, unsigned int 8, long
917505) line 1130 + 27 bytes
Status: NEW → ASSIGNED
Priority: -- → P1
Target Milestone: --- → mozilla1.0
Target Milestone: mozilla1.0 → Future
*** Bug 152960 has been marked as a duplicate of this bug. ***
Target Milestone: Future → mozilla1.1beta
Target Milestone: mozilla1.1beta → Future
Blocks: 163653
*** Bug 163653 has been marked as a duplicate of this bug. ***
Reproduced with 1/03/03 branch build, Win XP.
Keywords: testcase
*** Bug 211524 has been marked as a duplicate of this bug. ***
Unable to reproduce this or any of the dupes, 2003-11-08-05 trunk Linux.
(also tried with -moz-hidden-unscrollable)
WFM, 2004-02-08-08 trunk Windows XP and Linux.  The reason it's not reproducible
could be that it is not possible to "continue typing until the cursor goes out
of the field" anymore, even with '-moz-hidden-unscrollable' the TEXTAREA scrolls
the text to keep the caret visible at all times (which seems very reasonable
to me).  WORKSFORME?

*** This bug has been marked as a duplicate of 175896 ***
Status: ASSIGNED → RESOLVED
Closed: 21 years ago
Resolution: --- → DUPLICATE
v
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: