193405 - Trunk M130B crash editing mail forward [@ nsTableRowGroupFrame::FindFrameAt]

Status: RESOLVED FIXED

(MailNews Core :: Composition, defect)

Description

[Jay Patel [:jay]]

This is a topcrasher with recent MozillaTrunk builds and Mozilla 1.3 Beta.  I
was also able to reproduce this crash with the following steps:

1. select an email to forward that has tables in it.
2. in the mail composition window that is opened, use the arrow keys to move the
cursor around...up and down through the table. 
3. eventually you will see the crash.  i think i crashed when i got to the end
of the table.

Here is my incident:
Incident ID 17201979
Stack Signature 	nsTableRowGroupFrame::FindFrameAt f535827d
Email Address 	[e-mail]
Product ID 	MozillaTrunk
Build ID 	2003021308
Trigger Time 	2003-02-14 14:29:25
Platform 	Win32
Operating System 	Windows NT 5.1 build 2600
Module 	gklayout.dll
URL visited 	mail editor
User Comments 	i was forwarding an email and used the arrow keys to move the
cursor though a table...and after a few clicks going up and down...boom!
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp
Trigger Line No. 	2066
Stack Trace 	
nsTableRowGroupFrame::FindFrameAt
[c:/builds/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 2066]
nsFrame::GetNextPrevLineFromeBlockFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp, line 3328]
nsFrame::PeekOffset
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp, line 3876]
nsTextFrame::PeekOffset
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsTextFrame.cpp, line 4034]
nsSelection::MoveCaret
[c:/builds/seamonkey/mozilla/content/base/src/nsSelection.cpp, line 1637]
nsSelection::LineMove
[c:/builds/seamonkey/mozilla/content/base/src/nsSelection.cpp, line 3261]
PresShell::LineMove
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 3169]
nsSelectionMoveCommands::DoCommand
[c:/builds/seamonkey/mozilla/editor/libeditor/base/nsEditorCommands.cpp, line 580]
nsControllerCommandManager::DoCommand
[c:/builds/seamonkey/mozilla/embedding/components/commandhandler/src/nsControllerCommandManager.cpp,
line 180]
nsBaseCommandController::DoCommand
[c:/builds/seamonkey/mozilla/embedding/components/commandhandler/src/nsBaseCommandController.cpp,
line 134]
nsXBLPrototypeHandler::ExecuteHandler
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp, line 326]
nsXBLWindowHandler::WalkHandlersInternal
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLWindowHandler.cpp, line 312]
nsXBLWindowKeyHandler::WalkHandlers
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp, line 181]
nsXBLWindowKeyHandler::KeyPress
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLWindowKeyHandler.cpp, line 197]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1662]
nsWindowRoot::HandleChromeEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsWindowRoot.cpp, line 215]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 827]
nsXULDocument::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2583]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3376]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3368]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3368]
nsXULElement::HandleChromeEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 4499]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 827]
nsDocument::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp, line 3524]
nsGenericElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericElement.cpp, line 1960]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6212]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6163]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2164]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 304]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1948]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 83]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1119]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1136]
nsWindow::DispatchKeyEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3017]
nsWindow::OnKeyDown
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3106]
USER32.dll + 0x5793 (0x77d45793) 

And more data from Talkback:
nsTableRowGroupFrame::FindFrameAt   17 
BBID range: 17009022 - 17173053
Min/Max Seconds since last crash: 540 - 432124
Min/Max Runtime: 598 - 432124
Crash data range: 2003-02-06 to 2003-02-13
Build ID range: 2003020408 to 2003021304

Stack Trace: 

	 nsTableRowGroupFrame::FindFrameAt
[c:/builds/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp 
line 2066]
	 nsFrame::GetNextPrevLineFromeBlockFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp  line 3328]
	 nsFrame::PeekOffset
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp  line 3876]
	 nsFrame::GetNextPrevLineFromeBlockFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp  line 3340]
	 nsBlockFrame::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 5994]
	 PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6246]
	 PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6136]
	 nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp  line 2210]
	 nsView::HandleEvent	[c:/builds/seamonkey/mozilla/view/src/nsView.cpp  line 304]
	 nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp  line 1948]
	 HandleEvent	[c:/builds/seamonkey/mozilla/view/src/nsView.cpp  line 83]
	 nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1119]
	 nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1136]
	 nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 5378]
	 ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 5633]
	 nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 4133]
	 nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 1403]
	 KERNEL32.DLL + 0x363b (0xbff7363b)
	 KERNEL32.DLL + 0x24407 (0xbff94407)
	 0x00658b66
 
 	Source File :
c:/builds/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp line
: 2066
     (17170963)	Comments: Working....
     (17154728)	URL: http://www.vuosaarensatama.net/
     (17154726)	URL: http://www.vuosaarensatama.net/
     (17140803)	Comments: editing an html-doc
     (17136736)	URL: www.oscars.org
     (17136736)	Comments: mail crashed while trying to delete a "forwarding"
table in a message
     (17115623)	URL: http://www.audiovox.com/faqaec.html
     (17115623)	Comments: filling out a form.  Basic editing (typing  deleting 
moving cursor  cut-and-paste using keys (not mouse))
     (17106750)	Comments: Entering some ticket into RT... oops  data lost...
     (17104490)	Comments: Editing a multi line textbox  hitting with the cursor
multiple time the vertical end of the entry and going up/down.
     (17090511)	Comments: deleteing a table in mail I was Fwd
     (17028635)	Comments: Cursor right at end of textarea
     (17009022)	URL: https://www.safe-mail.net
     (17009022)	Comments: browsing

Please correct me if I picked the wrong component and rassign.  Thanks.

Comment 1

[Bernd]

jpatel could you please attach the testcase to the bug, wfm win98 :-(

Comment 2

[Bernd]

I changed the code that crashes, patch coming up, but I would like to be able to
reproduce the crash first.

Comment 3

[Bernd]

Attachment: patch

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 114603 [details] [diff] [review]
patch

Is this something that's not supposed to happen?  If so, could you add an
assertion (probably using NS_NOTREACHED and adding {})?  Other than that,
sr=dbaron.

Comment 5

[Bernd]

You can't create cellmap holes with the composer itself, but it is easy to
create them with normal html

<table>
<tr><td><td><td rowspan=2></tr>
<tr><td></tr>
</table>

this will create a hole under the second table cell in the second row.

Comment 6

[Bernd]

fix checked in

Comment 7

[Matthias Versen [:Matti]]

*** Bug 198324 has been marked as a duplicate of this bug. ***