219895 - Crash on table delete row in composer [@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons]

Status: RESOLVED DUPLICATE of bug 243809

(SeaMonkey :: Composer, defect)

Description

[Jim Booth]

User-Agent:       Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.5b) Gecko/20030917
Build Identifier: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.5b) Gecko/20030917

Deleting a row in a table causes a crash when there is a <!-- comment --> in the
row below the one being deleted.

Reproducible: Always

Steps to Reproduce:
1. Insert a 2 x 2 table in a blank Composer page
2. switch to source view, and insert <!-- comment --> in the first cell in the
second row
3. switch back to Normal view and use Menu Table/Delete/Row to delete the FIRST
row in the table.  (Also happens with RightClick/TableDelete/Row)
Actual Results:  
Composer crashes

Expected Results:  
The row should be deleted.

Talkback IDs TB23776207Q, TB23775821M, TB23775556W, TB23775375G, TB23775361G,
TB23775284Q, TB23775235X, TB23775086M, TB23774822K, TB23774783X.

Problem occurs in builds at least as far back as 20030807 but does not occur in
20030627, the next oldest release I had to test.   I will try to narrow it down
further.

Comment 1

[Jim Booth]

ccing Daniel Glazman

Comment 2

[Hermann Schwab]

dupe of 217717?
Bug 217717 crash [@ nsHTMLEditor::GetCSSBackgroundColorState] deleting table in
compose window

Comment 3

[Lorenzo Colitti]

Attachment: testcase

testcase

Comment 4

[Lorenzo Colitti]

Confirming with Linux trunk build 2003110505, so this is not a duplicate.

Comment 5

[Anders Pedersen]

(In reply to comment #0)
> User-Agent:       Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.5b)
Gecko/20030917
> Build Identifier: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.5b)
Gecko/20030917
> 
> Deleting a row in a table causes a crash when there is a <!-- comment --> in the
> row below the one being deleted.
> 
> Reproducible: Always
> 
> Steps to Reproduce:
> 1. Insert a 2 x 2 table in a blank Composer page
> 2. switch to source view, and insert <!-- comment --> in the first cell in the
> second row
> 3. switch back to Normal view and use Menu Table/Delete/Row to delete the FIRST
> row in the table.  (Also happens with RightClick/TableDelete/Row)
> Actual Results:  
> Composer crashes
> 
> Expected Results:  
> The row should be deleted.
> 
> Talkback IDs TB23776207Q, TB23775821M, TB23775556W, TB23775375G, TB23775361G,
> TB23775284Q, TB23775235X, TB23775086M, TB23774822K, TB23774783X.
> 
> Problem occurs in builds at least as far back as 20030807 but does not occur in
> 20030627, the next oldest release I had to test.   I will try to narrow it down
> further.


Crashes here...

talkbackid: TB8706M
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040330
Microsoft Windows 2000 Pro 5.00.2195 SP4

Comment 6

[Asa Dotzler [:asa]]

nsHTMLEditor::CheckSelectionStateForAnonymousButtons
[/mozilla/editor/libeditor/html/nsHTMLAnonymousUtils.cpp, line 211]
nsHTMLEditor::EndUpdateViewBatch
[/mozilla/editor/libeditor/html/nsHTMLEditor.cpp, line 5981]
nsEditor::EndTransaction [/mozilla/editor/libeditor/base/nsEditor.cpp, line 725]
XPTC_InvokeByIndex [/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2029]
XPC_WN_CallMethod [/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line
1288]
js_Invoke [/mozilla/js/src/jsinterp.c, line 943]
js_Interpret [/mozilla/js/src/jsinterp.c, line 2964]
js_Invoke [/mozilla/js/src/jsinterp.c, line 959]
nsXPCWrappedJSClass::CallMethod
[/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1338]
nsXPCWrappedJS::CallMethod [/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line
450]
PrepareAndDispatch [/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 119]
SharedStub [/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsControllerCommandTable::DoCommand
[/mozilla/embedding/components/commandhandler/src/nsControllerCommandTable.cpp,
line 192]
nsBaseCommandController::DoCommand
[/mozilla/embedding/components/commandhandler/src/nsBaseCommandController.cpp,
line 133]
XPTC_InvokeByIndex [/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2029]
XPC_WN_CallMethod [/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line
1288]
js_Invoke [/mozilla/js/src/jsinterp.c, line 943]
js_Interpret [/mozilla/js/src/jsinterp.c, line 2964]
js_Invoke [/mozilla/js/src/jsinterp.c, line 959]
js_InternalInvoke [/mozilla/js/src/jsinterp.c, line 1036]
JS_CallFunctionValue [/mozilla/js/src/jsapi.c, line 3591]
nsJSContext::CallEventHandler [/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1272]
nsJSEventListener::HandleEvent [/mozilla/dom/src/events/nsJSEventListener.cpp,
line 181]
nsEventListenerManager::HandleEventSubType
[/mozilla/content/events/src/nsEventListenerManager.cpp, line 1435]
nsEventListenerManager::HandleEvent
[/mozilla/content/events/src/nsEventListenerManager.cpp, line 1512]
nsXULElement::HandleDOMEvent [/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2851]
PresShell::HandleDOMEventWithTarget
[/mozilla/layout/html/base/src/nsPresShell.cpp, line 6103]
nsMenuFrame::Execute [/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 1651]
nsMenuFrame::HandleEvent [/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 443]
PresShell::HandleEventInternal [/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6073]
PresShell::HandleEvent [/mozilla/layout/html/base/src/nsPresShell.cpp, line 5948]
nsViewManager::HandleEvent [/mozilla/view/src/nsViewManager.cpp, line 2281]
nsViewManager::DispatchEvent [/mozilla/view/src/nsViewManager.cpp, line 2025]
HandleEvent [/mozilla/view/src/nsView.cpp, line 79]
nsWindow::DispatchEvent [/mozilla/widget/src/windows/nsWindow.cpp, line 1068]
nsWindow::DispatchWindowEvent [/mozilla/widget/src/windows/nsWindow.cpp, line 1085]
nsWindow::DispatchMouseEvent [/mozilla/widget/src/windows/nsWindow.cpp, line 5225]
ChildWindow::DispatchMouseEvent [/mozilla/widget/src/windows/nsWindow.cpp, line
5478]
nsWindow::ProcessMessage [/mozilla/widget/src/windows/nsWindow.cpp, line 4063]
nsWindow::WindowProc [/mozilla/widget/src/windows/nsWindow.cpp, line 1347]
USER32.dll + 0x2a2d0 (0x77e3a2d0)
USER32.dll + 0x45e5 (0x77e145e5)
USER32.dll + 0xa816 (0x77e1a816)
nsAppShellService::Run [/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 524]
main1 [/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1309]
main [/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1713]
WinMain [/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1735]
WinMainCRTStartup()
KERNEL32.DLL + 0x287e7 (0x7c5987e7)

Comment 7

[Greg K.]

Reproduced using Mac/2004031613. Setting All/All.

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

*** Bug 244103 has been marked as a duplicate of this bug. ***

Comment 9

[James Lockie]

The message/test case of bug 244103 does not have a table.
Since it has been determined that this is the same bug because of the stack
trace then the description of this bug is incorrect.

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

208   // what's its tag?
209   nsAutoString focusTagName;
210   res = focusElement->GetTagName(focusTagName);
211   if (NS_FAILED(res)) return res;

It looks like this is all about a tag, specifically.  Whether or not it's a
table that's containing it shouldn't matter.

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

Duping to a bug with a patch and a review...

*** This bug has been marked as a duplicate of 243809 ***