344927 - crash [@ nsContentIterator::NextNode] if I drag an element past the end of document that contains an XBL element

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect)

Description

[gamerson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060714 SeaMonkey/1.5a
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060714 SeaMonkey/1.5a

Here is the TB id of the crash.
TB21040078M

I found this crash while working on my application that embeds the mozilla editor.  I was editing a document that had an element with an XBL binding.  In the document, there was an XBL element at the very end of the document.  Then I dragged an image element past the end of the document and tried to do a drop.  That is when I got the crash.

Reproducible: Always

Steps to Reproduce:
1. Open the zip attachment that contains a folder with 2 files.
2. Open the custom.html with mozilla. Once the document loads, it turns on the editor using "designMode=on".
3. Drag the image element below the blue line and drop it.

Actual Results:  
Mozilla crashes after the drop.

Expected Results:  
The drop show have placed the image at the end of the document.

TB21040078M

Comment 1

[gamerson]

Attachment: Zip file with files needed to replicate the crash

Comment 2

[Nickolay_Ponomarev]

Incident ID: 21040078
Stack Signature	nsContentIterator::NextNode b5b6935c
Product ID	MozillaTrunk
Build ID	2006071409
Trigger Time	2006-07-17 07:59:40.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	gklayout.dll + (000e983f)
URL visited	
User Comments	Loaded my reproducable crash test case that involes designMode for a document (editor) and an element with a XBL binding.
Since Last Crash	30 sec
Total Uptime	56 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsContentIterator.cpp, line 828
Stack Trace 	
nsContentIterator::NextNode  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsContentIterator.cpp, line 828]
nsContentIterator::Next  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsContentIterator.cpp, line 1006]
nsHTMLEditRules::AdjustSpecialBreaks  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLEditRules.cpp, line 7239]
nsHTMLEditRules::AfterEditInner  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLEditRules.cpp, line 462]
nsHTMLEditRules::AfterEdit  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLEditRules.cpp, line 394]
nsHTMLEditor::EndOperation  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLEditor.cpp, line 4142]
nsHTMLEditor::InsertFromTransferable  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLDataTransfer.cpp, line 1308]
nsHTMLEditor::InsertFromDrop  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLDataTransfer.cpp, line 1626]
nsTextEditorDragListener::DragDrop  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/text/nsEditorEventListeners.cpp, line 666]
DispatchToInterface  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 145]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1742]
nsEventTargetChainItem::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 356]
nsEventTargetChainItem::HandleEventTargetChain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 456]
nsEventDispatcher::Dispatch  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 643]
PresShell::HandleEventInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6270]
PresShell::HandlePositionedEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6145]
PresShell::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5973]
nsViewManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1665]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1618]
HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1102]
nsNativeDragTarget::ProcessDrag  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsNativeDragTarget.cpp, line 237]
nsNativeDragTarget::Drop  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsNativeDragTarget.cpp, line 363]
ole32.dll + 0x118ec6 (0x775f8ec6)
ole32.dll + 0x119108 (0x775f9108)
ole32.dll + 0xefce8 (0x775cfce8)
ole32.dll + 0xefb70 (0x775cfb70)
nsDragService::StartInvokingDragSession  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp, line 311]
nsDragService::InvokeDragSession  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsDragService.cpp, line 200]
nsPlaintextEditor::DoDrag  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/text/nsPlaintextDataTransfer.cpp, line 408]
nsTextEditorDragListener::DragGesture  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/text/nsEditorEventListeners.cpp, line 509]
DispatchToInterface  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 145]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1742]
nsEventTargetChainItem::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 356]
nsEventTargetChainItem::HandleEventTargetChain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 456]
nsEventDispatcher::Dispatch  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 643]
nsEventStateManager::GenerateDragGesture  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 1717]
nsEventStateManager::PreHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 666]
PresShell::HandleEventInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6263]
PresShell::HandlePositionedEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6145]
PresShell::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5973]
nsViewManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1665]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1618]
HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1102]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5998]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6180]
nsWindow::WindowProc  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1291]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::ProcessNextNativeEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp, line 154]
nsBaseAppShell::DoProcessNextNativeEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp, line 137]
0xc0850845

Comment 3

[Martijn Wargers (dead)]

Attachment: xbl file needed for testcase

Comment 4

[Martijn Wargers (dead)]

Attachment: testcase

Comment 5

[Martijn Wargers (dead)]

Confirmed. I can see the crash also occuring with the 1.9.0.5 branch build.

Comment 6

[José Jeria]

I see no crash using :
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a2pre) Gecko/20080818033342 Minefield/3.1a2pre

Comment 7

[Martijn Wargers (dead)]

Yeah, worksforme too, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/20080815064214 Minefield/3.1a2pre