55856 - Assertion in range code when deleting last list items

Status: NEW

(Core :: DOM: Editor, defect, P5)

Description

[Simon Fraser [no longer active]]

I see the following assertion in range code:

###!!! ASSERTION: nsRange::IsIncreasing: 'Not Reached', file nsRange.cpp, line 
667

if I:
1. Load the attachment in composer
2. Select over all the list items
3. Delete them, leaving a single empty (hollow circle) list item
4. Hit delete again to remove the remaining list item.

Starting source:
<ul>
<li>
<div class="moz-text-html" style="font-family: Times; font-size: 12px; ">
<ul>
<li>Fixed bug 1234</li>
<li>Did some more work</li>
<li>Did other work</li>
</ul>
</div>
</li>
</ul>

Source after step 3:

<ul>
<li>
<div class="moz-text-html" style="font-family: Times; font-size: 12px; ">
<ul>
<li><br>
</li>
</ul>
</div>
</li>
</ul>

[note, when at this stage, and I go to HTML source and back, going back causes 
the following assertion:
###!!! ASSERTION: nsRange::PopRanges() got error from SetEnd(): 
'NS_SUCCEEDED(res)', file nsRange.cpp, line 890
]

HTML source after getting the assertion:

<ul>
<li>
<div class="moz-text-html" style="font-family: Times; font-size: 12px; ">
<ul>
&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
</ul>
</div>
</li>
</ul>

Wow, where did those nbsp's come from?

Comment 1

[rubydoo123]

moving to future until we can sort through fix dates

Comment 2

[Joe Francis]

moz 0.9

Comment 3

[Joe Francis]

moving a bunch of 0.9 bugs to 0.9.1

Comment 4

[rubydoo123]

moving to 1.0

Comment 5

[Asa Dotzler [:asa]]

Bugs targeted at mozilla1.0 without the mozilla1.0 keyword moved to mozilla1.0.1 
(you can query for this string to delete spam or retrieve the list of bugs I've 
moved)

Comment 6

[Joe Francis]

The trunk is the wave of the future!

Comment 7

[Joe Francis]

The days of having a half dozen milestones out in front of us to divide bugs 
between seem to be gone, though I dont know why.  Lumping everything together as 
far out as I can.  I'll pull back things that I am working on as I go.

Comment 8

[Joe Francis]

similar report from charlie:
11:27 AM:    cmanske: jfrancis_: Do this: start numbered list, type 3 lines,
select all lines, change type via format menu to "Definition" ...
11:26 AM:    cmanske: asserts at:
11:27 AM:    cmanske: nsVoidArray::ElementAt(int 1) line 78 + 35 bytes
11:27 AM:    cmanske: nsRange::IsIncreasing(nsIDOMNode *
11:27 AM:    cmanske: nsRange::CompareBoundaryPoints(nsR
11:27 AM:    cmanske: nsHTMLEditRules::UpdateDocChangeRang

Comment 9

[Charles Manske]

This is really annoying!

Comment 10

[Joe Francis]

differentiating bug severity of my most critical bugs vai abuse of milestone field
M2: severe
M1: very severe and/or fix in hand

Comment 11

[Kevin McCluskey (gone)]

nsbeta1-

Comment 12

[Simon Paquet [:sipaq]]

happens on all operating systems

Comment 13

[Jens Stutte [:jstutte]]

Bulk-downgrade of unassigned, >=5 years untouched DOM/Storage bugs' priority.

If you have reason to believe this is wrong (especially for the severity), please write a comment and ni :jstutte.

Comment 14

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

I think that this is not reproducible anymore.

Comment 15

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Hmm, I don't hit assertion anymore, but I see the following warnings:

[Child 7892, Main Thread] WARNING: '!mRightContent->GetParentNode()', fileeditor/libeditor/HTMLEditorDeleteHandler.cpp:3512
[Child 7892, Main Thread] WARNING: AutoBlockElementsJoiner::JoinBlockElementsInSameParent() failed: 'result.isOk()', file[editor/libeditor/HTMLEditorDeleteHandler.cpp:654](HTMLEditorDeleteHandler.cpp
[Child 7892, Main Thread] WARNING: AutoBlockElementsJoiner::Run() failed: 'result.isOk()', fileeditor/libeditor/HTMLEditorDeleteHandler.cpp:3296
[Child 7892, Main Thread] WARNING: AutoDeleteRangesHandler::HandleDeleteNonCollapsedRanges() failed: 'result.isOk()', fileeditor/libeditor/HTMLEditorDeleteHandler.cpp:1694
[Child 7892, Main Thread] WARNING: AutoDeleteRangesHandler::Run() failed: 'result.isOk()', fileeditor/libeditor/HTMLEditorDeleteHandler.cpp:1164
[Child 7892, Main Thread] WARNING: TextEditor::HandleDeleteSelection() failed: file editor/libeditor/EditorBase.cpp:4230
[Child 7892, Main Thread] WARNING: EditorBase::DeleteSelectionAsSubAction() failed: 'NS_SUCCEEDED(rv)', file editor/libeditor/EditorBase.cpp:4193

Comment 16

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: testcase