10531 - [PP]crash when running this log (delete selection? scrollintoview?)

Status: VERIFIED WONTFIX

(Core :: DOM: Editor, defect, P3)

Description

[Kathleen :Brade]

Christina produced this log which causes a crash in a build from today.
Unfortunately it's a bit difficult to debug when she wants to type so I can't offer
any pointers at the moment.

Comment 1

[Kathleen :Brade]

Attachment: editor journal file which can be run to reproduce crash

Comment 2

[leger]

Is this Mac specific?

Comment 3

[Kathleen :Brade]

I don't know; I'm guessing not.  Sujay or someone should try to run the log on
all platforms to determine whether it's platform-specific or not.

Comment 4

[sujay]

Its mac only it seems...adding [pp] to summary

Comment 5

[Joe Francis]

accepting bug

Comment 6

[Joe Francis]

setting milestone to m9

Comment 7

[kinmoz]

To reproduce the bug:

1. Save the attatchment to a file called journal.js.
2. Copy/Move the journal.js file into the directory that contains the apprunner
executeable.
3. Start the editor with it's default page: apprunner -edit
4. Select Debug->Run Log from the menus.

Here's the stack trace I get when running the journal file.

NTDLL! 77f76148()
nsDebug::Assertion(char * 0x0a83a3e8, char * 0x0a83a3c4, char * 0x0a83a398, int
52) line 176 + 13 bytes
DeleteTextTxn::Init(DeleteTextTxn * const 0x0a11eef0, nsIEditor * 0x09f99220,
nsIDOMCharacterData * 0x0a0cef10, unsigned int 91, unsigned int 1) line 52 + 34
bytes
nsEditor::CreateTxnForDeleteText(nsEditor * const 0x09f99220,
nsIDOMCharacterData * 0x0a0cef10, unsigned int 91, unsigned int 1, DeleteTextTxn
* * 0x0012d094) line 2131 + 32 bytes
nsEditor::CreateTxnForDeleteInsertionPoint(nsEditor * const 0x09f99220,
nsIDOMRange * 0x0a0d5da0, nsIEditor::ECollapsedSelectionAction eDeleteRight,
EditAggregateTxn * 0x0a241120) line 2529 + 34 bytes
nsEditor::CreateTxnForDeleteSelection(nsEditor * const 0x09f99220,
nsIEditor::ECollapsedSelectionAction eDeleteRight, EditAggregateTxn * *
0x0012d174) line 2378 + 34 bytes
nsEditor::DeleteSelection(nsEditor * const 0x09f99220,
nsIEditor::ECollapsedSelectionAction eDeleteRight) line 2320 + 23 bytes
nsTextEditor::DeleteSelection(nsTextEditor * const 0x09f99220,
nsIEditor::ECollapsedSelectionAction eDeleteRight) line 982 + 13 bytes
nsHTMLEditor::DeleteSelection(nsHTMLEditor * const 0x09f99220,
nsIEditor::ECollapsedSelectionAction eDeleteRight) line 220
nsEditorShell::DeleteSelection(nsEditorShell * const 0x0a0aa570, int 1) line
1416 + 27 bytes
XPTC_InvokeByIndex(nsISupports * 0x0a0aa570, unsigned int 33, unsigned int 1,
nsXPTCVariant * 0x0012d374) line 135
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x00f6e120,
nsXPCWrappedNative * 0x0a0acb50, const XPCNativeMemberDescriptor * 0x0132da24,
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 1, long *
0x0139b840, long * 0x0012d57c) line 511 + 44 bytes
WrappedNative_CallMethod(JSContext * 0x00f6e120, JSObject * 0x013d4528, unsigned
int 1, long * 0x0139b840, long * 0x0012d57c) line 130
js_Invoke(JSContext * 0x00f6e120, unsigned int 1, unsigned int 0) line 654 + 26
bytes
js_Interpret(JSContext * 0x00f6e120, long * 0x0012de50) line 2228 + 15 bytes
js_Execute(JSContext * 0x00f6e120, JSObject * 0x0a886610, JSScript * 0x0a23b400,
JSFunction * 0x01076c10, JSStackFrame * 0x0012e61c, int 0, long * 0x0012de50)
line 827 + 13 bytes
obj_eval(JSContext * 0x00f6e120, JSObject * 0x0130c918, unsigned int 1, long *
0x0139b820, long * 0x0012de50) line 672 + 34 bytes
js_Invoke(JSContext * 0x00f6e120, unsigned int 1, unsigned int 0) line 654 + 26
bytes
js_Interpret(JSContext * 0x00f6e120, long * 0x0012e67c) line 2228 + 15 bytes
js_Invoke(JSContext * 0x00f6e120, unsigned int 1, unsigned int 0) line 670 + 13
bytes
js_Interpret(JSContext * 0x00f6e120, long * 0x0012ee64) line 2228 + 15 bytes
js_Invoke(JSContext * 0x00f6e120, unsigned int 0, unsigned int 0) line 670 + 13
bytes
js_Interpret(JSContext * 0x00f6e120, long * 0x0012f64c) line 2228 + 15 bytes
js_Invoke(JSContext * 0x00f6e120, unsigned int 1, unsigned int 2) line 670 + 13
bytes
js_InternalCall(JSContext * 0x00f6e120, JSObject * 0x013d3bc0, long 20790216,
unsigned int 1, long * 0x0012f78c, long * 0x0012f794) line 747 + 15 bytes
JS_CallFunctionValue(JSContext * 0x00f6e120, JSObject * 0x013d3bc0, long
20790216, unsigned int 1, long * 0x0012f78c, long * 0x0012f794) line 2643 + 29
bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x0a0d8d80) line 97 + 34 bytes
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012f958, nsIDOMEvent * * 0x0012f92c, unsigned int 3, nsEventStatus &
nsEventStatus_eIgnore) line 1097 + 27 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x0a071ea0, nsIPresContext
& {...}, nsEvent * 0x0012f958, nsIDOMEvent * * 0x0012f92c, unsigned int 1,
nsEventStatus & nsEventStatus_eIgnore) line 2361
nsMenuFrame::Execute() line 916
nsMenuFrame::HandleEvent(nsMenuFrame * const 0x01356ea8, nsIPresContext & {...},
nsGUIEvent * 0x0012fbb0, nsEventStatus & nsEventStatus_eConsumeDoDefault) line
247
PresShell::HandleEvent(PresShell * const 0x00f9d124, nsIView * 0x0a0e8980,
nsGUIEvent * 0x0012fbb0, nsEventStatus & nsEventStatus_eConsumeDoDefault) line
2258 + 38 bytes
nsView::HandleEvent(nsView * const 0x0a0e8980, nsGUIEvent * 0x0012fbb0, unsigned
int 8, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 834
nsView::HandleEvent(nsView * const 0x00f9cbc0, nsGUIEvent * 0x0012fbb0, unsigned
int 28, nsEventStatus & nsEventStatus_eConsumeDoDefault, int & 0) line 819
nsViewManager::DispatchEvent(nsViewManager * const 0x00f9c9c0, nsGUIEvent *
0x0012fbb0, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 1611
HandleEvent(nsGUIEvent * 0x0012fbb0) line 67
nsWindow::DispatchEvent(nsWindow * const 0x0a0e8a14, nsGUIEvent * 0x0012fbb0,
nsEventStatus & nsEventStatus_eIgnore) line 490 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbb0) line 515
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3257 +
15 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line
3430
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 19333168, long *
0x0012fdd4) line 2525 + 24 bytes
nsWindow::WindowProc(void * 0x0001058e, unsigned int 514, unsigned int 0, long
19333168) line 563 + 27 bytes
USER32! 77e71250()
01270030()

Comment 8

[kinmoz]

Adding [e-mail] to the Cc line.

Comment 9

[Joe Francis]

pushing to m10 - not critical enough to hold m9 for

Comment 10

[hamerly]

Pushed to m10

Comment 11

[Joe Francis]

too much has changed and is changing to spin wheels over this one - changes in
the documents we construct in response to user actions have rendered the log
moot.  I may have already fixed whatever the problem was.  We should beat on it
some more next week after I check in the revised InsertText() code.

Comment 12

[sujay]

verified in 8/18 build.