Closed Bug 10815 Opened 21 years ago Closed 21 years ago

Crash deleting selected text and table.

Categories

(Core :: DOM: Editor, defect, P3, major)

x86
Windows NT
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: lchiang, Assigned: kinmoz)

Details

Crash deleting selected text and table.

Reproduced:  Release Build 1999072815, WinNT 4.0.  Did not try on Necko builds
yet or on other platforms.  (Sujay - perhaps you can try since this is in the
editor area?  Thanks.)

1)  Start Apprunner
2)  Tasks | Editor
3)  Scroll down the page to the part right before the table on the page.
4)  Select "4. Another thing" and all the table cells.
5)  Press Delete

Actual Results:   Crash occurs
Expected Results:  The items selected get deleted.

Additional Information:
a)  This is also reproducible in the HTML mail compose window where I first saw
this problem.
b)  In the Editor, if I just select the table without selecting "4. Another
thing" and press Delete, there is no problem.  The table gets deleted.
c)  Several talkback incidents filed:  11775268, 11775207, 11764258.  Below is a
stack trace from the most recent crash using the Editor:

   nsHTMLEditRules::WillDeleteSelection
[d:\builds\seamonkey\mozilla\editor\base\nsHTMLEditRules.cpp, line 452]
   nsHTMLEditRules::WillDoAction
[d:\builds\seamonkey\mozilla\editor\base\nsHTMLEditRules.cpp, line 93]
   nsTextEditor::DeleteSelection
[d:\builds\seamonkey\mozilla\editor\base\nsTextEditor.cpp, line 982]
   nsHTMLEditor::DeleteSelection
[d:\builds\seamonkey\mozilla\editor\base\nsHTMLEditor.cpp, line 220]
   nsTextEditorKeyListener::KeyDown
[d:\builds\seamonkey\mozilla\editor\base\nsEditorEventListeners.cpp, line 179]
   nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line
758]
   nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 2303]
   nsHTMLHtmlElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLHtmlElement.cpp, line
188]
   PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2250]
   nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 834]
   nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 819]
   nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 819]
   nsView::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 819]
   nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1736]
   HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 67]
   nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 494]
   nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 515]
   nsWindow::DispatchKeyEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1960]
   nsWindow::OnKeyDown
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2154]
   nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2498]
   nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 564]
   USER32.dll + 0x1268 (0x77e71268)
   0x01530001
As more folks are using mail in 5.0, this may be a common occurrence in editing
replies and such.
Assignee: buster → jfrancis
stack points into the rules.  Joe, please do first pass investigation, and pass
along if necessary.
Status: NEW → ASSIGNED
accepting bug
setting milestone to m9
Assignee: jfrancis → kin
Status: ASSIGNED → NEW
I'll look into this bug. Reassigning to kin@netscape.com. Adding
buster@netscape.com to Cc list.
Status: NEW → ASSIGNED
Accepting bug.
We crash in nsHTMLEditRules::WillDeleteSelection() when there isn't a collapsed
selection and the body node is either the StartParent, or EndParent, or both of
the selection range. This is because the code always assumes that there is a
blocknode parent element, which isn't true of the body, so the code never
checked the to see if the result of mEditor->GetBlockNodeParent() was NULL.

Here's the fix:

Index: nsHTMLEditRules.cpp
===================================================================
RCS file: /cvsroot/mozilla/editor/base/nsHTMLEditRules.cpp,v
retrieving revision 1.37
diff -c -r1.37 nsHTMLEditRules.cpp
*** nsHTMLEditRules.cpp 1999/07/26 18:05:41     1.37
--- nsHTMLEditRules.cpp 1999/08/02 21:46:36
***************
*** 440,447 ****

      // deleting across blocks
      // are the blocks of same type?
!     nsCOMPtr<nsIDOMNode> leftParent = mEditor->GetBlockNodeParent(node);
!     nsCOMPtr<nsIDOMNode> rightParent = mEditor->GetBlockNodeParent(endNode);

      // are the blocks siblings?
      nsCOMPtr<nsIDOMNode> leftBlockParent;
--- 440,457 ----

      // deleting across blocks
      // are the blocks of same type?
!     nsCOMPtr<nsIDOMNode> leftParent;
!     nsCOMPtr<nsIDOMNode> rightParent;
!
!     if (IsBody(node))
!       leftParent = node;
!     else
!       leftParent = mEditor->GetBlockNodeParent(node);
!
!     if (IsBody(endNode))
!       rightParent = endNode;
!     else
!       rightParent = mEditor->GetBlockNodeParent(endNode);

      // are the blocks siblings?
      nsCOMPtr<nsIDOMNode> leftBlockParent;
Hmmm, maybe the right thing to do is to call IsBlockNode() for both node and
endNode instead of IsBody().

Joe, is that the right thing to do?
Status: ASSIGNED → RESOLVED
Closed: 21 years ago
Resolution: --- → FIXED
Fix checked in:

    mozilla/editor/base/nsHTMLEditRules.cpp
      - Modified GetPromotedPoint() to check for NULL in the
        case where aWhere == kEnd and GetChildAt() returns NULL.
Status: RESOLVED → VERIFIED
verified in 8/10 build.
You need to log in before you can comment on or make changes to this bug.