121742 - Moving the cursor up in a TEXTAREA in malformed HTML causes crash

Status: VERIFIED DUPLICATE of bug 115350

(Core :: Layout: Tables, defect)

Description

[Jacob Eisinger]

When the cursor is moved up or down in TEXTAREA that is placed in a TABLE
without a TR or TD, mozilla crashes.

To reproduce:
1. open up the to be attached html test case.
2. place the cursor in the text area
3. press up and then down one or two times
4. mozilla crashes

I realize that if the html was well-formed, this crash would not occur, however
in the real world, this doesn't always happen.

BUILD ID: 2002011103

Comment 1

[Jacob Eisinger]

Attachment: test case

Comment 2

[Matthias Versen [:Matti]]

thanks for the testcase !

win2k stack Trace :
nsFrame::PeekOffset(nsFrame * const 0x048e2580, nsIPresContext * 0x04586d70, 
nsPeekOffsetStruct * 0x0012e3ec) line 3387 + 36 bytes
BRFrame::PeekOffset(BRFrame * const 0x048e2580, nsIPresContext * 0x04586d70, 
nsPeekOffsetStruct * 0x0012e3ec) line 266 + 17 bytes
nsSelection::MoveCaret(unsigned int 40, int 0, nsSelectionAmount eSelectLine) 
line 1591 + 41 bytes
nsSelection::LineMove(nsSelection * const 0x040fea80, int 1, int 0) line 2976 + 
16 bytes
nsTextInputSelectionImpl::LineMove(nsTextInputSelectionImpl * const 0x040fd7c8, 
int 1, int 0) line 893 + 34 bytes
nsSelectionMoveCommands::DoCommand(nsSelectionMoveCommands * const 0x041480e0, 
const nsAString & {...}, nsISupports * 0x040fc340) line 387 + 39 bytes
nsControllerCommandManager::DoCommand(nsControllerCommandManager * const 
0x04148fb0, const nsAString & {...}, nsISupports * 0x040fc340) line 199 + 31 
bytes
nsEditorController::DoCommand(nsEditorController * const 0x041008f0, const 
nsAString & {...}) line 208
nsXBLPrototypeHandler::ExecuteHandler(nsXBLPrototypeHandler * const 0x04116560, 
nsIDOMEventReceiver * 0x0409c030, nsIDOMEvent * 0x041cb2d8) line 317
DoKey(nsIAtom * 0x02cf47a0, nsIXBLPrototypeHandler * 0x04116560, nsIDOMEvent * 
0x041cb2d8, nsIDOMEventReceiver * 0x0409c030) line 108
nsXBLKeyHandler::KeyPress(nsXBLKeyHandler * const 0x0409eb30, nsIDOMEvent * 
0x041cb2d8) line 123 + 40 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x040a52e0, 
nsIPresContext * 0x04586d70, nsEvent * 0x0012f920, nsIDOMEvent * * 0x0012f504, 
nsIDOMEventTarget * 0x041c9040, unsigned int 7, nsEventStatus * 0x0012f88c) line 
1636 + 41 bytes
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x040a2e70, 
nsIPresContext * 0x04586d70, nsEvent * 0x0012f920, nsIDOMEvent * * 0x0012f504, 
unsigned int 1, nsEventStatus * 0x0012f88c) line 1652
nsHTMLTextAreaElement::HandleDOMEvent(nsHTMLTextAreaElement * const 0x040a2e70, 
nsIPresContext * 0x04586d70, nsEvent * 0x0012f920, nsIDOMEvent * * 0x00000000, 
unsigned int 1, nsEventStatus * 0x0012f88c) line 770 + 29 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f920, nsIView * 0x04084670, 
unsigned int 1, nsEventStatus * 0x0012f88c) line 5986 + 44 bytes
PresShell::HandleEvent(PresShell * const 0x0458c434, nsIView * 0x04084670, 
nsGUIEvent * 0x0012f920, nsEventStatus * 0x0012f88c, int 0, int & 1) line 5909 + 
25 bytes
nsView::HandleEvent(nsView * const 0x04084670, nsGUIEvent * 0x0012f920, unsigned 
int 0, nsEventStatus * 0x0012f88c, int 0, int & 1) line 387
nsView::HandleEvent(nsView * const 0x04084700, nsGUIEvent * 0x0012f920, unsigned 
int 0, nsEventStatus * 0x0012f88c, int 0, int & 1) line 344
nsView::HandleEvent(nsView * const 0x0458cb20, nsGUIEvent * 0x0012f920, unsigned 
int 0, nsEventStatus * 0x0012f88c, int 1, int & 1) line 344
nsViewManager::DispatchEvent(nsViewManager * const 0x0458ccc0, nsGUIEvent * 
0x0012f920, nsEventStatus * 0x0012f88c) line 1909
HandleEvent(nsGUIEvent * 0x0012f920) line 83
nsWindow::DispatchEvent(nsWindow * const 0x04083c14, nsGUIEvent * 0x0012f920, 
nsEventStatus & nsEventStatus_eIgnore) line 850 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f920) line 871
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 40) 
line 2600 + 15 bytes
nsWindow::OnKeyDown(unsigned int 40, unsigned int 336) line 2672
nsWindow::ProcessMessage(unsigned int 256, unsigned int 40, long 22020097, long 
* 0x0012fd20) line 3362 + 32 bytes
nsWindow::WindowProc(HWND__ * 0x005901c6, unsigned int 256, unsigned int 40, 
long 22020097) line 1115 + 27 bytes
USER32! 77e02e98()
USER32! 77e030e0()
USER32! 77e05824()
nsAppShellService::Run(nsAppShellService * const 0x004b4bd0) line 308
main1(int 2, char * * 0x00444fa0, nsISupports * 0x00000000) line 1285 + 32 bytes
main(int 2, char * * 0x00444fa0) line 1625 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87d08()


*** This bug has been marked as a duplicate of 115350 ***

Comment 3

[Amarendra Hanumanula]

 This is a dupe of bug# 115350.  Marking verified.