126026 - extraneous break on paste, which cannot be deleted via backspace

Status: VERIFIED DUPLICATE of bug 136165

(Core :: DOM: Editor, defect)

Description

[(not reading, please use [e-mail] instead)]

first I get this assertion:

###!!! ASSERTION: bad index: 'PRUint32(aIndex) < mState.mLength', file ..\..\..\
dist/include/content\nsTextFragment.h, line 230

then I crash here:

nsTextFragment::CharAt(int 0) line 231 + 42 bytes
nsWSRunObject::GetWSNodes() line 702 + 12 bytes
nsWSRunObject::nsWSRunObject(nsHTMLEditor * 0x07c67e00, nsIDOMNode * 
0x07dd00ec, int 1) line 96
nsWSRunObject::PrepareToDeleteRange(nsHTMLEditor * 0x07c67e00, 
nsCOMPtr<nsIDOMNode> * 0x0012ee6c, int * 0x0012ed88, nsCOMPtr<nsIDOMNode> * 
0x0012ee6c, int * 0x0012ed84) line 163
nsHTMLEditRules::WillDeleteSelection(nsISelection * 0x07bec0b0, short 2, int * 
0x0012ef0c, int * 0x0012ef48) line 1873 + 55 bytes
nsHTMLEditRules::WillDoAction(nsHTMLEditRules * const 0x07c67084, nsISelection 
* 0x07bec0b0, nsRulesInfo * 0x0012ef10, int * 0x0012ef0c, int * 0x0012ef48) 
line 492 + 31 bytes
nsPlaintextEditor::DeleteSelection(nsPlaintextEditor * const 0x07c67e00, short 
2) line 937 + 59 bytes
nsHTMLEditorLog::DeleteSelection(nsHTMLEditorLog * const 0x07c67e00, short 2) 
line 158 + 14 bytes
nsTextEditorKeyListener::KeyPress(nsTextEditorKeyListener * const 0x07745360, 
nsIDOMEvent * 0x07dec298) line 241
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x07bdd3c0, 
nsIPresContext * 0x07c38530, nsEvent * 0x0012f900, nsIDOMEvent * * 0x0012f654, 
nsIDOMEventTarget * 0x07c36520, unsigned int 2, nsEventStatus * 0x0012f7b0) 
line 1648 + 41 bytes
nsDocument::HandleDOMEvent(nsDocument * const 0x07c364f0, nsIPresContext * 
0x07c38530, nsEvent * 0x0012f900, nsIDOMEvent * * 0x0012f654, unsigned int 2, 
nsEventStatus * 0x0012f7b0) line 3262
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x07bb30f0, 
nsIPresContext * 0x07c38530, nsEvent * 0x0012f900, nsIDOMEvent * * 0x0012f654, 
unsigned int 1, nsEventStatus * 0x0012f7b0) line 1680 + 39 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f900, nsIView * 0x07c5c4f0, 
unsigned int 1, nsEventStatus * 0x0012f7b0) line 6003 + 44 bytes
PresShell::HandleEvent(PresShell * const 0x07bec764, nsIView * 0x07c5c4f0, 
nsGUIEvent * 0x0012f900, nsEventStatus * 0x0012f7b0, int 0, int & 1) line 5926 
+ 25 bytes
nsViewManager::HandleEvent(nsView * 0x07c5c7f0, nsGUIEvent * 0x0012f900, int 0) 
line 2010
nsView::HandleEvent(nsViewManager * 0x07b8ab90, nsGUIEvent * 0x0012f900, int 0) 
line 301
nsViewManager::DispatchEvent(nsViewManager * const 0x07b8ab90, nsGUIEvent * 
0x0012f900, nsEventStatus * 0x0012f870) line 1843 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f900) line 83
nsWindow::DispatchEvent(nsWindow * const 0x07c5c6c4, nsGUIEvent * 0x0012f900, 
nsEventStatus & nsEventStatus_eIgnore) line 854 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f900) line 875
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 8, 
long 0) line 2602 + 15 bytes
nsWindow::OnChar(unsigned int 8, unsigned int 8, unsigned char 1) line 2753
nsWindow::ProcessMessage(unsigned int 258, unsigned int 8, long 917505, long * 
0x0012fd20) line 3316 + 52 bytes
nsWindow::WindowProc(HWND__ * 0x00030286, unsigned int 258, unsigned int 8, 
long 917505) line 1119 + 27 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x01d14160) line 308
main1(int 2, char * * 0x00444b90, nsISupports * 0x00000000) line 1285 + 32 bytes
main(int 2, char * * 0x00444b90) line 1625 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87903()

I'll provide steps to reproduce this crasher next.

Comment 1

[(not reading, please use [e-mail] instead)]

to reproduce this:

1) go to http://www.mozilla.org/mailnews/arch/addrbook/hiddenprefs.html
2) edit page
3) select the bolded text "mail.addr_book.mapit_url.format" (including the 
quotes)
4) copy
5) paste

your editor will now look like this:

"Get Map" button pref ("mail.addr_book.mapit_url.format"  
)
The format for this pref  is:

6) move cursor to the )
7) hit delete, you'll crash. 

Comment 2

[Volker Merschmann]

WFM Mozilla/5.0 (Windows; U; Win98; de-AT; rv:0.9.8) Gecko/20020204

Comment 3

[Kathleen :Brade]

->joe

Comment 4

[Joe Francis]

The crash is WFM as well, and also Kin.  I don't see a build id.  It's likely the 
crash is a problem that Kin fixed earlier (thanks Kin!).  However, the odd break 
you get when you paste is a bug.  and the fact that you can't backspace that 
break away is bug.  So I'm leaving this open, but changing summary and 
retargeting.  Also clearing keywords.

Comment 5

[Kevin McCluskey (gone)]

Marking EDITORBASE-. The remaining problem involves content which was not
created by composer.

Comment 6

[Matthias Versen [:Matti]]

I have a special Mail (from a reporter) and i get a reproduceable crash with my 
win2k optimized and debug builds. (20020520..) if i try to reply and delete some 
lines. 
I don't have any special hidden pref.. !
I can attach the message if you want...

nsTextFragment::CharAt(int 0) line 240 + 42 bytes
nsWSRunObject::GetWSNodes() line 740 + 12 bytes
nsWSRunObject::nsWSRunObject(nsHTMLEditor * 0x04ba5d40, nsIDOMNode * 0x04c4c4cc, 
int 1) line 99
nsWSRunObject::PrepareToDeleteRange(nsHTMLEditor * 0x04ba5d40, 
nsCOMPtr<nsIDOMNode> * 0x0012edf0, int * 0x0012ed0c, nsCOMPtr<nsIDOMNode> * 
0x0012edf0, int * 0x0012ed08) line 166
nsHTMLEditRules::WillDeleteSelection(nsISelection * 0x04d33840, short 2, int * 
0x0012ee90, int * 0x0012eecc) line 1981 + 55 bytes
nsHTMLEditRules::WillDoAction(nsHTMLEditRules * const 0x048affac, nsISelection * 
0x04d33840, nsRulesInfo * 0x0012ee94, int * 0x0012ee90, int * 0x0012eecc) line 
492 + 31 bytes
....

Comment 7

[Joe Francis]

patch in 136165


*** This bug has been marked as a duplicate of 136165 ***

Comment 8

[sujay]

verified.