1275134 - Crash in nsRange::Collapsed via nsEditor::DeleteSelectionAndPrepareToCreateNode during compose/reply (typically quoted reply and spell check)

Status: RESOLVED DUPLICATE of bug 1361052

(Core :: DOM: Editor, defect, P2)

Description

[Wayne Mery (:wsmwk)]

#32 crash for 45.1.0. Not a new crash by any means. selection of user comments below

bp-3ef7ae83-6557-400e-bc6e-924f22160519
 0 	xul.dll	nsRange::Collapsed()	dom/base/nsRange.h:182
1 	xul.dll	nsEditor::DeleteSelectionAndPrepareToCreateNode()	editor/libeditor/nsEditor.cpp:4095
2 	xul.dll	nsHTMLEditor::InsertElementAtSelection(nsIDOMElement*, bool)	editor/libeditor/nsHTMLEditor.cpp:1507
3 	xul.dll	nsMsgCompose::InsertDivWrappedTextAtSelection(nsAString_internal const&, nsAString_internal const&)	c:/builds/moz2_slave/tb-rel-c-esr45-w32_bld-0000000/build/mailnews/compose/src/nsMsgCompose.cpp:578
4 	xul.dll	nsMsgCompose::ConvertAndLoadComposeWindow(nsString&, nsString&, nsString&, bool, bool)	c:/builds/moz2_slave/tb-rel-c-esr45-w32_bld-0000000/build/mailnews/compose/src/nsMsgCompose.cpp:677
5 	xul.dll	QuotingOutputStreamListener::OnStopRequest(nsIRequest*, nsISupports*, nsresult)	c:/builds/moz2_slave/tb-rel-c-esr45-w32_bld-0000000/build/mailnews/compose/src/nsMsgCompose.cpp:2995
6 	xul.dll	nsStreamConverter::OnStopRequest(nsIRequest*, nsISupports*, nsresult)	c:/builds/moz2_slave/tb-rel-c-esr45-w32_bld-0000000/build/mailnews/mime/src/nsStreamConverter.cpp:1077
7 	xul.dll	nsImapCacheStreamListener::OnStopRequest(nsIRequest*, nsISupports*, nsresult)	c:/builds/moz2_slave/tb-rel-c-esr45-w32_bld-0000000/build/mailnews/imap/src/nsImapProtocol.cpp:8732
8 	xul.dll	nsInputStreamPump::OnStateStop()	netwerk/base/nsInputStreamPump.cpp:715
9 	xul.dll	nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)	netwerk/base/nsInputStreamPump.cpp:434
10 	xul.dll	nsOutputStreamReadyEvent::Run()	xpcom/io/nsStreamUtils.cpp:91 

ayg@102377 4088 nsEditor::DeleteSelectionAndPrepareToCreateNode()
ayg@102377 4089 {
ayg@102377 4090    nsresult res;
froydnj@301570 4091 RefPtr<Selection> selection = GetSelection();
ehsan@43806 4092   NS_ENSURE_TRUE(selection, NS_ERROR_NULL_POINTER);
ayg@103196 4093    MOZ_ASSERT(selection->GetAnchorFocusRange());
ayg@103196 4094
ayg@103196 4095  if (!selection->GetAnchorFocusRange()->Collapsed()) {

amarchesini@144057 175  static already_AddRefed<nsRange>
amarchesini@144057 176  Constructor(const mozilla::dom::GlobalObject& global,
amarchesini@144057 177         mozilla::ErrorResult& aRv);
amarchesini@144057 178
trev@134893 179  bool Collapsed() const
trev@134893 180  {
trev@134893 181    return mIsPositioned && mStartParent == mEndParent &&
trev@134893 182        mStartOffset == mEndOffset;


Pressed CTRL-R to try and reply to a message.
Quoted the message i was replying to. Good Luck :)
My thunderbird always crashes. Please solve it in new update. I'll appreciate for that.
It crashed when I clicked on the column header to "sort by 'From' ".
clicked an email that was filled with a couple basic text sentences, no attachments and it "FC'ed"
pasting part of another email with shift-Ctrl+O paste as quotation.

Comment 1

[Wayne Mery (:wsmwk)]

because this occurs during compose there is almost always dataloss

bp-bf35e27d-c1e8-417e-8840-9abdf2161024

Comment 2

[Jorg K (CEST = GMT+2)]

No data loss since it happens when the user presses <ctrl>R to reply. All he loses is the selection in the message he wants to reply to.

Other than that, the report doesn't match the crash data:
  It crashed when I clicked on the column header to "sort by 'From' ".
Crash data:
  QuotingOutputStreamListener::InsertToCompose()
That's exactly when the reply with a quoted text is prepared, no data loss.

I bet this is also an add-on problem:
{3e17310d-82e8-4a43-bd2f-7c3055bfe589}
https://www.reasoncoresecurity.com/3e17310d-82e8-4a43-bd2f-7c3055bfe589.xpi-a3da3044e1b6bd835f7f2daadcc4963a7932ceef.aspx
MoreFunctionsForAddressBook

{12345678-1234-1234-1234-123456789abc}
https://www.reasoncoresecurity.com/12345678-1234-1234-1234-123456789abc.xpi-293a974ed28e54ffc4d7232bf00d44baed8df7c1.aspx
Remove Duplicate Messages

BTW, MoreFunctionsForAddressBook was/is known to be incompatible with TB 45.x.

How can we easily look up which add-ons are hiding those UUIDs?

Comment 3

[Makoto Kato [:m_kato]]

This will be called by some commands (cmd_insertHR, cmd_insertImageNoUI and cmd_insertLinkNoUI).  So, to reproduce this, we send some commands (inserthorizontalrule etc)...