143331 - Mozilla can crash when pressing backspace in mail composition

Status: VERIFIED DUPLICATE of bug 136165

(Core :: DOM: Editor, defect)

Description

[David Campbell]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc1)
Gecko/20020417
BuildID:    2002041711

Mozilla can crash when pressing backspace in mail composition window.

Reproducible: Always
Steps to Reproduce:
1.  Create a new mail folder in mozilla
2.  Exit mozilla
3.  Edit the mail folder file and put the message further below in it (this is
the easiest way to reproduce this that I could find - the problem originated
with an e-mail from a friend).
4.  Run mozilla
5.  Open the mail folder
6.  click on the message
7.  Click reply
8.  Put the cursor just before the "H" in "Hello"
9.  Press backspace twice
10.   It bombs and falls over

From - Mon Feb 11 22:17:16 2002
From: "David Campbell" <[e-mail]>
To: [e-mail]
Subject: Problem
Date: Mon, 11 Feb 2002 22:17:33 +1000
Mime-Version: 1.0
Message-ID: <[e-mail]>

On Thu, 9 May 2002, David Campbell wrote:

> Hello
>
> Hope things are well for you.


Actual Results:  It consistently crashes.

Expected Results:  Edited the text.

Comment 1

[Adam Hauner]

If you are crashing in Mozilla the best thing you can do to help the developers
fix your bug is to attach a stacktrace. If you're not building yourself you are
not out of luck. Mozilla releases nightly and milestone builds with Netscape's
Talkback (you can get latest build on:
http://ftp.mozilla.org/pub/mozilla/nightly/latest/) Talkback should catch most
crashes and offer to send in a crash report. Developers can retrieve that crash
report and attach it to your bug report if you provide either the Incident ID
(you can get it by running the talkback program from /components/talkback/).
Thanks for your help in testing Mozilla and reporting bugs.

Comment 2

[David Campbell]

Looking at talkback I've generated these incidents with this problem:

TB6135002G
TB6111686Z
TB6111580M

Comment 3

[Jean-Francois Ducarroz]

Stack trave from first talkback report:

nsWSRunObject::GetWSNodes
[d:\builds\seamonkey\mozilla\editor\libeditor\html\nsWSRunObject.cpp, line 729]
nsWSRunObject::nsWSRunObject
[d:\builds\seamonkey\mozilla\editor\libeditor\html\nsWSRunObject.cpp, line 99]
nsWSRunObject::PrepareToDeleteRange
[d:\builds\seamonkey\mozilla\editor\libeditor\html\nsWSRunObject.cpp, line 166]
nsHTMLEditRules::WillDeleteSelection
[d:\builds\seamonkey\mozilla\editor\libeditor\html\nsHTMLEditRules.cpp, line 1893]
nsHTMLEditRules::WillDoAction
[d:\builds\seamonkey\mozilla\editor\libeditor\html\nsHTMLEditRules.cpp, line 486]
nsPlaintextEditor::DeleteSelection
[d:\builds\seamonkey\mozilla\editor\libeditor\text\nsPlaintextEditor.cpp, line 938]
nsHTMLEditorLog::DeleteSelection
[d:\builds\seamonkey\mozilla\editor\libeditor\html\nsHTMLEditorLog.cpp, line 159]
nsTextEditorKeyListener::KeyPress
[d:\builds\seamonkey\mozilla\editor\libeditor\text\nsEditorEventListeners.cpp,
line 255]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1654]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3233]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1673]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6096]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6019]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2030]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1887]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886]
nsWindow::DispatchKeyEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2660]
nsWindow::OnChar [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp,
line 2810]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3459]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x30e0 (0x77e130e0)
USER32.DLL + 0x5824 (0x77e15824)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 309]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1431]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1766]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1784]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

reassign to editor.

Comment 4

[kinmoz]

Giving to jfrancis for some ws lovin'.

Comment 5

[David Campbell]

still happens on RC2 2002051006

Comment 6

[Joe Francis]

So far I cannot repro this.  The line in the stacktrace was probably this one:
    nsCOMPtr<nsITextContent> textNode(do_QueryInterface(mNode));
which is currently line 728 but should have been 729 for rc1.  Examining the
call path to this point I can see o way mNode can be null (WillDeleteSelection
checked for this a few steps up the stack).  So I'm at a loss here for now.

Comment 7

[Joe Francis]

got it.  This is a dup of 136165.  patch will there shortly.


*** This bug has been marked as a duplicate of 136165 ***

Comment 8

[sujay]

verified.