16072 - edit mode, select-all, delete crashes

Status: VERIFIED DUPLICATE of bug 12958

(Core :: Layout, defect, P1)

Description

[buster]

run viewer
fire up editor mode
select-all (manually or control-a)
delete
crash.

stack:
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x01d37be0,
nsIPresContext * 0x01b4e3f0, nsIContent * 0x01098f1c, nsIContent * 0x01d4bacc,
int 0) line 6267 + 16 bytes
nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x01d37be0,
nsIPresContext * 0x01b4e3f0, nsIContent * 0x01098f1c, nsIContent * 0x01d4bacc,
nsIContent * 0x01d4bacc, int 0) line 6014 + 28 bytes
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x01d37be0,
nsIPresContext * 0x01b4e3f0, nsIContent * 0x01098f1c, nsIContent * 0x01d4bb8c,
int 0) line 6430 + 46 bytes
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x01d37c80, nsIPresContext *
0x01b4e3f0, nsIContent * 0x01098f1c, nsIContent * 0x01d4bb8c, int 0) line 956
PresShell::ContentRemoved(PresShell * const 0x01d37ad8, nsIDocument *
0x01b4db00, nsIContent * 0x01098f1c, nsIContent * 0x01d4bb8c, int 0) line 1762 +
50 bytes
nsDocument::ContentRemoved(nsDocument * const 0x01b4db00, nsIContent *
0x01098f1c, nsIContent * 0x01d4bb8c, int 0) line 1588
nsHTMLDocument::ContentRemoved(nsHTMLDocument * const 0x01b4db00, nsIContent *
0x01098f1c, nsIContent * 0x01d4bb8c, int 0) line 1094
nsGenericHTMLContainerElement::RemoveChildAt(int 0, int 1) line 2925
nsGenericHTMLContainerElement::RemoveChild(nsIDOMNode * 0x01d4bb80, nsIDOMNode *
* 0x0012f40c) line 2728 + 14 bytes
nsHTMLBodyElement::RemoveChild(nsHTMLBodyElement * const 0x01098f10, nsIDOMNode
* 0x01d4bb80, nsIDOMNode * * 0x0012f40c) line 171 + 22 bytes
DeleteElementTxn::Do(DeleteElementTxn * const 0x01f08770) line 91 + 77 bytes
EditAggregateTxn::Do(EditAggregateTxn * const 0x01f089c0) line 59 + 12 bytes
DeleteRangeTxn::Do(DeleteRangeTxn * const 0x01f089c0) line 141 + 9 bytes
EditAggregateTxn::Do(EditAggregateTxn * const 0x01f08e70) line 59 + 12 bytes
nsTransactionItem::Do() line 102 + 18 bytes
nsTransactionManager::BeginTransaction(nsITransaction * 0x01f08e70) line 1038 +
11 bytes
nsTransactionManager::Do(nsTransactionManager * const 0x01f06750, nsITransaction
* 0x01f08e70) line 134 + 18 bytes
nsEditor::Do(nsEditor * const 0x01dbfae0, nsITransaction * 0x01f08e70) line 385
+ 30 bytes
nsEditor::DeleteSelectionImpl(nsEditor * const 0x01dbfae0,
nsIEditor::ESelectionCollapseDirection eDeleteNext) line 4095 + 16 bytes
nsHTMLEditor::DeleteSelection(nsHTMLEditor * const 0x01dbfae0,
nsIEditor::ESelectionCollapseDirection eDeleteNext) line 1218 + 19 bytes
nsHTMLEditorLog::DeleteSelection(nsHTMLEditorLog * const 0x01dbfae0,
nsIEditor::ESelectionCollapseDirection eDeleteNext) line 155 + 13 bytes
nsTextEditorKeyListener::KeyPress(nsIDOMEvent * 0x01f08ed0) line 215
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012fcbc, nsIDOMEvent * * 0x0012f9ec, unsigned int 7, nsEventStatus &
nsEventStatus_eIgnore) line 809 + 17 bytes
nsDocument::HandleDOMEvent(nsDocument * const 0x01b4db00, nsIPresContext &
{...}, nsEvent * 0x0012fcbc, nsIDOMEvent * * 0x0012f9ec, unsigned int 1,
nsEventStatus & nsEventStatus_eIgnore) line 2388
nsHTMLHtmlElement::HandleDOMEvent(nsHTMLHtmlElement * const 0x01b4eebc,
nsIPresContext & {...}, nsEvent * 0x0012fcbc, nsIDOMEvent * * 0x00000000,
unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 187 + 41 bytes
PresShell::HandleEvent(PresShell * const 0x01d37ad4, nsIView * 0x01d497d0,
nsGUIEvent * 0x0012fcbc, nsEventStatus & nsEventStatus_eIgnore) line 2064 + 39
bytes
nsView::HandleEvent(nsView * const 0x01d497d0, nsGUIEvent * 0x0012fcbc, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834
nsView::HandleEvent(nsView * const 0x01d489e0, nsGUIEvent * 0x0012fcbc, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x01d48ac0, nsGUIEvent * 0x0012fcbc, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x01d36100, nsGUIEvent * 0x0012fcbc, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsViewManager::DispatchEvent(nsViewManager * const 0x01d36400, nsGUIEvent *
0x0012fcbc, nsEventStatus & nsEventStatus_eIgnore) line 1665
HandleEvent(nsGUIEvent * 0x0012fcbc) line 63
nsWindow::DispatchEvent(nsWindow * const 0x01d48854, nsGUIEvent * 0x0012fcbc,
nsEventStatus & nsEventStatus_eIgnore) line 342 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fcbc) line 363
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 46)
line 1972 + 15 bytes
nsWindow::OnKeyDown(unsigned int 46, unsigned int 83) line 2177
nsWindow::ProcessMessage(unsigned int 256, unsigned int 46, long 22216705, long
* 0x0012fee4) line 2512 + 40 bytes

Comment 1

[buster]

marked M11 on the assumption that something's seriously wrong in gecko to cause
this crash, not because I care about how the editor operates on the test0 page.

Comment 2

[kipp]

*** This bug has been marked as a duplicate of 12958 ***

Comment 3

[Chris Petersen]

Marking as verified duplicate of 12958.