166056 - Crash when pasting unusual characters in URL Bar/Composer/Textarea [@ nsDataObj::GetText][@ MSVCRT.DLL]

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Olivier Cahagne]

Build ID: 2002090104 (trunk) on Win2k.

Steps to reproduce:
1. Load upcoming testcase,
2. Double click on the chars to select them,
3. Ctrl-L to focus URL Bar, Ctrl-V to paste the chars,
4. Mozilla crashes.

Talkback ID: TB10203947W.

These chars were found when pasting an URL from an internal page to EditPlus
(perhaps it's a CR/LF char ?), Mozilla didn't show these chars via View Source.

Comment 1

[Olivier Cahagne]

Attachment: Testcase (see comment #1 for steps to reproduce crash)

Comment 2

[Olivier Cahagne]

I don't crash using build 20020901 on Linux (trunk).

Comment 3

[Olivier Cahagne]

it crashes Win2k if content is pasted nearly anywhere (a Bugzilla textbox,
Composer, etc.).

Comment 4

[Robert Ginda]

Attachment: Talkback report TB10203947W

Comment 5

[Olivier Cahagne]

-> XP Toolkit

Comment 6

[Olivier Cahagne]

another simple testcase:
1. Load http://www.deadly.org/article.php3?sid=20020830183511
2. copy (by double clicking on it) the URL in comment 'no subject given' (bottom
of page)
3. paste it in URL bar (or composer/textarea in another page),
4. Mozilla crashes.

If I paste the content I just highlighted ( should be
http://www.gentoo.org/news/20020123-amd-news.html ) in an advanced editor
(EditPlus), it shows ??? (this was first pasted in EditPlus, then in Mozilla,
otherwise would have crashed), so it seems copying a URL is broken.

Comment 7

[Michael Lefevre]

just a data point - WFM in 2002083108 on win2k.

Comment 8

[Olivier Cahagne]

regression as 2002083108 works fine on Win2k. Only checkins between 2002083108
and 2002090104: bug 78676, bug 128420 (unrelated: bug 144368, bug 142594, bug
19420) and also a checkin to enable (?) MMX in mozilla/configure.in
Cc'ing caillon as he works on bug 162163 which involves selection.

Comment 9

[Boris Zbarsky [:bzbarsky]]

*** Bug 166157 has been marked as a duplicate of this bug. ***

Comment 10

[timeless]

assuming this is the right bug, i've crashed repeatedly trying to copy a bug
summary and paste it into notepad so that i can update the mozilla release notes.
marking smoketest blocker.
tb10250809e -- if this stack doesn't match please file a new bug cc me and feel
free to move the markers to that bug.

Comment 11

[greer]

Attachment: timeless' stack (incident #10250809)

timeless, you've got the right bug.

Comment 12

[Ben Guthrie]

build id 2002090108  I don't think it was special characters, simple ctrl/v of
text from a web page

TB10264218Y

is this the right bug?


MOZILLA caused an invalid page fault in
module MSVCRT.DLL at 0177:78001637.
Registers:
EAX=0464a3ca CS=0177 EIP=78001637 EFLGS=00010202
EBX=0064ed98 SS=017f ESP=0064ec44 EBP=0064ec4c
ECX=00ffe8f2 DS=017f ESI=00650000 FS=12af
EDX=00000002 ES=017f EDI=050d12f8 GS=0000
Bytes at CS:EIP:
f3 a5 ff 24 95 68 1f 00 78 8b c7 ba 03 00 00 00 
Stack dump:
03ffb6b2 60e98aad 0064ece0 6054ec76 050d0010 0064ed18 03ffb6b2 0064ed84 03ffb6b0
03ffeba0 00000000 00000000 00423ff8 03ffb6b0 00423ff4 0064ecd0 

Comment 13

[Boris Zbarsky [:bzbarsky]]

*** Bug 166232 has been marked as a duplicate of this bug. ***

Comment 14

[Ryan Pertusio]

Is it possible, that this is a regression, or some relation to bug 16940
(plaintext copy pastes Japanese)?

From my recollection, the "unusual characters" are actually Japanese characters,
that are not displaying correctly.

2002090208 - WinXP

From my personal experience, I can reproduce this bug, by copying some text from
a website (any.. doesnt matter), and pasting it into NotePad, Explorer (location
bar), and some other programs.  (I hesitate to modify the summary, as it is
quite long already)

I have a few talkback incidents.. but TalkBack refuses to send (another bug). 
If necessary, I can attach the incidents somehow (instructions?)

Comment 15

[Ryan Pertusio]

Also note some stack info and testcase in bug 166157 (marked a duplicate of this
one)

Comment 16

[Ryan Pertusio]

Apologies, I mistyped the bug number.

bug 164940 - Plaintext copy pastes Japanese

I successfully sent 1 talkback report, others still refuse to send.

TB10280721G

Comment 17

[Alec Flett]

let's at least start here:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=MozillaTinderboxAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Change+Size&hours=2&date=explicit&mindate=8%2F31%2F2002+8%3A00&maxdate=9%2F1%2F2002+4%3A00&cvsroot=%2Fcvsroot

I think jag might be on vacation

Comment 18

[Alec Flett]

in particular, jfrancis's change to nsDocumentEncoder for bug 78676
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=MozillaTinderboxAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&hours=2&date=explicit&mindate=8%2F31%2F2002+8%3A00&maxdate=9%2F1%2F2002+4%3A00&cvsroot=%2Fcvsroot

reassigning over there to start.

Comment 19

[David G King]

From that Bonsai query, it really can only be nsDocumentEncoder or
nsGlobalWindow as everything else is Unix only (or Makefile/configure stuff).

Comment 20

[Akkana Peck]

I don't see a crash on linux with either test case; but it doesn't paste
anything either (into either the urlbar, composer or a separate plaintext app
like a shell window).  Most text copies/pastes correctly, but the examples in
the test cases don't, so there's clearly something wrong even if I don't see the
crash.

Comment 21

[Akkana Peck]

Reverting nsDocumentEncoder.cpp to revision 1.72 (before Joe's two changes) does
make the two testcase urls paste again.  I can't verify whether it fixes the
crash since I'm not seeing the crash.

Comment 22

[kinmoz]

Yeah it's definitely something in nsDocumentEncoder.cpp revision 1.73. I backed
out out to rev 1.72 and the crash is gone.

Comment 23

[Alec Flett]

sheriff alec says: check it in, lets get this tree open!

Comment 24

[Joe Francis]

backed out

Comment 25

[kinmoz]

I told jfrancis over aim that I think it has to do with the 2 areas in the diff
where he does this:

+    // reset default values
+    *outNode = parent;
+    *outOffset = offset;
+

If I skip those places, in the debugger things paste fine.

Comment 26

[greer]

*** Bug 166418 has been marked as a duplicate of this bug. ***

Comment 27

[Boris Zbarsky [:bzbarsky]]

*** Bug 166553 has been marked as a duplicate of this bug. ***

Comment 28

[Dimitrios]

All testcases in the dupes and the original one now are not crashing on
2002090404/Win2000. Verifying as fixed.  Big thanx to people involved in fixing
this issue.

Comment 29

[Olivier Cahagne]

*** Bug 167999 has been marked as a duplicate of this bug. ***