18723 - [CRASH] Calling nsIEditor::EndOfDocument when doing a reply freeze the App.

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect, P3)

Description

[Jean-Francois Ducarroz]

Now, you can specify where to put the insertion point when you reply to a message. If you set the following pref:

user_pref("mailnews.reply_on_top", 0);

The cursor should go at the end of the reply message. But when I call editor->EndOfDocument (nsMsgCompose.cpp,
line 147), we hit an infinity loop that frozen the application.

Comment 1

[Akkana Peck]

I see this on Linux, too, and have a stack trace:
#0  0x40166da1 in nsTraceRefcnt::LogAddRef (aPtr=0x89945f0, aRefCnt=4,
    aClazz=0x4118c592 "nsHTMLHtmlElement", classSize=72)
    at nsTraceRefcnt.cpp:1054
#1  0x40f5b957 in nsHTMLHtmlElement::AddRef (this=0x89945f0)
    at nsHTMLHtmlElement.cpp:106
#2  0x40f5bc26 in nsHTMLHtmlElement::QueryInterface (this=0x89945f0,
    aIID=@0x411c4ba0, aInstancePtr=0xbffff26c) at nsHTMLHtmlElement.cpp:113
#3  0x410daf66 in nsContentIterator::CurrentNode (this=0x8999428,
    aNode=0xbffff26c) at nsContentIterator.cpp:721
#4  0x418b6c0e in nsEditor::GetLastEditableNode (this=0x89df2a8,
    aRoot=0x8a22a48, outLastNode=0xbffff33c) at nsEditor.cpp:1834
#5  0x418b2186 in nsEditor::EndOfDocument (this=0x89df2a8) at nsEditor.cpp:726

It's looping giving the error:
NotReached: "nsContentIterator::PrevNode() : no parent found" at file
nsContentIterator.cpp, line 583
Line 583 is preceded by the comment:
      // a little noise to catch some iterator usage bugs.
I'm not sure whether this means that nsEditor::GetLastEditableNode is misusing
its content iterator, or if it means that the content iterator is misusing
itself.

Comment 2

[rubydoo123]

preface summary with keyword and setting to M12

Comment 3

[Joe Francis]

I'll try to look into this tonight.  accepting bug.

Comment 4

[rhp (gone)]

I need to uncomment some code in the compose back end when this is working.

- rhp

Comment 5

[Joe Francis]

fixed - problem was the usage of an unfinished iterator feature: MakePre().  I
rewrote nsEditor::GetFirstEditableNode() and nsEditor::GetLastEditableNode() to
not use this iterator feature (indeed to not use iterators at all).

It works fine now although the caret might not be where you expect in the
EndOfDocument() case: it appears at the end of the quoted text rather on a line
after it.  However, when you type the new text appears in the right place.  I
think the caret issue will be fixed by some work I'm checking in later this week.

Comment 6

[pmock]

Verified as fixed on win32, linux, and macos using the following builds:
ftp://sweetlou/products/client/seamonkey/windows/32bit/x86/1999-12-06-09-M12/sea
monkey32e.exe
ftp://sweetlou/products/client/seamonkey/unix/linux_glibc/2.2/x86/1999-12-06-08-
M12/netscape-i686-pc-linux-gnu.tar.gz
ftp://sweetlou/products/client/seamonkey/macos/8.x/ppc/1999-12-06-08-M12/netscap
e5-mac-M12.sea.bin

The user pref "user_pref("mailnews.reply_on_top", 0);" does work.  0=put
cursor/caret after quoted text.  1=put cursor/caret above quoted text.
When the text is quoted, there is a blank line separating the insertion point
and quoted text. No crash experienced.

Verified as fixed.

Comment 7

[pmock]

fyi, I tested this bug under POP and IMAP using a html and plain text editor.