211979 - mozilla crashes when I switch to design mode and load a page there [@ nsUndoCommand::IsCommandEnabled ]

Status: RESOLVED DUPLICATE of bug 211348

(Core :: DOM: Editor, defect)

Description

[Vitali]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624

1. I load a page into IFRAME
2. I switch to design mode in that IFRAME
3. I load another page in IFRAME - it cannot load right
4. When I start editing, Mozilla crashes.

Reproducible: Always

Steps to Reproduce:
1. I load a page into IFRAME
2. I switch to design mode in that IFRAME
3. I load another page in IFRAME - it cannot load right
4. When I start editing, Mozilla crashes.
Actual Results:  
finally it crashes. it worked in mozilla 1.3, but in 1.4 final version, it is not.

Expected Results:  
the page is loaded and user can edit it.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Over to Editor.

Comment 2

[Olivier Cahagne]

confirming using build 2003070405 (trunk) on Linux: TB21691773H.

Comment 3

[Olivier Cahagne]

got stack from a debug Linux build 20030702:

0x0808941e in nsQueryInterface::operator()(nsID const&, void**) const (
    this=0xbfffa1a4, aIID=@0x422c781c, answer=0xbfffa154) at nsCOMPtr.cpp:47
47                                      status = mRawPtr->QueryInterface(aIID, 
answer);
(gdb) bt
#0  0x0808941e in nsQueryInterface::operator()(nsID const&, void**) const (
    this=0xbfffa1a4, aIID=@0x422c781c, answer=0xbfffa154) at nsCOMPtr.cpp:47
#1  0x4219bed7 in nsCOMPtr<nsIEditor>::assign_from_helper(nsCOMPtr_helper 
const&, nsID const&) (this=0xbfffa1b4, helper=@0xbfffa1a4, aIID=@0x422c781c)
    at ../../../dist/include/xpcom/nsCOMPtr.h:965
#2  0x4219bd4c in nsCOMPtr (this=0xbfffa1b4, helper=@0xbfffa1a4)
    at ../../../dist/include/xpcom/nsCOMPtr.h:549
#3  0x422ac9c1 in nsUndoCommand::IsCommandEnabled(char const*, nsISupports*, 
int*) (this=0x86d1780, aCommandName=0x875e8d0 "cmd_undo",
    aCommandRefCon=0x89d2d10, outCmdEnabled=0xbfffa410)
    at nsEditorCommands.cpp:74
#4  0x420cf802 in nsControllerCommandTable::IsCommandEnabled(char const*, 
nsISupports*, int*) (this=0x86d19f0, aCommandName=0x875e8d0 "cmd_undo",
    aCommandRefCon=0x89d2d10, aResult=0xbfffa410)
    at nsControllerCommandTable.cpp:138
#5  0x420c8e67 in nsBaseCommandController::IsCommandEnabled(char const*, int*)
    (this=0x8b476e0, aCommand=0x875e8d0 "cmd_undo", aResult=0xbfffa410)
    at nsBaseCommandController.cpp:117
#6  0x4082466d in XPTC_InvokeByIndex () at xptcinvoke_gcc_x86_unix.cpp:69
#7  0x4094dbde in XPCWrappedNative::CallMethod(XPCCallContext&, 
XPCWrappedNative::CallMode) (ccx=@0xbfffa4d0, mode=CALL_METHOD) at 
xpcwrappednative.cpp:2016
#8  0x40957fc5 in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*, 
long*) (cx=0x8264978, obj=0x8a42f60, argc=1, argv=0x8b47c60, vp=0xbfffa670)
    at xpcwrappednativejsops.cpp:1269
#9  0x4005ccb0 in js_Invoke (cx=0x8264978, argc=1, flags=0) at jsinterp.c:843
#10 0x4006b2e5 in js_Interpret (cx=0x8264978, result=0xbfffac1c)
    at jsinterp.c:2854
#11 0x4005cd2e in js_Invoke (cx=0x8264978, argc=1, flags=2) at jsinterp.c:860
#12 0x4005d0a7 in js_InternalInvoke (cx=0x8264978, obj=0x8230520,
    fval=136799088, flags=0, argc=1, argv=0xbfffafd8, rval=0xbfffadcc)
    at jsinterp.c:935
#13 0x4002d1ce in JS_CallFunctionValue (cx=0x8264978, obj=0x8230520,
    fval=136799088, argc=1, argv=0xbfffafd8, rval=0xbfffadcc) at jsapi.c:3531
#14 0x41369972 in nsJSContext::CallEventHandler(void*, void*, unsigned, void*, 
int*, int) (this=0x817f8a8, aTarget=0x8230520, aHandler=0x8276370, argc=1,
    argv=0xbfffafd8, aBoolResult=0xbfffae78, aReverseReturnResult=0)
    at nsJSEnvironment.cpp:1216
#15 0x413df176 in nsJSEventListener::HandleEvent(nsIDOMEvent*) (
    this=0x85f70a8, aEvent=0x8b216a8) at nsJSEventListener.cpp:180
#16 0x41aee0c7 in nsEventListenerManager::HandleEventSubType(nsListenerStruct*,
nsIDOMEvent*, nsIDOMEventTarget*, unsigned, unsigned) (this=0x85f7078,
    aListenerStruct=0x85f70d0, aDOMEvent=0x8b216a8, aCurrentTarget=0x8ae5540,
    aSubType=32, aPhaseFlags=7) at nsEventListenerManager.cpp:1190
#17 0x41af14ce in nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, 
nsIDOMEvent**, nsIDOMEventTarget*, unsigned, nsEventStatus*) (this=0x85f7078,
    aPresContext=0x83cc218, aEvent=0xbfffb720, aDOMEvent=0xbfffb65c,
    aCurrentTarget=0x8ae5540, aFlags=7, aEventStatus=0xbfffb6cc)
    at nsEventListenerManager.cpp:2189
#18 0x41d3e4fd in nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, 
nsIDOMEvent**, unsigned, nsEventStatus*) (this=0x84e1b30, 
aPresContext=0x83cc218,
    aEvent=0xbfffb720, aDOMEvent=0xbfffb65c, aFlags=7, aEventStatus=0xbfffb6cc)
    at nsXULElement.cpp:3275
#19 0x41cc47d2 in nsXULCommandDispatcher::UpdateCommands(nsAString const&) (
    this=0x83cb3f8, aEventName=@0xbfffba10) at nsXULCommandDispatcher.cpp:389
#20 0x41386a75 in GlobalWindowImpl::UpdateCommands(nsAString const&) (
    this=0x8b18158, anAction=@0xbfffba10) at nsGlobalWindow.cpp:3541
#21 0x41372540 in nsFocusController::UpdateCommands(nsAString const&) (
    this=0x83c9160, aEventName=@0xbfffba10) at nsFocusController.cpp:166
#22 0x413734a0 in nsFocusController::Focus(nsIDOMEvent*) (this=0x83c9160,
    aEvent=0x8ae5560) at nsFocusController.cpp:322
#23 0x41aefcd6 in nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, 
nsIDOMEvent**, nsIDOMEventTarget*, unsigned, nsEventStatus*) (this=0x8338fc8,
    aPresContext=0x8a924c8, aEvent=0xbfffdb80, aDOMEvent=0xbfffd924,
    aCurrentTarget=0x84087f0, aFlags=4, aEventStatus=0xbfffdbbc)
    at nsEventListenerManager.cpp:1687
#24 0x413b8319 in nsWindowRoot::HandleChromeEvent(nsIPresContext*, nsEvent*, 
nsIDOMEvent**, unsigned, nsEventStatus*) (this=0x84087f0, 
aPresContext=0x8a924c8,
    aEvent=0xbfffdb80, aDOMEvent=0xbfffd924, aFlags=4, aEventStatus=0xbfffdbbc)
    at nsWindowRoot.cpp:214
[...]
I couldn't find any local vars to look at.

Didn't find dupes, marking NEW.

Comment 4

[Kathleen :Brade]

dupe of 211348 and probably something else; I thought we fixed this.

*** This bug has been marked as a duplicate of 211348 ***