Crash on table delete row in composer [@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons]

RESOLVED DUPLICATE of bug 243809

Status

SeaMonkey
Composer
--
critical
RESOLVED DUPLICATE of bug 243809
15 years ago
10 years ago

People

(Reporter: Jim Booth, Unassigned)

Tracking

({crash, testcase})

Trunk
crash, testcase

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

15 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.5b) Gecko/20030917
Build Identifier: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.5b) Gecko/20030917

Deleting a row in a table causes a crash when there is a <!-- comment --> in the
row below the one being deleted.

Reproducible: Always

Steps to Reproduce:
1. Insert a 2 x 2 table in a blank Composer page
2. switch to source view, and insert <!-- comment --> in the first cell in the
second row
3. switch back to Normal view and use Menu Table/Delete/Row to delete the FIRST
row in the table.  (Also happens with RightClick/TableDelete/Row)
Actual Results:  
Composer crashes

Expected Results:  
The row should be deleted.

Talkback IDs TB23776207Q, TB23775821M, TB23775556W, TB23775375G, TB23775361G,
TB23775284Q, TB23775235X, TB23775086M, TB23774822K, TB23774783X.

Problem occurs in builds at least as far back as 20030807 but does not occur in
20030627, the next oldest release I had to test.   I will try to narrow it down
further.
(Reporter)

Comment 1

15 years ago
ccing Daniel Glazman
Summary: Crash when deleting table row in composer → Crash on table delete row in composer

Comment 2

15 years ago
dupe of 217717?
Bug 217717 crash [@ nsHTMLEditor::GetCSSBackgroundColorState] deleting table in
compose window

Updated

15 years ago
Keywords: crash

Comment 3

15 years ago
Created attachment 135930 [details]
testcase

testcase

Comment 4

15 years ago
Confirming with Linux trunk build 2003110505, so this is not a duplicate.

Comment 5

15 years ago
(In reply to comment #0)
> User-Agent:       Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.5b)
Gecko/20030917
> Build Identifier: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.5b)
Gecko/20030917
> 
> Deleting a row in a table causes a crash when there is a <!-- comment --> in the
> row below the one being deleted.
> 
> Reproducible: Always
> 
> Steps to Reproduce:
> 1. Insert a 2 x 2 table in a blank Composer page
> 2. switch to source view, and insert <!-- comment --> in the first cell in the
> second row
> 3. switch back to Normal view and use Menu Table/Delete/Row to delete the FIRST
> row in the table.  (Also happens with RightClick/TableDelete/Row)
> Actual Results:  
> Composer crashes
> 
> Expected Results:  
> The row should be deleted.
> 
> Talkback IDs TB23776207Q, TB23775821M, TB23775556W, TB23775375G, TB23775361G,
> TB23775284Q, TB23775235X, TB23775086M, TB23774822K, TB23774783X.
> 
> Problem occurs in builds at least as far back as 20030807 but does not occur in
> 20030627, the next oldest release I had to test.   I will try to narrow it down
> further.


Crashes here...

talkbackid: TB8706M
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040330
Microsoft Windows 2000 Pro 5.00.2195 SP4

Comment 6

15 years ago
nsHTMLEditor::CheckSelectionStateForAnonymousButtons
[/mozilla/editor/libeditor/html/nsHTMLAnonymousUtils.cpp, line 211]
nsHTMLEditor::EndUpdateViewBatch
[/mozilla/editor/libeditor/html/nsHTMLEditor.cpp, line 5981]
nsEditor::EndTransaction [/mozilla/editor/libeditor/base/nsEditor.cpp, line 725]
XPTC_InvokeByIndex [/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2029]
XPC_WN_CallMethod [/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line
1288]
js_Invoke [/mozilla/js/src/jsinterp.c, line 943]
js_Interpret [/mozilla/js/src/jsinterp.c, line 2964]
js_Invoke [/mozilla/js/src/jsinterp.c, line 959]
nsXPCWrappedJSClass::CallMethod
[/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1338]
nsXPCWrappedJS::CallMethod [/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line
450]
PrepareAndDispatch [/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 119]
SharedStub [/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsControllerCommandTable::DoCommand
[/mozilla/embedding/components/commandhandler/src/nsControllerCommandTable.cpp,
line 192]
nsBaseCommandController::DoCommand
[/mozilla/embedding/components/commandhandler/src/nsBaseCommandController.cpp,
line 133]
XPTC_InvokeByIndex [/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2029]
XPC_WN_CallMethod [/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line
1288]
js_Invoke [/mozilla/js/src/jsinterp.c, line 943]
js_Interpret [/mozilla/js/src/jsinterp.c, line 2964]
js_Invoke [/mozilla/js/src/jsinterp.c, line 959]
js_InternalInvoke [/mozilla/js/src/jsinterp.c, line 1036]
JS_CallFunctionValue [/mozilla/js/src/jsapi.c, line 3591]
nsJSContext::CallEventHandler [/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1272]
nsJSEventListener::HandleEvent [/mozilla/dom/src/events/nsJSEventListener.cpp,
line 181]
nsEventListenerManager::HandleEventSubType
[/mozilla/content/events/src/nsEventListenerManager.cpp, line 1435]
nsEventListenerManager::HandleEvent
[/mozilla/content/events/src/nsEventListenerManager.cpp, line 1512]
nsXULElement::HandleDOMEvent [/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2851]
PresShell::HandleDOMEventWithTarget
[/mozilla/layout/html/base/src/nsPresShell.cpp, line 6103]
nsMenuFrame::Execute [/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 1651]
nsMenuFrame::HandleEvent [/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 443]
PresShell::HandleEventInternal [/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6073]
PresShell::HandleEvent [/mozilla/layout/html/base/src/nsPresShell.cpp, line 5948]
nsViewManager::HandleEvent [/mozilla/view/src/nsViewManager.cpp, line 2281]
nsViewManager::DispatchEvent [/mozilla/view/src/nsViewManager.cpp, line 2025]
HandleEvent [/mozilla/view/src/nsView.cpp, line 79]
nsWindow::DispatchEvent [/mozilla/widget/src/windows/nsWindow.cpp, line 1068]
nsWindow::DispatchWindowEvent [/mozilla/widget/src/windows/nsWindow.cpp, line 1085]
nsWindow::DispatchMouseEvent [/mozilla/widget/src/windows/nsWindow.cpp, line 5225]
ChildWindow::DispatchMouseEvent [/mozilla/widget/src/windows/nsWindow.cpp, line
5478]
nsWindow::ProcessMessage [/mozilla/widget/src/windows/nsWindow.cpp, line 4063]
nsWindow::WindowProc [/mozilla/widget/src/windows/nsWindow.cpp, line 1347]
USER32.dll + 0x2a2d0 (0x77e3a2d0)
USER32.dll + 0x45e5 (0x77e145e5)
USER32.dll + 0xa816 (0x77e1a816)
nsAppShellService::Run [/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 524]
main1 [/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1309]
main [/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1713]
WinMain [/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1735]
WinMainCRTStartup()
KERNEL32.DLL + 0x287e7 (0x7c5987e7)

Updated

15 years ago
Keywords: testcase
Summary: Crash on table delete row in composer → Crash on table delete row in composer [@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons]

Comment 7

15 years ago
Reproduced using Mac/2004031613. Setting All/All.
OS: Windows 98 → All
Hardware: PC → All
*** Bug 244103 has been marked as a duplicate of this bug. ***

Comment 9

14 years ago
The message/test case of bug 244103 does not have a table.
Since it has been determined that this is the same bug because of the stack
trace then the description of this bug is incorrect.
208   // what's its tag?
209   nsAutoString focusTagName;
210   res = focusElement->GetTagName(focusTagName);
211   if (NS_FAILED(res)) return res;

It looks like this is all about a tag, specifically.  Whether or not it's a
table that's containing it shouldn't matter.
Duping to a bug with a patch and a review...

*** This bug has been marked as a duplicate of 243809 ***
Status: NEW → RESOLVED
Last Resolved: 14 years ago
Resolution: --- → DUPLICATE
Product: Browser → Seamonkey
Crash Signature: [@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons]
You need to log in before you can comment on or make changes to this bug.