260771 - Crash when indenting

Status: VERIFIED FIXED

(SeaMonkey :: Composer, defect, P1)

Description

[Roy Lamberton]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040919
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040919

When editing an existing web document [we use a lot of templates with blockquote
here], the composer will freeze, then cause a general crash when using
blockquote to indent sections of a document.

This happens when the browser is also open with pages with heavy graphic content.

Reproducible: Always
Steps to Reproduce:
1. Enter and existing html document in Composer
2. Attempt to use the keyboard Blockquote function
3. Entire Mozilla suite locks up and sends a report to Microsoft

Actual Results:  
we get a lockup with a loss of everything since the last save. [We then curse
and scream because sometimes we've lost part of a story!]

Expected Results:  
Indented the paragraph or section of the document 

The software just returns a not responding error, then XP takes over and closes
the entire Suite.

We are running XP Pro with 1 GB of RAM and SP2 installed.

Comment 1

[Colin S]

Tested and works fine just by editing this page and indenting in several places
using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910.
This may be a regression, or it may be specific to your setup. Can you test with
1.7.3 and confirm that it does not occur with that version?

Comment 2

[Gérard Talbot]

I was "able" to crash by doing the following steps:
1- Start Composer in a blank document
2- click the "indent text (move right)" icon in the Formating toolbar

I think/believe that the bug is reproducible if there is no text at all in the
document.

Mozilla 1.8a4 build 2004092104 under XP Pro SP2 here.

I can not send talkback crash data because of bug 210251 (I have modem connection).

CONFIRMING

Colin, this bug was filed for the trunk version, not the 1.7 branch.
"be sure that you've reproduced your bug using a build released within the past
three days."
http://www.mozilla.org/quality/bug-writing-guidelines.html

Comment 3

[Gérard Talbot]

I was able to send talkback crash data 
(Incident ID TB951768G)
while trying Mozilla 1.8a4 build 2004092306.

Setting priority to P1; I think Severity should be set to Blocker.

Adding keywords talkbackid, clean-report, regression

Comment 4

[Marcia Knous [:marcia]]

I think this bug may possibly be related to Bugzilla 261120 which is already
marked as a blocker. Using today's trunk build (20040923) on the Mac, I am able
to reproduce a crash using a blank document and just hitting indent, but not
when I edit an exiting document and indent text. I will investigate this using
Win XP and report back after trying to recreate the steps (as best as possible)
that the reporter describes.

Comment 5

[Gérard Talbot]

Both bugs are very similar and are possibly related to the same bug: if there is
no text in the document (or no targeted nodes for the command), it triggers an
infinite loop. There maybe other commands which would create an infinite loop
with a blank document.

Comment 6

[Mats Palmgren (inactive)]

###!!! ASSERTION: index out of range: '0 <= aIndex && aIndex < Count()',
   file ../../../dist/include/xpcom/nsVoidArray.h, line 71

(gdb) bt
...
#6  <signal handler called>
#7  0x419e99d3 in nsVoidArray::FastElementAt(int) const (this=0xbfffc35c,
aIndex=0) at nsVoidArray.h:72
#8  0x419e8d88 in nsCOMArray_base::ObjectAt(int) const (this=0xbfffc35c,
aIndex=0) at nsCOMArray.h:100
#9  0x419e5fba in nsCOMArray<nsIDOMNode>::ObjectAt(int) const (this=0xbfffc35c,
aIndex=0) at nsCOMArray.h:153
#10 0x419e3ac0 in nsCOMArray<nsIDOMNode>::operator[](int) const
(this=0xbfffc35c, aIndex=0) at nsCOMArray.h:163
#11 0x41a25953 in nsHTMLEditRules::WillCSSIndent(nsISelection*, int*, int*)
(this=0x8aa0458, aSelection=0x8a17928, aCancel=0xbfffc33c, aHandled=0xbfffc4c8)
    at nsHTMLEditRules.cpp:3496
...
(gdb) fr 11
#11 0x41a25953 in nsHTMLEditRules::WillCSSIndent(nsISelection*, int*, int*)
(this=0x8aa0458, aSelection=0x8a17928, aCancel=0xbfffc33c, aHandled=0xbfffc4c8)
    at nsHTMLEditRules.cpp:3496
3496        nsCOMPtr<nsIDOMNode> curNode = arrayOfNodes[0];
(gdb) p arrayOfNodes
$8 = {<nsCOMArray_base> = {mArray = {_vptr.nsVoidArray = 0x40a8b768, mImpl =
0x0}}, <No data fields>}
(gdb)

Comment 7

[Mats Palmgren (inactive)]

Attachment: wip

Something like this perhaps...	this also fixes bug 261120, which is the same
kind of problem but at a different line.

Comment 8

[Roy Lamberton]

the problem seems to have disappeared after I downloaded the latest version

Comment 9

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 159915 [details] [diff] [review]
wip

r=bzbarsky

Comment 10

[Roy Lamberton]

The problem still exists in build 2004092206.

Complete lockup of Mozilla Browser and composter when trying to indent a file.
Line above indent had both Font color and Bold. hit new line and attempted to
use "Control ]" to indent. Page locked, could not save changes and eventually
the entire browser shut down due to no response.

FWIW - 1. this is intermittant, I can indent on other pages without error.
2. I don't know how to get the Netscape reporting to run in the background so
you guys could see this in action - it worked the first time, but I don't see
anything that suggests it is sending in reports.

Thanks
rsl

Comment 11

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

Roy Lamberton: the fix is not checked in yet!!!

Comment 12

[Roy Lamberton]

Here is the html prior to the changes that caused the lockup. The Changes were
made immediately after the <body>:

<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
<meta name="author" content="rstetson">
<meta name="GENERATOR" content="Mozilla/4.79 [en] (Windows NT 5.0; U)
[Netscape]"><title>PregameIntel</title></head>
<body><br>
<blockquote><hr size="2" width="100%">


<center><table bgcolor="#330033" border="1" cols="1" width="75%">
<caption><i><font face="arial narrow"><font color="#000000"><font size="-1">You
can send your comments or "back door" information</font></font></font></i>
<br><i><font face="arial narrow"><font size="-1">to<a
href="https://secure.theinsiders.com/a.z?s=179&amp;p=5&amp;c=18">
Coach Roy</a><br>
<br>
</font></font></i></caption>

<tbody><tr align="center" bgcolor="#663366" valign="CENTER">
<td align="center" valign="CENTER"><b><font face="Tahoma"><font
color="#ffffff"><font size="+1">Go
Cats</font></font></font></b>
<br><b><font face="Tahoma"><font color="#ffffff"><font size="+1">Beat 'em
All!</font></font></font></b></td>
</tr>

<tr align="center" bgcolor="#ffffff">
<td><b><font color="#663366">Talk about it on the Purple Boards</font></b>
<br><font color="#663366">[<a href="http://citadel.ezboard.com/bnorthwestern">Click
Here</a>]</font></td>
</tr>

<tr>
<td>
<center><font face="Tahoma"><font color="#ffffff"><font size="-2">Copyright
2004 by PurpleWildcats.com/Purple Reign</font></font></font></center>
</td>
</tr>
</tbody></table></center>
<!---------------- OPENTRACKER HTML START -----------------><script
defer="defer"
src="http://server1.opentracker.net/?site=www.purplewildcats.com"></script>
<!---------------- OPENTRACKER HTML END -----------------></blockquote>

</body></html>

Comment 13

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

All: PLEASE STOP spamming this bug ; I verified on my debug build the diagnosis
was correct, the fix is attached and has all necessary r/sr/a so Mats can check
it in.
Mats, det kan jag göra i stället för dig om du inte kan.

Comment 14

[Roy Lamberton]

This thing happens whenever you are trying to indent in front of an <hr> tag.

Comment 15

[Asa Dotzler [:asa]]

Comment on attachment 159915 [details] [diff] [review]
wip

a=asa for 1.8a4 checkin.

Comment 16

[Asa Dotzler [:asa]]

Is this landed yet? If not, who is on the hook for that? Time is short for 1.8a4

Comment 17

[Mats Palmgren (inactive)]

Give me 10 minutes and it will be in...

Comment 18

[Mats Palmgren (inactive)]

Checked in 2004-09-24 13:23 PDT.

Comment 19

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Y'know, I've had a fix for this in my tree for a week (attached to bug 96108),
but I never got superreview on it.  I think I'd thought I requested it but I
actually hadn't.

Comment 20

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

(And I prefer my solution, which was different for all but the first change. 
And I'm clearly doing code reviews too quickly if I don't notice that while
reviewing.)

Comment 21

[Mats Palmgren (inactive)]

Yeah, that looks even better...

-> FIXED

Comment 22

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on the trunk using build 2004-09-26-05 on Windows XP with Seamonkey.