Closed Bug 279458 Opened 15 years ago Closed 15 years ago

[midas] Using vBulletin3 rich text editor mode makes Mozilla crash [@ nsDOMEvent::GetTargetFromFrame - 0xdddddddd - 0x00000000]

Categories

(Core :: DOM: Editor, defect, critical)

x86
Windows Server 2003
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 279205

People

(Reporter: vedran, Assigned: mozeditor)

References

()

Details

(Keywords: crash, regression)

Crash Data

Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8b) Gecko/20050122

Steps to reproduce (it will probably occur on any vB3-based board):
1. Go to "Post reply" or "Edit signature" or any page that uses rich text editing.
2. Type some text into the box.
3. Select the text.
4. Try changing the fontsize using the toolbar of the box.

Mozilla crashes.
Talkback ID: TB3234715Q
I'm sorry if this is a duplicate, I searched but I simply couldn't find anything
similar.
Summary: Using vBulletin3 rich text editor mode makes Mozilla crash → [midas] Using vBulletin3 rich text editor mode makes Mozilla crash
When did this regress?
I'm not sure if it helps, but it works in Firefox 1.0 and probably in Mozilla 1.7.5.
Stacktrace:
dddddddd()
nsDOMEvent::GetTargetFromFrame() line 233 + 55 bytes
nsDOMEvent::nsDOMEvent(nsPresContext * 0x047920f0, nsEvent * 0x0012f0bc) line
114 + 12 bytes
nsDOMUIEvent::nsDOMUIEvent(nsPresContext * 0x047920f0, nsGUIEvent * 0x0012f0bc)
line 57 + 58 bytes
nsDOMMouseEvent::nsDOMMouseEvent(nsPresContext * 0x047920f0, nsInputEvent *
0x0012f0bc) line 48 + 103 bytes
NS_NewDOMMouseEvent(nsIDOMEvent * * 0x0012ef70, nsPresContext * 0x047920f0,
nsInputEvent * 0x0012f0bc) line 284 + 35 bytes
nsEventListenerManager::CreateEvent(nsEventListenerManager * const 0x034b6070,
nsPresContext * 0x047920f0, nsEvent * 0x0012f0bc, const nsAString & {...},
nsIDOMEvent * * 0x0012ef70) line 1650 + 17 bytes
nsXULElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent * 0x0012f0bc,
nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus * 0x0012f594)
line 2054 + 54 bytes
nsXULElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent * 0x0012f0bc,
nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus * 0x0012f594)
line 2086
nsXULElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent * 0x0012f0bc,
nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus * 0x0012f594)
line 2086
nsXULElement::HandleChromeEvent(nsXULElement * const 0x034fae6c, nsPresContext *
0x047920f0, nsEvent * 0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int
0x00000204, nsEventStatus * 0x0012f594) line 3177 + 35 bytes
nsGlobalWindow::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent * 0x0012f0bc,
nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus * 0x0012f594)
line 890
nsDocument::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent * 0x0012f0bc,
nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus * 0x0012f594)
line 3826
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1945 + 46 bytes
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsHTMLFormElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 697 + 28 bytes
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
nsGenericElement::HandleDOMEvent(nsPresContext * 0x047920f0, nsEvent *
0x0012f0bc, nsIDOMEvent * * 0x0012ef70, unsigned int 0x00000204, nsEventStatus *
0x0012f594) line 1939
Keywords: stackwanted
Summary: [midas] Using vBulletin3 rich text editor mode makes Mozilla crash → [midas] Using vBulletin3 rich text editor mode makes Mozilla crash [@ nsDOMEvent::GetTargetFromFrame - 0xdddddddd - 0x00000000]
It doesn't crash using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050119
Firefox/1.0+ 16:07
But it crashes, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050120
Firefox/1.0+ 22:16

So this could very well be a regression from fixing bug 244366.
Hmm, my debug build has the patch from bug 279205 inside, and it doesn't crash
with the url in this bug.
If someone else wants to test this quickly, without the hassle of registering,
etc., look here:
http://martijn.heelveel.info/test/mozilla/crashdesign/newreply.php.htm
Depends on: 279205
Marking duplicate of bug 279205, but please reopen if this is still present in
tomorrow's builds.

*** This bug has been marked as a duplicate of 279205 ***
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
Verified using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8b)
Gecko/20050124 build. A fix for bug 279205 indeed fixes this. Thanks, Boris!
Crash Signature: [@ nsDOMEvent::GetTargetFromFrame - 0xdddddddd - 0x00000000]
You need to log in before you can comment on or make changes to this bug.