281355 - crash if I call alert() on DidDeleteSelection of nsIEditActionListener interface

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect)

Description

[alexander :surkov (:asurkov)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a5) Gecko/20041122
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a5) Gecko/20041122

Sometimes calling of alert() method in DidDeleteSelectoin of
nsIEditActionListener brings to crash.

Reproducible: Sometimes

Steps to Reproduce:

Comment 1

[alexander :surkov (:asurkov)]

Attachment: testcase

Comment 2

[alexander :surkov (:asurkov)]

alert() method in DidDeleteText of nsIEditActionListener() sometimes leads to crash.

Comment 3

[Frank Wein [:mcsmurf]]

The alert should appear when i delete the selection (aka i click somewhere where
no selection is)? I can't seem to reproduce this (yes, i ran this testcase from
local and Allowed the scripts the privs).

Comment 4

[alexander :surkov (:asurkov)]

You can ran this test locally to reproduce this bug. You should select range and
then press 'delete' or 'backspace' key (or ctrl+x). When you delete selected
text then you should see alert. If you don't see alert then you probably recover
one more bug: event is not fired. I saw such behaviour but it is rarely.
Run this test and try to select and delete topic 'Webhosting Still Available'. I
always get a crash when I do it.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Is there a talkback incident ID?

Comment 6

[alexander :surkov (:asurkov)]

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3728144G

Comment 7

[alexander :surkov (:asurkov)]

Sorry, correct talkback id is 
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3728237K

Comment 8

[timeless]

Incident ID: 3728237
Stack Signature	nsFontMetricsWin::ResolveForwards a29cf3df
Product ID	MozillaTrunk
Build ID	2005011116
Trigger Time	2005-02-15 22:27:31.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	gkgfxwin.dll + (0000a1b2)
URL visited	
User Comments	https://bugzilla.mozilla.org/show_bug.cgi?id=281355
Since Last Crash	10433 sec
Total Uptime	728701 sec
Trigger Reason	Unknown exception 0x153f143f
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsFontMetricsWin.cpp,
line 3958
Stack Trace 	
nsFontMetricsWin::ResolveForwards 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsFontMetricsWin.cpp,
line 3958]
nsRenderingContextWin::GetWidth 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsRenderingContextWin.cpp,
line 1482]
nsTextFrame::GetPointFromOffset 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsTextFrame.cpp,
line 3840]
nsTypedSelection::GetPointFromOffset 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsSelection.cpp,
line 6753]
nsTypedSelection::GetCachedFrameOffset 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsSelection.cpp,
line 5104]
nsCaret::GetCaretRectAndInvert 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCaret.cpp,
line 983]
nsCaret::DrawCaret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCaret.cpp,
line 901]
nsCaret::StartBlinking 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCaret.cpp,
line 499]
DispatchToInterface 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 136]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1604]
nsDocument::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 3827]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 604]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5914]
PresShell::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5773]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2360]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2133]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1102]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5578]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 4241]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x2ca8 (0x77e12ca8)
USER32.dll + 0x4764 (0x77e14764)
USER32.dll + 0x4720 (0x77e14720)
ntdll.dll + 0x215ef (0x77fa15ef)
nsGlobalWindow::Focus 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 2612]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 779]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5914]
PresShell::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5773]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2360]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2133]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1102]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5578]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 4244]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x2ca8 (0x77e12ca8)
USER32.dll + 0x4764 (0x77e14764)
USER32.dll + 0x4720 (0x77e14720)
ntdll.dll + 0x215ef (0x77fa15ef)
nsGlobalWindow::Focus 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 2612]
nsWebShellWindow::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 569]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1102]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5578]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 4241]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x2ca8 (0x77e12ca8)
USER32.dll + 0x4764 (0x77e14764)
USER32.dll + 0x4720 (0x77e14720)
ntdll.dll + 0x215ef (0x77fa15ef)
USER32.dll + 0x4222 (0x77e14222)
USER32.dll + 0x2ca8 (0x77e12ca8)
USER32.dll + 0x52e6 (0x77e152e6)
USER32.dll + 0x6487 (0x77e16487)
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1390]
USER32.dll + 0x2ca8 (0x77e12ca8)
USER32.dll + 0x4764 (0x77e14764)
USER32.dll + 0x4720 (0x77e14720)
ntdll.dll + 0x215ef (0x77fa15ef)
nsXULWindow::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 481]
nsWebShellWindow::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 1584]
nsChromeTreeOwner::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsChromeTreeOwner.cpp,
line 349]
nsGlobalWindow::CloseWindow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 4851]
nsJSContext::ScriptEvaluated 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1867]

we have other bugs about nsFontMetricsWin::ResolveForwards, but i don't see the
stack's bottom, among other strange things....

Comment 9

[Martijn Wargers (dead)]

Is this still an issue, Alexander?
The testcase doesn't crash for me with current trunk build.

Comment 10

[alexander :surkov (:asurkov)]

Can you provide a link to your build? I would test with it.

Comment 11

[Boris Zbarsky [:bzbarsky]]

ftp://ftp.mozilla.org/pub/mozilla.org/mozilla/nightly/latest-trunk/ should have it.

Or ftp://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/ if that's
preferred.

Comment 12

[alexander :surkov (:asurkov)]

I tested on latest trunk (1.8b2) and on 1.8b3. Bug is presented. To reproduce
the bug try to select a header (in instance 'welcome to XULPlanet' or 'Learn
XUL') and press delete. After alert with 'hello' message mozilla should be
crashed. .

Comment 13

[Martijn Wargers (dead)]

(In reply to comment #12)
> I tested on latest trunk (1.8b2) and on 1.8b3.
1.8bb2 or 1.8b3 is not latest trunk.
You need to download one of the builds that Boris gave you the link for.
But anyway, I just crashed with a 2005-08-29 trunk build, so this bug is still
there.

Comment 14

[Martijn Wargers (dead)]

With the testcase, I crash every time, when double clicking on a link or one
click at the xulplanet logo.
When clicking the link, it seems that the link is followed. This doesn't happen
when this line:
//editor.getEditor(editor.contentWindow).addEditActionListener(listener);
is commented (like I did here).

Comment 15

[Boris Zbarsky [:bzbarsky]]

Chances are the point is that this code is not reentrant and that callees should
not put up modal dialogs...

Comment 16

[Wayne Mery (:wsmwk)]

problem gone?

testcase WFM - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060918 SeaMonkey/1.5a

only thing I see is ... Error: uncaught exception: Permission denied to create wrapper for object of class UnnamedClass

Comment 17

[Martijn Wargers (dead)]

Well, I get:
Error: [Exception... "'Permission denied to get property XULElement.disabled' when calling method: [nsIDOMXULControlElement::disabled]"  nsresult: "0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)"  location: "JS frame :: file:///C:/Documents%20and%20Settings/mw/Bureaublad/test2.xul :: anonymous :: line 23"  data: no]
Source File: file:///C:/Documents%20and%20Settings/mw/Bureaublad/test2.xul
Line: 23

with current trunk build. But I don't crash anymore. I'm marking this bug worksforme. Alexander, if you can still reproduce this bug with current trunk bug, then please reopen.