297926 - Crash when following the steps in this editor testcase

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase. Because of enablePrivilege use, you have to try the
testcase on your local hard drive.
When clicking two times on the link, Mozilla crashes (although currently one
click seems enough).

The key seems to be, this line:
var editorsession = editingSession.getEditorForWindow(editor.contentWindow);
Although I don't use it for something, it seems to be the cause of the crash.
When I remove that line of code, Mozilla doesn't crash anymore.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

0x64726164
nsCSSFrameConstructor::GetInsertionPoint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 11522]
nsCSSFrameConstructor::ContentInserted 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9033]
nsCSSFrameConstructor::RecreateFramesForContent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 11691]
nsCSSFrameConstructor::ProcessRestyledFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 10189]
nsIPresShell::ReconstructStyleDataInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5545]
nsHTMLEditor::AddOverrideStyleSheet 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLEditor.cpp,
line 3614]
nsHTMLEditor::Init 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLEditor.cpp,
line 319]
nsEditingSession::SetupEditorOnWindow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/composer/src/nsEditingSession.cpp,
line 453]
nsEditingSession::EndDocumentLoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/composer/src/nsEditingSession.cpp,
line 1110]
nsEditingSession::OnStateChange 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/composer/src/nsEditingSession.cpp,
line 815]
nsDocLoader::FireOnStateChange 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 1194]
nsDocLoader::doStopDocumentLoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 832]
nsDocLoader::OnStopRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 653]
nsLoadGroup::RemoveRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsLoadGroup.cpp,
line 732]
nsLoadGroup::Cancel 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsLoadGroup.cpp,
line 400]
nsDocLoader::Stop 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 311]
nsDocLoader::Stop 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 306]
nsDocShell::Stop 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 3163]
nsDSURIContentListener::DoContent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDSURIContentListener.cpp,
line 127]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2105]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1348]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1178]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3469]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1198]
nsXPCWrappedJSClass::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsDocumentOpenInfo::TryContentListener 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 739]
nsDocumentOpenInfo::DispatchContent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 483]
nsDocumentOpenInfo::OnStartRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 328]
nsHttpChannel::CallOnStartRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 696]
nsHttpChannel::ProcessNormal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 865]
nsHttpChannel::ProcessResponse 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 788]

Comment 3

[Martijn Wargers (dead)]

Actually, I also get this same crash in a 'regular' case, it only happens to me
when I have bfcache on:
- Go to https://bugzilla.mozilla.org/attachment.cgi?id=154357 (testcase from bug
253078)
- Click on the Google image -> drag handles should appear.
- Press Back -> you get to this page again.
- Press Forward -> Crash

Comment 4

[Brian Ryner (not reading)]

Attachment: patch

I was surprised to discover this sort of pseudo-anonymous content that the
editor creates.  By not using any of our other anonymous content mechanisms, it
ends up suffering from some odd problems -- I think this should be converted to
XBL if possible.

At any rate, with the current implementation, the HTMLEditor must clean up the
anonymous nodes that it created, or the last owning reference to them will be
left with the frame, which means a reframe will crash (as the destruction of
the original frame destroys the content node).

Comment 5

[Brian Ryner (not reading)]

Comment on attachment 188807 [details] [diff] [review]
patch

requesting approval for post-1.1a2 landing

Comment 6

[Brian Ryner (not reading)]

checked in

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using build 2005-07-14-05 Windows XP SeaMonkey trunk using:

https://bugzilla.mozilla.org/attachment.cgi?id=186489

and the testcase in comment 3.

I still see weird things (like designMode remaining on, etc.) but I believe
designMode already has a ton of bugs on it, and there's no more crash here.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Stephend, could you file the bugs you see (with the url pointing to this testcase)?

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

bz: the bug I should've mentioned explicitly is bug 300165, and I'm waiting to
test our behavior post-fix before filing additional bugs.  Sorry for not
mentioning it.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Ah, ok.  Sounds good.