Closed Bug 331275 Opened 19 years ago Closed 19 years ago

Crash when inserting bad HTML [@nsCOMArray_base::ObjectAt]

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: hhschwab, Assigned: mozeditor)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(1 file)

testcase
525 bytes, text/html
Details
In composer, use the Insert menu to insert an invalid HTML tag: Insert HTML... </td> insert crashes Seamonkey, see http://forums.mozillazine.org/viewtopic.php?t=395814 Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0 Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8) Gecko/20060319 SeaMonkey/1.1a (inconnu) Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060320 SeaMonkey/1.5a Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060320 SeaMonkey/1.5a Talkback: TB16670530G First link to the source doesn't load, maybe that's the bug? Invalid filename: /mozilla/xpcom/build/../glue\nsVoidArray.h. should be: http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../glue/nsVoidArray.h&mark=72&rev=#72 Stack Trace: nsCOMArray_base::ObjectAt [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/build/../glue\nsVoidArray.h, line 72] nsHTMLEditor::InsertHTML [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLDataTransfer.cpp, line 253] XPCWrappedNative::CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152] XPC_WN_CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1246] js_Interpret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3886] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1270] nsXPCWrappedJSClass::CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1379] nsXPCWrappedJS::CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 466] SharedStub [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147] nsEventListenerManager::HandleEventSubType [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1652] nsEventListenerManager::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1759] nsEventTargetChainItem::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 335] nsEventTargetChainItem::HandleEventTargetChain [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 455] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 405] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventDispatcher::Dispatch [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 575] PresShell::HandleDOMEventWithTarget [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6164] nsButtonBoxFrame::DoMouseClick [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp, line 175] nsButtonBoxFrame::MouseClicked [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsButtonBoxFrame.h, line 61] nsPresShellEventCB::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 1472] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 405] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventTargetChainItem::CreateChainAndHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392] nsEventDispatcher::Dispatch [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 575] PresShell::HandleEventInternal [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6121] PresShell::HandleEventWithTarget [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6014] nsEventStateManager::CheckForAndDispatchClick [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 3030] nsEventStateManager::PostHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 2013] PresShell::HandleEventInternal [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6139] PresShell::HandlePositionedEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5996] PresShell::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5824] nsViewManager::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1712] nsViewManager::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1665] HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1184] nsWindow::DispatchMouseEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6285] ChildWindow::DispatchMouseEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6467] nsWindow::WindowProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1373] KERNEL32.DLL + 0x363b (0xbff7363b) KERNEL32.DLL + 0x242e7 (0xbff942e7) 0x006584f6
Seems to be an old regression, tested crashing: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050813 SeaMonkey/1.0a 1.9a1: 2005103009 1.9a1: 2005120309
Attached file testcase —
The testcase crashes on load for me in current trunk build.
Might be useful to have a narrow regression range.
Assignee: composer → mozeditor
Component: Composer → Editor
Keywords: regression, testcase
Product: Mozilla Application Suite → Core
Between 1.8b4_2005081112 and 1.8b4_2005081123 was the last regression.
(In reply to comment #5) Ria, thanks for finding this. So I've been pretty near in comment #1 ;-) > Between 1.8b4_2005081112 and 1.8b4_2005081123 was the last regression. http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-08-11+08%3A00&maxdate=2005-08-11+23%3A59&cvsroot=%2Fcvsroot could it be some invalid makefile? first link into source is broken in TB, SM, FX because of backslash instead of slash. Invalid filename: /mozilla/xpcom/build/../ds\nsCOMArray.h. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../ds/nsCOMArray.h&mark=108&rev=MOZILLA_1_8_BRANCH#108 Invalid filename: /mozilla/xpcom/build/../glue\nsVoidArray.h. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../glue/nsVoidArray.h&mark=72&rev=#72 Invalid filename: /mozilla/xpcom/build/../glue\nsCOMArray.h http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../glue/nsCOMArray.h&mark=100&rev=#100 Invalid filename: /mozilla/xpcom/build/../ds\nsCOMArray.h. http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../ds/nsCOMArray.h&mark=100&rev=MOZILLA_1_8_0_BRANCH#100
jay: can you fix talkback to convert \'s to /'s? i'll see about maybe fixing bonsai to accept \s... maybe...
Actually, the patch for bug 309599 seems to fix this.
Depends on: 309599
timeless: Can you log a bug on that and assign it to me. I have too much on my plate right now, but I will try to fix that \/ problem asap.
This should be fixed now with the fix for bug 309599. Please check with tomorrow's trunk build?
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
v. tinderbox build Build ID: 2006032319
Status: RESOLVED → VERIFIED
Crash Signature: [@nsCOMArray_base::ObjectAt]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: