331275 - Crash when inserting bad HTML [@nsCOMArray_base::ObjectAt]

Reporter

Description

•

18 years ago

In composer, use the Insert menu to insert an invalid HTML tag:
Insert HTML... </td> insert

crashes Seamonkey, see http://forums.mozillazine.org/viewtopic.php?t=395814

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8) Gecko/20060319 SeaMonkey/1.1a (inconnu)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060320 SeaMonkey/1.5a
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20060320 SeaMonkey/1.5a


Talkback: TB16670530G

First link to the source doesn't load, maybe that's the bug?
Invalid filename: /mozilla/xpcom/build/../glue\nsVoidArray.h.
should be:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../glue/nsVoidArray.h&mark=72&rev=#72

Stack Trace:
nsCOMArray_base::ObjectAt  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/build/../glue\nsVoidArray.h, line 72]
nsHTMLEditor::InsertHTML  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/editor/libeditor/html/nsHTMLDataTransfer.cpp, line 253]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1246]
js_Interpret  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3886]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1270]
nsXPCWrappedJSClass::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1379]
nsXPCWrappedJS::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 466]
SharedStub  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1652]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1759]
nsEventTargetChainItem::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 335]
nsEventTargetChainItem::HandleEventTargetChain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 455]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 405]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventDispatcher::Dispatch  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 575]
PresShell::HandleDOMEventWithTarget  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6164]
nsButtonBoxFrame::DoMouseClick  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp, line 175]
nsButtonBoxFrame::MouseClicked  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsButtonBoxFrame.h, line 61]
nsPresShellEventCB::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 1472]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 405]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventTargetChainItem::CreateChainAndHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 392]
nsEventDispatcher::Dispatch  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventDispatcher.cpp, line 575]
PresShell::HandleEventInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6121]
PresShell::HandleEventWithTarget  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6014]
nsEventStateManager::CheckForAndDispatchClick  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 3030]
nsEventStateManager::PostHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 2013]
PresShell::HandleEventInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6139]
PresShell::HandlePositionedEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5996]
PresShell::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5824]
nsViewManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1712]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 1665]
HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1184]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6285]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6467]
nsWindow::WindowProc  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1373]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x006584f6

Hermann Schwab

Reporter

Comment 1

•

18 years ago

Seems to be an old regression, tested crashing: 

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050813 SeaMonkey/1.0a
1.9a1: 2005103009
1.9a1: 2005120309

Martijn Wargers (dead)

Comment 2

•

18 years ago

Attached file testcase — Details

The testcase crashes on load for me in current trunk build.

Martijn Wargers (dead)

Comment 3

•

18 years ago

Might be useful to have a narrow regression range.

Assignee: composer → mozeditor

Component: Composer → Editor

Keywords: regression, testcase

Product: Mozilla Application Suite → Core

Hermann Schwab

Reporter

Comment 4

•

18 years ago

    tested using testcase: 
    TB16674036Q SM Trunk, TB16674119Z FX Trunk, TB16674445Y FX Branch

    306 crashes found in the old database:
    Thunderbird: http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=16414525

    http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsCOMArray_base%3A%3AObjectAt&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=build

Ria Klaassen (not reading all bugmail)

Comment 5

•

18 years ago

Between 1.8b4_2005081112 and 1.8b4_2005081123 was the last regression.

Hermann Schwab

Reporter

Comment 6

•

18 years ago

(In reply to comment #5)
Ria, thanks for finding this. So I've been pretty near in comment #1 ;-)
> Between 1.8b4_2005081112 and 1.8b4_2005081123 was the last regression.

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-08-11+08%3A00&maxdate=2005-08-11+23%3A59&cvsroot=%2Fcvsroot

could it be some invalid makefile?
first link into source is broken in TB, SM, FX because of backslash instead of slash. 

Invalid filename: /mozilla/xpcom/build/../ds\nsCOMArray.h.
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../ds/nsCOMArray.h&mark=108&rev=MOZILLA_1_8_BRANCH#108

Invalid filename: /mozilla/xpcom/build/../glue\nsVoidArray.h.
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../glue/nsVoidArray.h&mark=72&rev=#72

Invalid filename: /mozilla/xpcom/build/../glue\nsCOMArray.h
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../glue/nsCOMArray.h&mark=100&rev=#100

Invalid filename: /mozilla/xpcom/build/../ds\nsCOMArray.h.
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/build/../ds/nsCOMArray.h&mark=100&rev=MOZILLA_1_8_0_BRANCH#100

timeless

Comment 7

•

18 years ago

jay: can you fix talkback to convert \'s to /'s?

i'll see about maybe fixing bonsai to accept \s... maybe...

Martijn Wargers (dead)

Comment 8

•

18 years ago

Actually, the patch for bug 309599 seems to fix this.

Depends on: 309599

Jay Patel [:jay]

Comment 9

•

18 years ago

timeless:  Can you log a bug on that and assign it to me.  I have too much on my plate right now, but I will try to fix that \/ problem asap.

Martijn Wargers (dead)

Comment 10

•

18 years ago

This should be fixed now with the fix for bug 309599.
Please check with tomorrow's trunk build?

Status: NEW → RESOLVED

Closed: 18 years ago

Resolution: --- → FIXED

Hermann Schwab

Reporter

Comment 11

•

18 years ago

v. tinderbox build Build ID: 2006032319

Status: RESOLVED → VERIFIED

Nobody; OK to take it and work on it

Updated

•

13 years ago

Crash Signature: [@nsCOMArray_base::ObjectAt]

Bugzilla

Quick Search

Crash when inserting bad HTML [@nsCOMArray_base::ObjectAt]

Categories

(Core :: DOM: Editor, defect)

Tracking

()

People

(Reporter: hhschwab, Assigned: mozeditor)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Comment 1

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Comment 8

Comment 9

Comment 10

Comment 11

Updated

Attachment

General

Description

File Name

Content Type