Closed Bug 37821 Opened 24 years ago Closed 24 years ago

<select> tag crashes editor

Tracking

()

Status:

VERIFIED DUPLICATE of bug 37493

Milestone:

M16

People

(Reporter: elig, Assigned: cmanske)

References

(
URL
)

Details

(Keywords: crash, testcase)

Attachments

(1 file)

small html file with <select> and a few options 24 years ago Jesse Ruderman 99 bytes, text/html		Details

Eli Goldberg

Reporter

Description

•

24 years ago

Using this afternoon's builds (Win/Mac/Linux):

1. View www.amazon.com
2. From the File menu, select "Edit Page".

<Or, view a page with a link to it, and then context-click to load the page in 
Editor.>

Immediate crash results:

PowerPC unmapped memory exception at 68F168F0
 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  1FE7402C  
  0E56EAC0    PPC  1FE6323C  main+0016C
  0E56EA30    PPC  1FE62B84  main1(int, char**, nsISplashScreen*)+00624
  0E56E940    PPC  1E6CA8C8  nsAppShellService::Run()+00018
  0E56E900    PPC  1E661110  nsAppShell::Run()+00038
  0E56E8B0    PPC  1E66180C  nsMacMessagePump::DoMessagePump()+0003C
  0E56E860    PPC  1E661E14  nsMacMessagePump::DispatchEvent(int, EventRecord*)+
00174
  0E56E810    PPC  1E1F4924  Repeater::DoRepeaters(const EventRecord&)+00030
  0E56E7D0    PPC  1E6456D4  nsMacNSPREventQueueHandler::RepeatAction(const 
EventRecord&)+000
0C
  0E56E790    PPC  1E6457EC  nsMacNSPREventQueueHandler::ProcessPLEventQueue()+
000B0
  0E56E720    PPC  1E305D28  nsEventQueueImpl::ProcessPendingEvents()+000E4
  0E56E6C0    PPC  1E305C7C  nsEventQueueImpl::ProcessPendingEvents()+00038
  0E56E660    PPC  1E35EC68  PL_ProcessPendingEvents+0004C
  0E56E620    PPC  1E35ED50  PL_HandleEvent+00020
  0E56E5E0    PPC  1E5ED3AC  nsStreamListenerEvent::HandlePLEvent(PLEvent*)+00024
  0E56E590    PPC  1E5EE264  nsOnStopRequestEvent::HandleEvent()+00070
  0E56E540    PPC  1E5A7598  nsHTTPServerListener::OnStopRequest(nsIChannel*, 
nsISupports*, u
nsigned int, const unsigned short*)+00124
  0E56E490    PPC  1E5A0850  nsHTTPChannel::ResponseCompleted(nsIStreamListener*, 
unsigned in
t, const unsigned short*)+000B8
  0E56E420    PPC  1E604914  nsLoadGroup::RemoveChannel(nsIChannel*, nsISupports*
, unsigned i
nt, const unsigned short*)+00104
  0E56E3A0    PPC  1F852618  nsDocLoaderImpl::OnStopRequest(nsIChannel*, 
nsISupports*, unsign
ed int, const unsigned short*)+00060
  0E56E350    PPC  1F852848  nsDocLoaderImpl::DocLoaderIsEmpty(unsigned int)+
00100
  0E56E2F0    PPC  1F852BB4  
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl*, nsIChan
nel*, unsigned int)+00138
  0E56E270    PPC  1F8773F4  nsWebShell::OnEndDocumentLoad(nsIDocumentLoader*, 
nsIChannel*, u
nsigned int)+0030C
  0E56DBF0    PPC  1D583400  nsEditorShell::OnEndDocumentLoad(nsIDocumentLoader*, 
nsIChannel*
, unsigned int)+00324
  0E56D6F0    PPC  1D574780  
nsEditorShell::PrepareDocumentForEditing(nsIDocumentLoader*, nsI
URI*)+00E6C
  0E56D2D0    PPC  1D548964  nsHTMLEditor::ApplyOverrideStyleSheet(const 
nsString&, nsICSSSty
leSheet**)+00014
  0E56D290    PPC  1D5490C4  
nsHTMLEditor::ApplyDocumentOrOverrideStyleSheet(const nsString&,
 int, nsICSSStyleSheet**)+0066C
  0E56D0C0    PPC  1DB89DCC  
nsDocument::SetStyleSheetDisabledState(nsIStyleSheet*, int)+0011
8
  0E56D040    PPC  1DBA3C84  
PresShell::StyleSheetDisabledStateChanged(nsIDocument*, nsIStyle
Sheet*, int)+0000C
  0E56D000    PPC  1DBA3B34  PresShell::ReconstructFrames()+0002C
  0E56CFC0    PPC  1DBB40F4  
StyleSetImpl::ReconstructDocElementHierarchy(nsIPresContext*)+00
018
  0E56CF80    PPC  1DE38734  
nsCSSFrameConstructor::ReconstructDocElementHierarchy(nsIPresCon
text*)+0014C
  0E56CE00    PPC  1DEB50F4  FrameManager::RemoveFrame(nsIPresContext*, 
nsIPresShell&, nsIFra
me*, nsIAtom*, nsIFrame*)+00020
  0E56CDC0    PPC  1DC5D4B8  CanvasFrame::RemoveFrame(nsIPresContext*, 
nsIPresShell&, nsIAtom
*, nsIFrame*)+00090
  0E56CD50    PPC  1DE4880C  nsFrameList::DestroyFrame(nsIPresContext*, nsIFrame*
)+00038
  0E56CD10    PPC  1DDFFFF4  nsAreaFrame::Destroy(nsIPresContext*)+00034
  0E56CCD0    PPC  1DD931E8  nsBlockFrame::Destroy(nsIPresContext*)+0005C
  0E56CC90    PPC  1DDF6EE0  nsLineBox::DeleteLineList(nsIPresContext*, 
nsLineBox*)+0004C
  0E56CC40    PPC  1DD931E8  nsBlockFrame::Destroy(nsIPresContext*)+0005C
  0E56CC00    PPC  1DDF6EE0  nsLineBox::DeleteLineList(nsIPresContext*, 
nsLineBox*)+0004C
  0E56CBB0    PPC  1DC37024  nsTableOuterFrame::Destroy(nsIPresContext*)+00040
  0E56CB70    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56CB20    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56CAD0    PPC  1DC2B680  nsTableFrame::Destroy(nsIPresContext*)+0002C
  0E56CA90    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56CA40    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C9F0    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C9A0    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C950    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C900    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C8B0    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C860    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C810    PPC  1DD931E8  nsBlockFrame::Destroy(nsIPresContext*)+0005C
  0E56C7D0    PPC  1DDF6EE0  nsLineBox::DeleteLineList(nsIPresContext*, 
nsLineBox*)+0004C
  0E56C780    PPC  1DC37024  nsTableOuterFrame::Destroy(nsIPresContext*)+00040
  0E56C740    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C6F0    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C6A0    PPC  1DC2B680  nsTableFrame::Destroy(nsIPresContext*)+0002C
  0E56C660    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C610    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C5C0    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C570    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C520    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C4D0    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C480    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C430    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C3E0    PPC  1DD931E8  nsBlockFrame::Destroy(nsIPresContext*)+0005C
  0E56C3A0    PPC  1DDF6EE0  nsLineBox::DeleteLineList(nsIPresContext*, 
nsLineBox*)+0004C
  0E56C350    PPC  1DC37024  nsTableOuterFrame::Destroy(nsIPresContext*)+00040
  0E56C310    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C2C0    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C270    PPC  1DC2B680  nsTableFrame::Destroy(nsIPresContext*)+0002C
  0E56C230    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C1E0    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C190    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C140    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C0F0    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C0A0    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56C050    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56C000    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56BFB0    PPC  1DD931E8  nsBlockFrame::Destroy(nsIPresContext*)+0005C
  0E56BF70    PPC  1DDF6EE0  nsLineBox::DeleteLineList(nsIPresContext*, 
nsLineBox*)+0004C
  0E56BF20    PPC  1DC37024  nsTableOuterFrame::Destroy(nsIPresContext*)+00040
  0E56BEE0    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56BE90    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56BE40    PPC  1DC2B680  nsTableFrame::Destroy(nsIPresContext*)+0002C
  0E56BE00    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56BDB0    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56BD60    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56BD10    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56BCC0    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56BC70    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56BC20    PPC  1DB82634  nsContainerFrame::Destroy(nsIPresContext*)+00054
  0E56BBD0    PPC  1DE48418  nsFrameList::DestroyFrames(nsIPresContext*)+00048
  0E56BB80    PPC  1DD931E8  nsBlockFrame::Destroy(nsIPresContext*)+0005C
  0E56BB40    PPC  1DDF6EE0  nsLineBox::DeleteLineList(nsIPresContext*, 
nsLineBox*)+0004C
  0E56BAF0    PPC  1DD931E8  nsBlockFrame::Destroy(nsIPresContext*)+0005C
  0E56BAB0    PPC  1DDF6EE0  nsLineBox::DeleteLineList(nsIPresContext*, 
nsLineBox*)+0004C
  0E56BA60    PPC  1DE17DE8  nsComboboxControlFrame::Destroy(nsIPresContext*)+
00144
  0E56B9F0    PPC  1DDFFFF4  nsAreaFrame::Destroy(nsIPresContext*)+00034
  0E56B9B0    PPC  1DD931E8  nsBlockFrame::Destroy(nsIPresContext*)+0005C
 Closing log

Jesse Ruderman

Updated

•

24 years ago

Whiteboard: davidr8@home.com simplifying

Jesse Ruderman

Comment 1

•

24 years ago

The dropdown list on the page causes the crash.  Even an empty 
<select></select> will crash the editor.

Keywords: crash, testcase

Summary: Editor crashes on amazon.com → <select> tag crashes editor

Whiteboard: davidr8@home.com simplifying

Jesse Ruderman

Comment 2

•

24 years ago

Attached file small html file with <select> and a few options — Details

rubydoo123

Comment 3

•

24 years ago

assigning to akkana for review

Assignee: beppe → akkana

Target Milestone: --- → M16

Eli Goldberg

Reporter

Comment 4

•

24 years ago

Wow, thanks, David!

Akkana Peck

Comment 5

•

24 years ago

The attachment crashes on linux, too, but the stack trace is different: instead
of event code, I see this:

#1  0x41029824 in nsLineBox::DeleteLineList (aPresContext=0x86b68c0, 
    aLine=0x86f97fc)
    at /builds/moz/mozilla/layout/html/base/src/nsLineBox.cpp:250
#2  0x40ff25d3 in nsBlockFrame::Destroy (this=0x8769a90, 
    aPresContext=0x86b68c0)
    at /builds/moz/mozilla/layout/html/base/src/nsBlockFrame.cpp:1177
#3  0x40fef0c3 in nsAreaFrame::Destroy (this=0x8769a90, aPresContext=0x86b68c0)
    at /builds/moz/mozilla/layout/html/base/src/nsAreaFrame.cpp:69
#4  0x41134c3d in nsComboboxControlFrame::Destroy (this=0x8769a90, 
    aPresContext=0x86b68c0)
    at /builds/moz/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp:2282
#5  0x4102983b in nsLineBox::DeleteLineList (aPresContext=0x86b68c0, 
    aLine=0x86f9860)
    at /builds/moz/mozilla/layout/html/base/src/nsLineBox.cpp:251
#6  0x40ff25d3 in nsBlockFrame::Destroy (this=0x8769a20, 
    aPresContext=0x86b68c0)
    at /builds/moz/mozilla/layout/html/base/src/nsBlockFrame.cpp:1177
#7  0x4102983b in nsLineBox::DeleteLineList (aPresContext=0x86b68c0, 
    aLine=0x8769a68)
    at /builds/moz/mozilla/layout/html/base/src/nsLineBox.cpp:251
#8  0x40ff25d3 in nsBlockFrame::Destroy (this=0x87699d4, 
    aPresContext=0x86b68c0)
    at /builds/moz/mozilla/layout/html/base/src/nsBlockFrame.cpp:1177
#9  0x40fef0c3 in nsAreaFrame::Destroy (this=0x87699d4, aPresContext=0x86b68c0)
    at /builds/moz/mozilla/layout/html/base/src/nsAreaFrame.cpp:69
#10 0x412a5e03 in nsFrameList::DestroyFrame (this=0x8768d38, 
    aPresContext=0x86b68c0, aFrame=0x87699d4)
    at /builds/moz/mozilla/layout/base/src/nsFrameList.cpp:121
#11 0x4101aa5e in CanvasFrame::RemoveFrame (this=0x8768d04, 
    aPresContext=0x86b68c0, aPresShell=@0x87589b8, aListName=0x0, 
    aOldFrame=0x87699d4)
    at /builds/moz/mozilla/layout/html/base/src/nsHTMLFrame.cpp:202
#12 0x41010279 in FrameManager::RemoveFrame (this=0x86a4db8, 
    aPresContext=0x86b68c0, aPresShell=@0x87589b8, aParentFrame=0x8768d04, 
    aListName=0x0, aOldFrame=0x87699d4)
    at /builds/moz/mozilla/layout/html/base/src/nsFrameManager.cpp:632
#13 0x4119c732 in nsCSSFrameConstructor::ReconstructDocElementHierarchy (
    this=0x86a5078, aPresContext=0x86b68c0)
    at /builds/moz/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp:7210
#14 0x412e65cd in StyleSetImpl::ReconstructDocElementHierarchy (
    this=0x86bbd00, aPresContext=0x86b68c0)
    at /builds/moz/mozilla/layout/base/src/nsStyleSet.cpp:1010
#15 0x4103e135 in PresShell::ReconstructFrames (this=0x87589b8)
    at /builds/moz/mozilla/layout/html/base/src/nsPresShell.cpp:2900
#16 0x4103e1e6 in PresShell::StyleSheetDisabledStateChanged (this=0x87589b8, 
    aDocument=0x8715e78, aStyleSheet=0x87779a8, aDisabled=0)
    at /builds/moz/mozilla/layout/html/base/src/nsPresShell.cpp:2926
#17 0x41291ebb in nsDocument::SetStyleSheetDisabledState (this=0x8715e78, 
    aSheet=0x87779a8, aDisabled=0)
    at /builds/moz/mozilla/layout/base/src/nsDocument.cpp:1470
#18 0x4199c632 in nsHTMLEditor::ApplyDocumentOrOverrideStyleSheet (
    this=0x86c76a0, aURL=@0xbfffec54, aOverride=1, aStyleSheet=0x0)
    at /builds/moz/mozilla/editor/base/nsHTMLEditor.cpp:3914
#19 0x4199bde8 in nsHTMLEditor::ApplyOverrideStyleSheet (this=0x86c76a0, 
    aURL=@0xbfffec54, aStyleSheet=0x0)
    at /builds/moz/mozilla/editor/base/nsHTMLEditor.cpp:3850
#20 0x419c75a1 in nsEditorShell::PrepareDocumentForEditing (this=0x86c42f0, 
    aLoader=0x86bf9b0, aUrl=0x87807a8)
    at /builds/moz/mozilla/editor/base/nsEditorShell.cpp:471

Something about applying the editor's style sheet, and problems with nsLineBox. 
Charley, any idea what might be going on here?

Assignee: akkana → cmanske

Kathleen :Brade

Comment 6

•

24 years ago

I had a bug for this with an even simpler testcase (empty select); that was bug 
#36916.  That bug was resolved as a duplicate of bug #37493.  Charley--if you can 
help out with the #37493 bug it might be helpful since it's currently assigned to 
Troy.


*** This bug has been marked as a duplicate of 37493 ***

Status: NEW → RESOLVED

Closed: 24 years ago

Resolution: --- → DUPLICATE

sujay

Comment 7

•

24 years ago

verified in 5/3 build.

Status: RESOLVED → VERIFIED

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Quick Search

<select> tag crashes editor

Categories

(Core :: DOM: Editor, defect, P3)

Tracking

()

People

(Reporter: elig, Assigned: cmanske)

References

(
URL
)

Details

(Keywords: crash, testcase)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Updated

Comment 1

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Attachment

General

Description

File Name

Content Type