Crash when removing or setting attribute on <body> tag for MS home page




18 years ago
17 years ago


(Reporter: harishd, Assigned: Charles Manske)




Firefox Tracking Flags

(Not tracked)





18 years ago
Steps to reproduce:

1) Open up the above URL in the browser
2) Do File->Edit Page ( to open up composer )
3) In composer enable "Edit mode toolbar"
4) Select <HTML>Source
5) Scroll a little
6) Choose "Normal" ( in the toolbar )

Actual Result: Crash!!!!

Comment 1

18 years ago
Btw, tested with 10/23/00 branch build.
Keywords: crash

Comment 2

18 years ago
I see this too (changing platform/OS to All). Here's the stack gdb gives me:

#0  0x40136a02 in nsQueryInterface::operator() (this=0xbfffc474,
aIID=@0x41c17f90, answer=0xbfffc3e4) at nsCOMPtr.cpp:32
#1  0x41afccfc in nsCOMPtr<nsIBox>::assign_from_helper (this=0xbfffc480,
helper=@0xbfffc474, aIID=@0x41c17f90) at ../../../dist/include/nsCOMPtr.h:856
#2  0x41afce45 in nsCOMPtr<nsIBox>::nsCOMPtr (this=0xbfffc480,
helper=@0xbfffc474) at ../../../dist/include/nsCOMPtr.h:564
#3  0x418f1815 in nsCSSFrameConstructor::StyleChangeReflow (this=0x86fb4e0,
aPresContext=0x8aff370, aFrame=0x8aaec48, aAttribute=0x0) at
#4  0x418f1e38 in nsCSSFrameConstructor::ProcessRestyledFrames (this=0x86fb4e0,
aChangeList=@0xbfffc574, aPresContext=0x8aff370) at nsCSSFrameConstructor.cpp:9762
#5  0x418f2f6c in nsCSSFrameConstructor::AttributeChanged (this=0x86fb4e0,
aPresContext=0x8aff370, aContent=0x89556a8, aNameSpaceID=0,
aAttribute=0x81b9940, aHint=2) at nsCSSFrameConstructor.cpp:10076
#6  0x41a7a861 in StyleSetImpl::AttributeChanged (this=0x8c1d940,
aPresContext=0x8aff370, aContent=0x89556a8, aNameSpaceID=0,
aAttribute=0x81b9940, aHint=-1) at nsStyleSet.cpp:1194
#7  0x4176b005 in PresShell::AttributeChanged (this=0x8c2e690,
aDocument=0x8bb5cb8, aContent=0x89556a8, aNameSpaceID=0, aAttribute=0x81b9940,
aHint=-1) at nsPresShell.cpp:4294
#8  0x41a109a7 in nsDocument::AttributeChanged (this=0x8bb5cb8,
aChild=0x89556a8, aNameSpaceID=0, aAttribute=0x81b9940, aHint=-1) at
#9  0x4179003d in nsGenericHTMLElement::UnsetAttribute (this=0x89556b4,
aNameSpaceID=0, aAttribute=0x81b9940, aNotify=1) at nsGenericHTMLElement.cpp:1504
#10 0x417ac3ee in nsHTMLBodyElement::UnsetAttribute (this=0x89556a0,
aNameSpaceID=0, aAttribute=0x81b9940, aNotify=1) at nsHTMLBodyElement.cpp:197
#11 0x41a3c213 in nsGenericElement::RemoveAttribute (this=0x89556b4,
aName=@0x8e00a6c) at nsGenericElement.cpp:754
#12 0x417ad16a in nsHTMLBodyElement::RemoveAttribute (this=0x89556a0,
aName=@0x8e00a6c) at nsHTMLBodyElement.cpp:185
#13 0x421b6439 in ChangeAttributeTxn::Do (this=0x8e00a38) at
#14 0x42250d68 in nsTransactionItem::Do (this=0x8e00ad8) at
#15 0x42253458 in nsTransactionManager::BeginTransaction (this=0x8c78ca8,
aTransaction=0x8e00a38) at nsTransactionManager.cpp:1033
#16 0x422519b1 in nsTransactionManager::Do (this=0x8c78ca8,
aTransaction=0x8e00a38) at nsTransactionManager.cpp:121
#17 0x4212c0ec in nsEditor::Do (this=0x8cc5010, aTxn=0x8e00a38) at nsEditor.cpp:1157
#18 0x4212e666 in nsEditor::RemoveAttribute (this=0x8cc5010, aElement=0x89556a0,
aAttribute=@0xbfffca80) at nsEditor.cpp:1668
#19 0x42132826 in nsEditor::CloneAttributes (this=0x8cc5010,
aDestNode=0x89556a0, aSourceNode=0x86e5a98) at nsEditor.cpp:2785
#20 0x42198494 in nsHTMLEditor::RebuildDocumentFromSource (this=0x8cc5010,
aSourceString=@0xbfffd0d8) at nsHTMLEditor.cpp:3146
[ ... ]
OS: Windows NT → All
Hardware: PC → All

Comment 3

18 years ago
I'm using build MN6 dated 20001023 on win95 and it works fine, no crash
whatsoever. I did notice in the source of the page that they have a close
</basefont> element -- which is really weird considering that is an empty
element. However, there was no crashing toggling back and forth and I edited the
file in all 3 modes to see if maybe that would cause the crash

Comment 4

18 years ago
asking Sujay if he can try this on mac and linux to see if he sees anything.

Comment 5

18 years ago
I can reproduce this problem on all 3 platforms(Windows, Mac and Linux).

Using 10/25 build.

Comment 6

18 years ago
assigning to brade for debugging
Target Milestone: --- → M19

Comment 7

18 years ago
reassign to charley since I'll be going on leave soon
Assignee: beppe → cmanske
Target Milestone: M19 → mozilla0.9

Comment 8

18 years ago
It's not to surprising we have trouble with Microsoft's home page (why would you
want too?)
We crash when simply trying to copy attributes from the <body> tag in HTML source
mode to the new DOM tree's body node.
Needs more investigation

Comment 9

18 years ago
I tried not removing attributes that were only having their value copied from
another element, but we still get the crash, which is because a null frame is
being accessessed (it was deleted?)
Summary: Crash on selecting "Normal" mode → Crash when removing or setting attribute on <body> tag for MS home page

Comment 10

17 years ago
I don't see this problem anymore.
When switching to HTML Source and back to Normal, I get lots of assertions, but
no fatal crashes.
Sujay: Please test this again on all platforms.

Comment 11

17 years ago
Harish, is this still a problem for you? try out in recent build...thanks!
I will also test on another platform.

Comment 12

17 years ago
Sujay: What is the result of your testing?

Comment 13

17 years ago
I don't see the crash either. 

Comment 14

17 years ago
No other response that this still exists, so bye!
Last Resolved: 17 years ago
Resolution: --- → WORKSFORME

Comment 15

17 years ago
verified in 3/21 build.
You need to log in before you can comment on or make changes to this bug.