57934 - Crash when replying to a message with this attachment

Status: VERIFIED WORKSFORME

(SeaMonkey :: MailNews: Message Display, defect, P1)

Description

[msanz]

Using Win NT, 20001024 branch  build
I received a mail with an html attachment that I will include in this report,
and I crash every time I try to reply to it. I've tried with other html files
and it works correctly, but there is something with this one that makes N6 crash.

Comment 1

[msanz]

Attachment: HTL file

Comment 2

[msanz]

adding crash keyword

Comment 3

[scottputterman]

reassigning to ducarroz. msanz, do you have a stack trace?

Comment 4

[msanz]

This is the URL to the stack trace
http://cyclone/reports/incidenttemplate.CFM?reportID=1152&style=0&tc=13&cp=3&bbid=19746200

Comment 5

[Jean-Francois Ducarroz]

looks like an Editor problem. It crash while calling InsertAsCitation! Reassign.

Comment 6

[msanz]

I think I've found a bug that this is dup of: 57571. If so, please mark dup. The
file attached is the same that I used

Comment 7

[Jean-Francois Ducarroz]

Occurs apparently on Linux too.

Comment 8

[Jean-Francois Ducarroz]

*** Bug 58739 has been marked as a duplicate of this bug. ***

Comment 9

[philippe tapon]

confirms that it happens on linux (M18) using a .txt file as attachment

Comment 10

[kinmoz]

With my 12/14/00 Linux and Win32 debug Trunk builds, I no longer crash, but what
I do see is several assertions thrown from nsBlockFrame::DoRemoveFrame() before
it goes into an inifinite loop.

The first assertion that is being triggered is:

    NS_ASSERTION(nsnull != line, "can't find deleted frame in lines");

and the var aDeletedFrame is pointing to is an nsTableOuterFrame.

I will attatch the minimal test case and the stack trace to the assertion that
happens just before the infinite loop.

Reassigning to [e-mail] and Cc'ing [e-mail].

Comment 11

[kinmoz]

Attachment: Stack trace to assertion in nsBlockFrame::DoRemoveFrame() just before infinite loop.

Comment 12

[kinmoz]

Attachment: Minimal HTML testcase to reproduce assertions and infinite loop.

Comment 13

[kinmoz]

Attachment: The real HTML minimal test case!

Comment 14

[buster]

moving to mozilla0.9

Comment 15

[buster]

moving to mozilla0.9, accepting

Comment 16

[buster]

This is a table frame construction problem.  The form frame thinks it's child
frame is the table outer frame.  I can't explain why this is true for building
the document via mail reply, and not true via normal browser load.

Assigning to karnaze.  If someone could find an easier way to reproduce, that
would be helpful. I'll run a few more tests.

The construct that causes us problems is
<table>
<form>
<tr>

Comment 17

[buster]

assigning to chris.  there's nothing I can do  in the layout code
other than the assertion that's already in place to protect against a broken
frame model.  Chris knows a lot more about the table frame construction code
than I do.

Comment 18

[buster]

more data:  this does *not* happen if you simply edit the document.  it's only
the mail-reply.  I tested this by loading the document into the browser and then
doing "edit page"

Comment 19

[fenella]

Assign it to myself.

Comment 20

[karnaze (gone)]

Moving to Mozilla0.9

Comment 21

[fenella]

To Esther..

Comment 22

[karnaze (gone)]

I can't reproduce the bug anymore. I saved attachment #4 [details] [diff] [review] to a file, sent it to 
myself as an attachment, and then replied to it. Marking worksforme.

Comment 23

[esther]

verified as workforme.