61111 - Blockquoted table hangs Composer depending on cursor movement

Status: VERIFIED DUPLICATE of bug 59577

(Core :: DOM: Editor, defect, P1)

Description

[Robin Whittle]

From Bugzilla Helper:
User-Agent: Mozilla/4.7 [en] (Win98; I)
BuildID:    2000112220

The file at the URL is self explanatory.  It is a very simple file starting with 
a blockquote and a single cell table with a single word of text.

  

Reproducible: Always
Steps to Reproduce:
From the start, two arrow movements down will cause Composer to lock up.  

Alternatively, from  the start, one down arrow, one up and one down, and then it 
is possible to use cursor keys move through the table to the un-blockquoted text 
below.   But try to use the up arrow from that text into the blockquoted table 
area and the program hangs.


Actual Results:  The program has the behaviorual characteristics of a 
stunned-mullet (Win98) but on Linux it is still possible to place the cursor 
with the mouse/trackball and pull down the menus,  but the menu items don't do 
anything.  In Linux other Mozilla windows seemed to operate fine but with Win98 
every Mozill window was dead and would not redraw when Alt-Tabbed to.

Expected Results:  Moved the cursor through the table without drama

There was no Talkback messages.  I had to terminate Mozilla.

Comment 1

[rubydoo123]

assigning to kin for debugging -- this hangs in win95 too. Nothing comes across 
the console either.

Comment 2

[rubydoo123]

really assign to kin

Comment 3

[kinmoz]

We are going into an infinite loop in nsFrame::PeekOffset(). 
[e-mail] owns selection now, Cc'ing [e-mail] since he 
originally wrote this code.

Here's the stack trace to the infinite do loop:

nsFrame::PeekOffset(nsFrame * const 0x01022118, nsIPresContext * 0x05bb4990, 
nsPeekOffsetStruct * 0x0012d2f4) line 3178
nsTextFrame::PeekOffset(nsTextFrame * const 0x01022118, nsIPresContext * 
0x05bb4990, nsPeekOffsetStruct * 0x0012d2f4) line 3178 + 17 bytes
nsSelection::MoveCaret(unsigned int 40, int 0, nsSelectionAmount eSelectLine) 
line 1480 + 41 bytes
nsSelection::LineMove(nsSelection * const 0x05b88a70, int 1, int 0) line 2071 + 
16 bytes
PresShell::LineMove(PresShell * const 0x05b89780, int 1, int 0) line 2633
nsSelectionMoveCommands::DoCommand(nsSelectionMoveCommands * const 0x042854f0, 
const unsigned short * 0x0012d868, nsISupports * 0x042cdb30) line 307 + 39 bytes
nsControllerCommandManager::DoCommand(nsControllerCommandManager * const 
0x04284300, const unsigned short * 0x0012d868, nsISupports * 0x042cdb30) line 
189 + 31 bytes
nsEditorController::DoCommand(nsEditorController * const 0x05bfb9b0, const 
unsigned short * 0x0012d868) line 201
nsXBLPrototypeHandler::ExecuteHandler(nsXBLPrototypeHandler * const 0x05c3f3d0, 
nsIDOMEventReceiver * 0x04daed50, nsIDOMEvent * 0x05b4ae80) line 257
nsXBLWindowKeyHandler::WalkHandlersInternal(nsXBLWindowKeyHandler * const 
0x04e0c480, nsIDOMKeyEvent * 0x05b4ae80, nsIAtom * 0x024ec120, 
nsIXBLPrototypeHandler * 0x05c3f740) line 256 + 48 bytes
nsXBLWindowKeyHandler::WalkHandlers(nsXBLWindowKeyHandler * const 0x04e0c480, 
nsIDOMEvent * 0x05b4ae84, nsIAtom * 0x024ec120) line 295
nsXBLWindowKeyHandler::KeyPress(nsIDOMEvent * 0x05b4ae84) line 311
nsEventListenerManager::HandleEvent(nsIPresContext * 0x05bb4990, nsEvent * 
0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, nsIDOMEventTarget * 0x04daed50, unsigned 
int 2, nsEventStatus * 0x0012f828) line 1173 + 23 bytes
nsWindowRoot::HandleChromeEvent(nsWindowRoot * const 0x04daed54, nsIPresContext 
* 0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 187
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x04daea20, 
nsIPresContext * 0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, 
unsigned int 2, nsEventStatus * 0x0012f828) line 581
nsXULDocument::HandleDOMEvent(nsXULDocument * const 0x04e0e230, nsIPresContext * 
0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 2011
nsXULElement::HandleDOMEvent(nsXULElement * const 0x04e3c140, nsIPresContext * 
0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 3499 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x054d2aa0, nsIPresContext * 
0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 3493 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x054d27e0, nsIPresContext * 
0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 3493 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x054d26d0, nsIPresContext * 
0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 3493 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x054d2310, nsIPresContext * 
0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 3493 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x054d2200, nsIPresContext * 
0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 3493 + 39 bytes
nsXULElement::HandleChromeEvent(nsXULElement * const 0x054d2214, nsIPresContext 
* 0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 4442 + 39 bytes
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x05b81d60, 
nsIPresContext * 0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, 
unsigned int 2, nsEventStatus * 0x0012f828) line 581
nsDocument::HandleDOMEvent(nsDocument * const 0x05c231f0, nsIPresContext * 
0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 2, 
nsEventStatus * 0x0012f828) line 3041
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x05bb4990, nsEvent * 
0x0012f8bc, nsIDOMEvent * * 0x0012f5d8, unsigned int 1, nsEventStatus * 
0x0012f828) line 1441 + 45 bytes
nsHTMLHtmlElement::HandleDOMEvent(nsHTMLHtmlElement * const 0x05c25cb8, 
nsIPresContext * 0x05bb4990, nsEvent * 0x0012f8bc, nsIDOMEvent * * 0x00000000, 
unsigned int 1, nsEventStatus * 0x0012f828) line 186
PresShell::HandleEventInternal(nsEvent * 0x0012f8bc, nsIView * 0x05c05b20, 
unsigned int 1, nsEventStatus * 0x0012f828) line 4876 + 47 bytes
PresShell::HandleEvent(PresShell * const 0x05b89774, nsIView * 0x05c05b20, 
nsGUIEvent * 0x0012f8bc, nsEventStatus * 0x0012f828, int 0, int & 1) line 4811 + 
25 bytes
nsView::HandleEvent(nsView * const 0x05c05b20, nsGUIEvent * 0x0012f8bc, unsigned 
int 8, nsEventStatus * 0x0012f828, int 0, int & 1) line 379
nsView::HandleEvent(nsView * const 0x05c03050, nsGUIEvent * 0x0012f8bc, unsigned 
int 8, nsEventStatus * 0x0012f828, int 0, int & 1) line 352
nsView::HandleEvent(nsView * const 0x05b80240, nsGUIEvent * 0x0012f8bc, unsigned 
int 28, nsEventStatus * 0x0012f828, int 1, int & 1) line 352
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x05b81f30, nsGUIEvent * 
0x0012f8bc, nsEventStatus * 0x0012f828) line 1439
HandleEvent(nsGUIEvent * 0x0012f8bc) line 68
nsWindow::DispatchEvent(nsWindow * const 0x05b80104, nsGUIEvent * 0x0012f8bc, 
nsEventStatus & nsEventStatus_eIgnore) line 686 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f8bc) line 707
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 40) 
line 2297 + 15 bytes
nsWindow::OnKeyDown(unsigned int 40, unsigned int 336) line 2364
nsWindow::ProcessMessage(unsigned int 256, unsigned int 40, long 22020097, long 
* 0x0012fc44) line 2926 + 32 bytes
nsWindow::WindowProc(HWND__ * 0x086d0524, unsigned int 256, unsigned int 40, 
long 22020097) line 962 + 27 bytes
USER32! 77e7124c()

Comment 4

[anthonyd]

*** This bug has been marked as a duplicate of 59577 ***

Comment 5

[sujay]

verified in 1/12 build.