Closed Bug 646194 Opened 9 years ago Closed 9 years ago

Firefox crashes when hitting OPTION+DELETE to beginning of textbox. [@ nsEditor::CreateTxnForDeleteCharacter ]

Categories

(Core :: Editor, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla5

People

(Reporter: cameron, Assigned: ehsan)

References

()

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0

Firefox crashes when starting from the middle of a message and hitting ALT+DELETE to beginning of textbox.

Appears to affect OS X only. I was not able to reproduce within my Windows XP VM.

Reproducible: Always

Steps to Reproduce:
1. Compose new email in Gmail.
2. Enter 'abcd efgh ijkl' as message text.
3. Position cursor after 'abcd'.
4. Hit OPTION+DELETE twice.

Actual Results:  
Firefox crashes.

Expected Results:  
Cursor should stop at start of textbox...and not crash.

Appears to affect OS X only. I was not able to reproduce within my Windows XP VM.
Cameron: I tried reproducing this using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:2.0) Gecko/20100101 Firefox/4.0 but no luck yet. Do you have any addons installed?
I have the following installed:
ElasticFox
FireBug
FireGestures
FlashBlock
HttpFox
NetExport
Web Developer
YSlow
Reproduced (Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0).

I noticed entering "asdfa" and multiple OPTION+DELETE does not cause issues, however as instructed "asdfa werwre", placing courser after 'asdfa' and two OPTION+DELETE presses does crash.

http://crash-stats.mozilla.com/report/index/bp-d8673d51-dc82-4f94-8411-b29d62110330
http://crash-stats.mozilla.com/report/index/bp-108b1a6d-01c3-4dc6-8f03-84cb52110330
hmm, bug 558983 didn't fix this
Status: UNCONFIRMED → NEW
Component: General → Editor
Ever confirmed: true
Keywords: crash
Product: Firefox → Core
QA Contact: general → editor
Summary: Firefox crashes when hitting OPTION+DELETE to beginning of textbox. → Firefox crashes when hitting OPTION+DELETE to beginning of textbox. [@ nsEditor::CreateTxnForDeleteCharacter ]
Version: unspecified → Trunk
Signature	nsEditor::CreateTxnForDeleteCharacter
UUID	d8673d51-dc82-4f94-8411-b29d62110330
Time 	2011-03-30 08:09:05.278740
Uptime	189
Last Crash	289 seconds (4.8 minutes) before submission
Install Age	684981 seconds (1.1 weeks) since version was first installed.
Product	Firefox
Version	4.0
Build ID	20110318052756
Branch	2.0
OS	Mac OS X
OS Version	10.6.6 10J567
CPU	amd64
CPU Info	family 6 model 23 stepping 10
Crash Reason	EXC_BAD_ACCESS / 0x0000000d
Crash Address	0x0
User Comments	
App Notes 	Renderers: 0x22600,0x20400GL Context? GL Context+
GL Layers? GL Layers+
Processor Notes 	
EMCheckCompatibility	False
Bugzilla - Report this Crash

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	nsEditor::CreateTxnForDeleteCharacter 	editor/libeditor/base/nsEditor.cpp:4759
1 	XUL 	nsEditor::CreateTxnForDeleteInsertionPoint 	editor/libeditor/base/nsEditor.cpp:4901
2 	XUL 	nsEditor::CreateTxnForDeleteSelection 	editor/libeditor/base/nsEditor.cpp:4721
3 	XUL 	nsEditor::DeleteSelectionImpl 	editor/libeditor/base/nsEditor.cpp:4282
4 	XUL 	nsPlaintextEditor::DeleteSelection 	editor/libeditor/text/nsPlaintextEditor.cpp:788
5 	XUL 	nsDeleteCommand::DoCommand 	editor/libeditor/base/nsEditorCommands.cpp:593
6 	XUL 	nsControllerCommandTable::DoCommand 	embedding/components/commandhandler/src/nsControllerCommandTable.cpp:191
7 	XUL 	nsBaseCommandController::DoCommand 	embedding/components/commandhandler/src/nsBaseCommandController.cpp:169
8 	XUL 	nsXBLPrototypeHandler::DispatchXBLCommand 	content/xbl/src/nsXBLPrototypeHandler.cpp:496
9 	XUL 	nsXBLPrototypeHandler::ExecuteHandler 	content/xbl/src/nsXBLPrototypeHandler.cpp:250
10 	XUL 	nsXBLWindowKeyHandler::WalkHandlersAndExecute 	content/xbl/src/nsXBLWindowKeyHandler.cpp:575
11 	XUL 	nsXBLWindowKeyHandler::WalkHandlersInternal 	content/xbl/src/nsXBLWindowKeyHandler.cpp:486
12 	XUL 	nsXBLWindowKeyHandler::WalkHandlers 	content/xbl/src/nsXBLWindowKeyHandler.cpp:359
13 	XUL 	nsXBLWindowKeyHandler::KeyPress 	content/xbl/src/nsXBLWindowKeyHandler.cpp:412
14 	XUL 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:175
15 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventListenerManager.h:146
16 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:395
17 	XUL 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:628
18 	XUL 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:7066
19 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6813
20 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6492
21 	XUL 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1105
22 	XUL 	HandleEvent 	view/src/nsView.cpp:161
23 	XUL 	nsChildView::DispatchEvent 	widget/src/cocoa/nsChildView.mm:1807
24 	XUL 	nsChildView::DispatchWindowEvent 	widget/src/cocoa/nsChildView.mm:1817
25 	XUL 	-[ChildView processKeyDownEvent:] 	widget/src/cocoa/nsChildView.mm:5436
26 	XUL 	-[ChildView keyDown:] 	widget/src/cocoa/nsChildView.mm:5666
27 	AppKit 	-[NSWindow sendEvent:] 	
28 	XUL 	-[ToolbarWindow sendEvent:] 	widget/src/cocoa/nsCocoaWindow.mm:2356
29 	AppKit 	-[NSApplication sendEvent:] 	
30 	AppKit 	-[NSApplication run] 	
31 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:746
32 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:220
33 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3786
34 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
35 	firefox-bin 	firefox-bin@0x1953
I did my best to try to reproduce it, but I couldn't.  Williala, comment 5 looks to be a very good STR, but where do you enter that text?  Can you please provide a list of steps to reproduce this crash as detailed as possible?  Thanks!
I forgot to mention that I tried both gmail and a normal textarea...
Here's a video showing the steps to reproduce and the crash.

http://dl.dropbox.com/u/7726279/2011-03-31_1655.swf
Cameron: Thanks for attaching the video. The reason I could not repro was I was typing in the subject line and not the message body.

(In reply to comment #10)
> Here's a video showing the steps to reproduce and the crash.
> 
> http://dl.dropbox.com/u/7726279/2011-03-31_1655.swf
Assignee: nobody → ehsan
Blocks: 558983
Keywords: regression
Attached patch Patch (v1)Splinter Review
Attachment #523921 - Flags: review?(roc)
http://hg.mozilla.org/projects/cedar/rev/8649c416eb53
Flags: in-testsuite+
Whiteboard: fixed-in-cedar
Target Milestone: --- → mozilla2.2
http://hg.mozilla.org/mozilla-central/rev/8649c416eb53
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-cedar
Crash Signature: [@ nsEditor::CreateTxnForDeleteCharacter ]
You need to log in before you can comment on or make changes to this bug.