Closed Bug 646194 Opened 15 years ago Closed 14 years ago

Firefox crashes when hitting OPTION+DELETE to beginning of textbox. [@ nsEditor::CreateTxnForDeleteCharacter ]

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla5

People

(Reporter: cameron, Assigned: ehsan.akhgari)

References

(
URL
)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Patch (v1)
5.54 KB, patch
roc
: review+
Details | Diff | Splinter Review
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0 Build Identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0 Firefox crashes when starting from the middle of a message and hitting ALT+DELETE to beginning of textbox. Appears to affect OS X only. I was not able to reproduce within my Windows XP VM. Reproducible: Always Steps to Reproduce: 1. Compose new email in Gmail. 2. Enter 'abcd efgh ijkl' as message text. 3. Position cursor after 'abcd'. 4. Hit OPTION+DELETE twice. Actual Results: Firefox crashes. Expected Results: Cursor should stop at start of textbox...and not crash. Appears to affect OS X only. I was not able to reproduce within my Windows XP VM.
Cameron: I tried reproducing this using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:2.0) Gecko/20100101 Firefox/4.0 but no luck yet. Do you have any addons installed?
I have the following installed: ElasticFox FireBug FireGestures FlashBlock HttpFox NetExport Web Developer YSlow
Reproduced (Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0). I noticed entering "asdfa" and multiple OPTION+DELETE does not cause issues, however as instructed "asdfa werwre", placing courser after 'asdfa' and two OPTION+DELETE presses does crash. http://crash-stats.mozilla.com/report/index/bp-d8673d51-dc82-4f94-8411-b29d62110330 http://crash-stats.mozilla.com/report/index/bp-108b1a6d-01c3-4dc6-8f03-84cb52110330
hmm, bug 558983 didn't fix this
Status: UNCONFIRMED → NEW
Component: General → Editor
Ever confirmed: true
Keywords: crash
Product: Firefox → Core
QA Contact: general → editor
Summary: Firefox crashes when hitting OPTION+DELETE to beginning of textbox. → Firefox crashes when hitting OPTION+DELETE to beginning of textbox. [@ nsEditor::CreateTxnForDeleteCharacter ]
Version: unspecified → Trunk
Signature nsEditor::CreateTxnForDeleteCharacter UUID d8673d51-dc82-4f94-8411-b29d62110330 Time 2011-03-30 08:09:05.278740 Uptime 189 Last Crash 289 seconds (4.8 minutes) before submission Install Age 684981 seconds (1.1 weeks) since version was first installed. Product Firefox Version 4.0 Build ID 20110318052756 Branch 2.0 OS Mac OS X OS Version 10.6.6 10J567 CPU amd64 CPU Info family 6 model 23 stepping 10 Crash Reason EXC_BAD_ACCESS / 0x0000000d Crash Address 0x0 User Comments App Notes Renderers: 0x22600,0x20400GL Context? GL Context+ GL Layers? GL Layers+ Processor Notes EMCheckCompatibility False Bugzilla - Report this Crash Crashing Thread Frame Module Signature [Expand] Source 0 XUL nsEditor::CreateTxnForDeleteCharacter editor/libeditor/base/nsEditor.cpp:4759 1 XUL nsEditor::CreateTxnForDeleteInsertionPoint editor/libeditor/base/nsEditor.cpp:4901 2 XUL nsEditor::CreateTxnForDeleteSelection editor/libeditor/base/nsEditor.cpp:4721 3 XUL nsEditor::DeleteSelectionImpl editor/libeditor/base/nsEditor.cpp:4282 4 XUL nsPlaintextEditor::DeleteSelection editor/libeditor/text/nsPlaintextEditor.cpp:788 5 XUL nsDeleteCommand::DoCommand editor/libeditor/base/nsEditorCommands.cpp:593 6 XUL nsControllerCommandTable::DoCommand embedding/components/commandhandler/src/nsControllerCommandTable.cpp:191 7 XUL nsBaseCommandController::DoCommand embedding/components/commandhandler/src/nsBaseCommandController.cpp:169 8 XUL nsXBLPrototypeHandler::DispatchXBLCommand content/xbl/src/nsXBLPrototypeHandler.cpp:496 9 XUL nsXBLPrototypeHandler::ExecuteHandler content/xbl/src/nsXBLPrototypeHandler.cpp:250 10 XUL nsXBLWindowKeyHandler::WalkHandlersAndExecute content/xbl/src/nsXBLWindowKeyHandler.cpp:575 11 XUL nsXBLWindowKeyHandler::WalkHandlersInternal content/xbl/src/nsXBLWindowKeyHandler.cpp:486 12 XUL nsXBLWindowKeyHandler::WalkHandlers content/xbl/src/nsXBLWindowKeyHandler.cpp:359 13 XUL nsXBLWindowKeyHandler::KeyPress content/xbl/src/nsXBLWindowKeyHandler.cpp:412 14 XUL nsEventListenerManager::HandleEventInternal content/events/src/nsEventListenerManager.cpp:175 15 XUL nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventListenerManager.h:146 16 XUL nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventDispatcher.cpp:395 17 XUL nsEventDispatcher::Dispatch content/events/src/nsEventDispatcher.cpp:628 18 XUL PresShell::HandleEventInternal layout/base/nsPresShell.cpp:7066 19 XUL PresShell::HandleEvent layout/base/nsPresShell.cpp:6813 20 XUL PresShell::HandleEvent layout/base/nsPresShell.cpp:6492 21 XUL nsViewManager::DispatchEvent view/src/nsViewManager.cpp:1105 22 XUL HandleEvent view/src/nsView.cpp:161 23 XUL nsChildView::DispatchEvent widget/src/cocoa/nsChildView.mm:1807 24 XUL nsChildView::DispatchWindowEvent widget/src/cocoa/nsChildView.mm:1817 25 XUL -[ChildView processKeyDownEvent:] widget/src/cocoa/nsChildView.mm:5436 26 XUL -[ChildView keyDown:] widget/src/cocoa/nsChildView.mm:5666 27 AppKit -[NSWindow sendEvent:] 28 XUL -[ToolbarWindow sendEvent:] widget/src/cocoa/nsCocoaWindow.mm:2356 29 AppKit -[NSApplication sendEvent:] 30 AppKit -[NSApplication run] 31 XUL nsAppShell::Run widget/src/cocoa/nsAppShell.mm:746 32 XUL nsAppStartup::Run toolkit/components/startup/src/nsAppStartup.cpp:220 33 XUL XRE_main toolkit/xre/nsAppRunner.cpp:3786 34 firefox-bin main browser/app/nsBrowserApp.cpp:158 35 firefox-bin firefox-bin@0x1953
I did my best to try to reproduce it, but I couldn't. Williala, comment 5 looks to be a very good STR, but where do you enter that text? Can you please provide a list of steps to reproduce this crash as detailed as possible? Thanks!
I forgot to mention that I tried both gmail and a normal textarea...
Here's a video showing the steps to reproduce and the crash. http://dl.dropbox.com/u/7726279/2011-03-31_1655.swf
Cameron: Thanks for attaching the video. The reason I could not repro was I was typing in the subject line and not the message body. (In reply to comment #10) > Here's a video showing the steps to reproduce and the crash. > > http://dl.dropbox.com/u/7726279/2011-03-31_1655.swf
Assignee: nobody → ehsan
Blocks: 558983
Keywords: regression
Attached patch Patch (v1) — — Splinter Review
Attachment #523921 - Flags: review?(roc)
http://hg.mozilla.org/projects/cedar/rev/8649c416eb53
Flags: in-testsuite+
Whiteboard: fixed-in-cedar
Target Milestone: --- → mozilla2.2
http://hg.mozilla.org/mozilla-central/rev/8649c416eb53
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-cedar
Crash Signature: [@ nsEditor::CreateTxnForDeleteCharacter ]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: