646194 - Firefox crashes when hitting OPTION+DELETE to beginning of textbox. [@ nsEditor::CreateTxnForDeleteCharacter ]

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[[e-mail]]

User-Agent:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0

Firefox crashes when starting from the middle of a message and hitting ALT+DELETE to beginning of textbox.

Appears to affect OS X only. I was not able to reproduce within my Windows XP VM.

Reproducible: Always

Steps to Reproduce:
1. Compose new email in Gmail.
2. Enter 'abcd efgh ijkl' as message text.
3. Position cursor after 'abcd'.
4. Hit OPTION+DELETE twice.

Actual Results:  
Firefox crashes.

Expected Results:  
Cursor should stop at start of textbox...and not crash.

Appears to affect OS X only. I was not able to reproduce within my Windows XP VM.

Comment 1

[Marcia Knous [:marcia]]

Cameron: I tried reproducing this using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:2.0) Gecko/20100101 Firefox/4.0 but no luck yet. Do you have any addons installed?

Comment 2

[[e-mail]]

I have the following installed:
ElasticFox
FireBug
FireGestures
FlashBlock
HttpFox
NetExport
Web Developer
YSlow

Comment 3

[Matthias Versen [:Matti]]

Please provide a crash ID from about:;crashes
https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Comment 4

[[e-mail]]

Here are a few:
 bp-3af4c930-5059-465b-b65a-a1ae52110329
 bp-8f653e4d-8462-4599-ad89-189562110329
 bp-dfd26d94-a7e0-43ee-9430-3a5042110329
 bp-48eb4e6c-3e8b-4e8c-83ea-4b0152110329

Comment 5

[williala]

Reproduced (Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0).

I noticed entering "asdfa" and multiple OPTION+DELETE does not cause issues, however as instructed "asdfa werwre", placing courser after 'asdfa' and two OPTION+DELETE presses does crash.

http://crash-stats.mozilla.com/report/index/bp-d8673d51-dc82-4f94-8411-b29d62110330
http://crash-stats.mozilla.com/report/index/bp-108b1a6d-01c3-4dc6-8f03-84cb52110330

Comment 6

[Matthias Versen [:Matti]]

hmm, bug 558983 didn't fix this

Comment 7

[timeless]

Signature	nsEditor::CreateTxnForDeleteCharacter
UUID	d8673d51-dc82-4f94-8411-b29d62110330
Time 	2011-03-30 08:09:05.278740
Uptime	189
Last Crash	289 seconds (4.8 minutes) before submission
Install Age	684981 seconds (1.1 weeks) since version was first installed.
Product	Firefox
Version	4.0
Build ID	20110318052756
Branch	2.0
OS	Mac OS X
OS Version	10.6.6 10J567
CPU	amd64
CPU Info	family 6 model 23 stepping 10
Crash Reason	EXC_BAD_ACCESS / 0x0000000d
Crash Address	0x0
User Comments	
App Notes 	Renderers: 0x22600,0x20400GL Context? GL Context+
GL Layers? GL Layers+
Processor Notes 	
EMCheckCompatibility	False
Bugzilla - Report this Crash

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	nsEditor::CreateTxnForDeleteCharacter 	editor/libeditor/base/nsEditor.cpp:4759
1 	XUL 	nsEditor::CreateTxnForDeleteInsertionPoint 	editor/libeditor/base/nsEditor.cpp:4901
2 	XUL 	nsEditor::CreateTxnForDeleteSelection 	editor/libeditor/base/nsEditor.cpp:4721
3 	XUL 	nsEditor::DeleteSelectionImpl 	editor/libeditor/base/nsEditor.cpp:4282
4 	XUL 	nsPlaintextEditor::DeleteSelection 	editor/libeditor/text/nsPlaintextEditor.cpp:788
5 	XUL 	nsDeleteCommand::DoCommand 	editor/libeditor/base/nsEditorCommands.cpp:593
6 	XUL 	nsControllerCommandTable::DoCommand 	embedding/components/commandhandler/src/nsControllerCommandTable.cpp:191
7 	XUL 	nsBaseCommandController::DoCommand 	embedding/components/commandhandler/src/nsBaseCommandController.cpp:169
8 	XUL 	nsXBLPrototypeHandler::DispatchXBLCommand 	content/xbl/src/nsXBLPrototypeHandler.cpp:496
9 	XUL 	nsXBLPrototypeHandler::ExecuteHandler 	content/xbl/src/nsXBLPrototypeHandler.cpp:250
10 	XUL 	nsXBLWindowKeyHandler::WalkHandlersAndExecute 	content/xbl/src/nsXBLWindowKeyHandler.cpp:575
11 	XUL 	nsXBLWindowKeyHandler::WalkHandlersInternal 	content/xbl/src/nsXBLWindowKeyHandler.cpp:486
12 	XUL 	nsXBLWindowKeyHandler::WalkHandlers 	content/xbl/src/nsXBLWindowKeyHandler.cpp:359
13 	XUL 	nsXBLWindowKeyHandler::KeyPress 	content/xbl/src/nsXBLWindowKeyHandler.cpp:412
14 	XUL 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:175
15 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventListenerManager.h:146
16 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:395
17 	XUL 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:628
18 	XUL 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:7066
19 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6813
20 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6492
21 	XUL 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1105
22 	XUL 	HandleEvent 	view/src/nsView.cpp:161
23 	XUL 	nsChildView::DispatchEvent 	widget/src/cocoa/nsChildView.mm:1807
24 	XUL 	nsChildView::DispatchWindowEvent 	widget/src/cocoa/nsChildView.mm:1817
25 	XUL 	-[ChildView processKeyDownEvent:] 	widget/src/cocoa/nsChildView.mm:5436
26 	XUL 	-[ChildView keyDown:] 	widget/src/cocoa/nsChildView.mm:5666
27 	AppKit 	-[NSWindow sendEvent:] 	
28 	XUL 	-[ToolbarWindow sendEvent:] 	widget/src/cocoa/nsCocoaWindow.mm:2356
29 	AppKit 	-[NSApplication sendEvent:] 	
30 	AppKit 	-[NSApplication run] 	
31 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:746
32 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:220
33 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3786
34 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
35 	firefox-bin 	firefox-bin@0x1953

Comment 8

[(no longer active)]

I did my best to try to reproduce it, but I couldn't.  Williala, comment 5 looks to be a very good STR, but where do you enter that text?  Can you please provide a list of steps to reproduce this crash as detailed as possible?  Thanks!

Comment 9

[(no longer active)]

I forgot to mention that I tried both gmail and a normal textarea...

Comment 10

[[e-mail]]

Here's a video showing the steps to reproduce and the crash.

http://dl.dropbox.com/u/7726279/2011-03-31_1655.swf

Comment 11

[Marcia Knous [:marcia]]

Cameron: Thanks for attaching the video. The reason I could not repro was I was typing in the subject line and not the message body.

(In reply to comment #10)
> Here's a video showing the steps to reproduce and the crash.
> 
> http://dl.dropbox.com/u/7726279/2011-03-31_1655.swf

Comment 12

[(no longer active)]

Attachment: Patch (v1)

Comment 13

[(no longer active)]

http://hg.mozilla.org/projects/cedar/rev/8649c416eb53

Comment 14

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/8649c416eb53