Closed Bug 646194 Opened 11 years ago Closed 11 years ago

Firefox crashes when hitting OPTION+DELETE to beginning of textbox. [@ nsEditor::CreateTxnForDeleteCharacter ]


(Core :: DOM: Editor, defect)

Not set





(Reporter: cameron, Assigned: ehsan.akhgari)




(Keywords: crash, regression)

Crash Data


(1 file)

User-Agent:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0

Firefox crashes when starting from the middle of a message and hitting ALT+DELETE to beginning of textbox.

Appears to affect OS X only. I was not able to reproduce within my Windows XP VM.

Reproducible: Always

Steps to Reproduce:
1. Compose new email in Gmail.
2. Enter 'abcd efgh ijkl' as message text.
3. Position cursor after 'abcd'.
4. Hit OPTION+DELETE twice.

Actual Results:  
Firefox crashes.

Expected Results:  
Cursor should stop at start of textbox...and not crash.

Appears to affect OS X only. I was not able to reproduce within my Windows XP VM.
Cameron: I tried reproducing this using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:2.0) Gecko/20100101 Firefox/4.0 but no luck yet. Do you have any addons installed?
I have the following installed:
Web Developer
Reproduced (Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0).

I noticed entering "asdfa" and multiple OPTION+DELETE does not cause issues, however as instructed "asdfa werwre", placing courser after 'asdfa' and two OPTION+DELETE presses does crash.
hmm, bug 558983 didn't fix this
Component: General → Editor
Ever confirmed: true
Keywords: crash
Product: Firefox → Core
QA Contact: general → editor
Summary: Firefox crashes when hitting OPTION+DELETE to beginning of textbox. → Firefox crashes when hitting OPTION+DELETE to beginning of textbox. [@ nsEditor::CreateTxnForDeleteCharacter ]
Version: unspecified → Trunk
Signature	nsEditor::CreateTxnForDeleteCharacter
UUID	d8673d51-dc82-4f94-8411-b29d62110330
Time 	2011-03-30 08:09:05.278740
Uptime	189
Last Crash	289 seconds (4.8 minutes) before submission
Install Age	684981 seconds (1.1 weeks) since version was first installed.
Product	Firefox
Version	4.0
Build ID	20110318052756
Branch	2.0
OS Version	10.6.6 10J567
CPU	amd64
CPU Info	family 6 model 23 stepping 10
Crash Reason	EXC_BAD_ACCESS / 0x0000000d
Crash Address	0x0
User Comments	
App Notes 	Renderers: 0x22600,0x20400GL Context? GL Context+
GL Layers? GL Layers+
Processor Notes 	
EMCheckCompatibility	False
Bugzilla - Report this Crash

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	nsEditor::CreateTxnForDeleteCharacter 	editor/libeditor/base/nsEditor.cpp:4759
1 	XUL 	nsEditor::CreateTxnForDeleteInsertionPoint 	editor/libeditor/base/nsEditor.cpp:4901
2 	XUL 	nsEditor::CreateTxnForDeleteSelection 	editor/libeditor/base/nsEditor.cpp:4721
3 	XUL 	nsEditor::DeleteSelectionImpl 	editor/libeditor/base/nsEditor.cpp:4282
4 	XUL 	nsPlaintextEditor::DeleteSelection 	editor/libeditor/text/nsPlaintextEditor.cpp:788
5 	XUL 	nsDeleteCommand::DoCommand 	editor/libeditor/base/nsEditorCommands.cpp:593
6 	XUL 	nsControllerCommandTable::DoCommand 	embedding/components/commandhandler/src/nsControllerCommandTable.cpp:191
7 	XUL 	nsBaseCommandController::DoCommand 	embedding/components/commandhandler/src/nsBaseCommandController.cpp:169
8 	XUL 	nsXBLPrototypeHandler::DispatchXBLCommand 	content/xbl/src/nsXBLPrototypeHandler.cpp:496
9 	XUL 	nsXBLPrototypeHandler::ExecuteHandler 	content/xbl/src/nsXBLPrototypeHandler.cpp:250
10 	XUL 	nsXBLWindowKeyHandler::WalkHandlersAndExecute 	content/xbl/src/nsXBLWindowKeyHandler.cpp:575
11 	XUL 	nsXBLWindowKeyHandler::WalkHandlersInternal 	content/xbl/src/nsXBLWindowKeyHandler.cpp:486
12 	XUL 	nsXBLWindowKeyHandler::WalkHandlers 	content/xbl/src/nsXBLWindowKeyHandler.cpp:359
13 	XUL 	nsXBLWindowKeyHandler::KeyPress 	content/xbl/src/nsXBLWindowKeyHandler.cpp:412
14 	XUL 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:175
15 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventListenerManager.h:146
16 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:395
17 	XUL 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:628
18 	XUL 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:7066
19 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6813
20 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6492
21 	XUL 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1105
22 	XUL 	HandleEvent 	view/src/nsView.cpp:161
23 	XUL 	nsChildView::DispatchEvent 	widget/src/cocoa/
24 	XUL 	nsChildView::DispatchWindowEvent 	widget/src/cocoa/
25 	XUL 	-[ChildView processKeyDownEvent:] 	widget/src/cocoa/
26 	XUL 	-[ChildView keyDown:] 	widget/src/cocoa/
27 	AppKit 	-[NSWindow sendEvent:] 	
28 	XUL 	-[ToolbarWindow sendEvent:] 	widget/src/cocoa/
29 	AppKit 	-[NSApplication sendEvent:] 	
30 	AppKit 	-[NSApplication run] 	
31 	XUL 	nsAppShell::Run 	widget/src/cocoa/
32 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:220
33 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3786
34 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
35 	firefox-bin 	firefox-bin@0x1953
I did my best to try to reproduce it, but I couldn't.  Williala, comment 5 looks to be a very good STR, but where do you enter that text?  Can you please provide a list of steps to reproduce this crash as detailed as possible?  Thanks!
I forgot to mention that I tried both gmail and a normal textarea...
Here's a video showing the steps to reproduce and the crash.
Cameron: Thanks for attaching the video. The reason I could not repro was I was typing in the subject line and not the message body.

(In reply to comment #10)
> Here's a video showing the steps to reproduce and the crash.
Assignee: nobody → ehsan
Blocks: 558983
Keywords: regression
Attached patch Patch (v1)Splinter Review
Attachment #523921 - Flags: review?(roc)
Flags: in-testsuite+
Whiteboard: fixed-in-cedar
Target Milestone: --- → mozilla2.2
Closed: 11 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-cedar
Crash Signature: [@ nsEditor::CreateTxnForDeleteCharacter ]
You need to log in before you can comment on or make changes to this bug.