72968 - browser crashes when doing REDO after doing some cut/paste in tables

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P1)

Description

[shrirang khanzode]

Found this bug since I always do some web page publishing using 'a similar 
scenario'. I start with a html file created in 4.x and then edit it in 6.x 
composer.

Steps:
1 Open the attached html file in 4.x composer (created in 4.x composer, it's a 
3x2 table with some text in the first two rows and the third row blank and 
center aligned)
2 Now, open 6.x composer and open the same file simultaneously
3 From the 4.x composer, select the text from any row and copy it in the   
clipboard (CTRL +C)
4 Go to the 6.x composer and click in the 3rd (blank) row's first cell and hit 
CTRL+V 
5 Observe that the table cells also get copied along with the text(guess this is   
a seperate bug already filed)
6 Now, go to Edit menu and do UNDO
7 Observe that the table loses it's border and the cell shrink (some weird 
  behaviour)
8 Doing REDO from the edit menu after this crashes the browser.

will attach stack trace...

Comment 1

[shrirang khanzode]

Attachment: testcase

Comment 2

[shrirang khanzode]

talkback's not working right now..will post trace once i get it...

Comment 3

[rubydoo123]

confirmed this crash, a talkback report was generated but talkback is down at 
the moment, asking kin to take a look at the talkback report once it gets added 
and get this off to the correct person

Comment 4

[rubydoo123]

Attachment: stacktrace for this bug, doesn't look like editor code in the stacktrace

Comment 5

[kinmoz]

Attachment: Simple test case.

Comment 6

[kinmoz]

Attachment: Stack trace for simple test case.

Comment 7

[kinmoz]

I just attatched a simple test case (04/09/01 14:17) and the stack trace 
(04/09/01 14:18) that was generated when using that simple test case.

You can reproduce the crash with the following steps:

1. Load the simple test case (04/09/01 14:17 attatchment) into composer.
2. Select the word "test" and hit CTRL-c to copy it.
3. Click in the blank cell in the 2nd row, and type CTRL-v to paste.
   Notice the various tables that get inserted.
4. Type CTRL-z to undo.
5. Type CTRL-y to redo.

You should now crash because nsCellMap::ExpandWithCells() is calling 
InsertElementAt() through a null row pointer.

It looks like on paste nsHTMLEditor::SplitStyleAbovePoint() is causing 2 extra 
tables to be inserted into the content tree. When we undo, we remove those extra 
tables, plus the last row in the original table.

Comment 8

[Joe Francis]

fix in hand

Comment 9

[Joe Francis]

fix checked in

Comment 10

[shrirang khanzode]

this thing DOES behave now..thanks.marking verif used 0618trunk to verify.