78235 - Typing over existing list items throws assertions.

Status: VERIFIED WORKSFORME

Description

[kinmoz]

Note, the following assertion is quite easy to repro in HTML Mail Compose, but 
for some reason I don't see it in composer following the steps below?

1. Start with a blank HTML MsgCompose
2. Hit the bullet list button on the toolbar.
3. Enter "asdf" in the first list item.
4. Hit Return/Enter Key.
5. Enter "asdf" in the 2nd list item.
6. Now select all of the text in both list items and type "a".

You should now have a single list item with an "a" followed by a caret. Anything 
you type after that will give you an assertion:

###!!! ASSERTION: nsRange::IsIncreasing: 'Not Reached', file y:\mozilla\content\
base\src\nsRange.cpp, line 810
###!!! Break: at file y:\mozilla\content\base\src\nsRange.cpp, line 810

I believe it's happening because we are trying to collapse the selection on a 
textnode that is no longer in the dom tree? That's my guess anyways since it's 
parent pointer in mInner is NULL.

Note that this doesn't happen if you hit backspace to erase the selection before 
you type the last "a".

Here's the stack to the assertion:



NTDLL! 77f762e8()
nsDebug::Assertion(const char * 0x01dd576c, const char * 0x100db0d0, const char 
* 0x01dd5744, int 810) line 290 + 13 bytes
nsDebug::NotReached(const char * 0x01dd576c, const char * 0x01dd5744, int 810) 
line 452 + 22 bytes
nsRange::IsIncreasing(nsIDOMNode * 0x07232be0, int 0, nsIDOMNode * 0x072528a0, 
int 4) line 810 + 21 bytes
nsRange::SetEnd(nsRange * const 0x072706a0, nsIDOMNode * 0x072528a0, int 4) line 
1224 + 49 bytes
nsRangeStore::GetRange(nsCOMPtr<nsIDOMRange> * 0x0012e534) line 638 + 42 bytes
nsSelectionState::IsCollapsed() line 124
PlaceholderTxn::Merge(PlaceholderTxn * const 0x07256dc0, nsITransaction * 
0x072707f0, int * 0x0012e5d0) line 187 + 11 bytes
nsTransactionManager::EndTransaction() line 1167 + 20 bytes
nsTransactionManager::DoTransaction(nsTransactionManager * const 0x06e7c530, 
nsITransaction * 0x072707f0) line 129 + 14 bytes
nsEditor::Do(nsEditor * const 0x06e7f860, nsITransaction * 0x072707f0) line 491 
+ 30 bytes
nsEditor::Do(nsEditor * const 0x06e7f860, nsITransaction * 0x07270860) line 477
nsEditor::InsertTextIntoTextNodeImpl(nsEditor * const 0x06e7f860, const 
nsAString & {...}, nsIDOMCharacterData * 0x0725f260, int 1) line 2398 + 16 bytes
nsEditor::InsertTextImpl(nsEditor * const 0x06e7f860, const nsAString & {...}, 
nsCOMPtr<nsIDOMNode> * 0x0012e94c, int * 0x0012e954, nsIDOMDocument * 
0x06dd8774) line 2339 + 32 bytes
nsHTMLEditRules::WillInsertText(int 2000, nsISelection * 0x06dd4290, int * 
0x0012ebc8, int * 0x0012ec08, const nsAString * 0x0012ed54, nsAString * 
0x0012eb28, int -1) line 1085 + 66 bytes
nsHTMLEditRules::WillDoAction(nsHTMLEditRules * const 0x06e7e2d4, nsISelection * 
0x06dd4290, nsRulesInfo * 0x0012ebd0, int * 0x0012ebc8, int * 0x0012ec08) line 
454 + 51 bytes
nsPlaintextEditor::InsertText(nsPlaintextEditor * const 0x06e7f8f4, const 
nsAString & {...}) line 976 + 56 bytes
nsHTMLEditorLog::InsertText(nsHTMLEditorLog * const 0x06e7f8f4, const nsAString 
& {...}) line 162 + 13 bytes
nsPlaintextEditor::TypedText(nsPlaintextEditor * const 0x06e7f860, const 
nsAString & {...}, int 0) line 541 + 26 bytes
nsHTMLEditor::TypedText(nsHTMLEditor * const 0x06e7f860, const nsAString & 
{...}, int 0) line 1175 + 17 bytes
nsHTMLEditor::HandleKeyPress(nsHTMLEditor * const 0x06e7f8f4, nsIDOMKeyEvent * 
0x07270910) line 1153 + 33 bytes
nsTextEditorKeyListener::KeyPress(nsIDOMEvent * 0x07270914) line 270 + 41 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x06e22640, nsEvent * 
0x0012f840, nsIDOMEvent * * 0x0012f568, nsIDOMEventTarget * 0x06dd879c, unsigned 
int 2, nsEventStatus * 0x0012f7ac) line 1419 + 40 bytes
nsDocument::HandleDOMEvent(nsDocument * const 0x06dd8770, nsIPresContext * 
0x06e22640, nsEvent * 0x0012f840, nsIDOMEvent * * 0x0012f568, unsigned int 2, 
nsEventStatus * 0x0012f7ac) line 2820
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x06e211b0, 
nsIPresContext * 0x06e22640, nsEvent * 0x0012f840, nsIDOMEvent * * 0x0012f568, 
unsigned int 1, nsEventStatus * 0x0012f7ac) line 1532 + 39 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f840, nsIView * 0x06e73470, 
unsigned int 1, nsEventStatus * 0x0012f7ac) line 5498 + 47 bytes
PresShell::HandleEvent(PresShell * const 0x06dd02b4, nsIView * 0x06e73470, 
nsGUIEvent * 0x0012f840, nsEventStatus * 0x0012f7ac, int 0, int & 1) line 5425 + 
25 bytes
nsView::HandleEvent(nsView * const 0x06e73470, nsGUIEvent * 0x0012f840, unsigned 
int 8, nsEventStatus * 0x0012f7ac, int 0, int & 1) line 377
nsView::HandleEvent(nsView * const 0x06e73bc0, nsGUIEvent * 0x0012f840, unsigned 
int 8, nsEventStatus * 0x0012f7ac, int 0, int & 1) line 350
nsView::HandleEvent(nsView * const 0x06dd14c0, nsGUIEvent * 0x0012f840, unsigned 
int 28, nsEventStatus * 0x0012f7ac, int 1, int & 1) line 350
nsViewManager::DispatchEvent(nsViewManager * const 0x06dd3400, nsGUIEvent * 
0x0012f840, nsEventStatus * 0x0012f7ac) line 2055
HandleEvent(nsGUIEvent * 0x0012f840) line 68
nsWindow::DispatchEvent(nsWindow * const 0x06e73a84, nsGUIEvent * 0x0012f840, 
nsEventStatus & nsEventStatus_eIgnore) line 704 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f840) line 725
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 97, unsigned int 0) 
line 2339 + 15 bytes
nsWindow::OnChar(unsigned int 97, unsigned int 0, unsigned char 0) line 2463
nsWindow::ProcessMessage(unsigned int 258, unsigned int 97, long 1966081, long * 
0x0012fc10) line 2883 + 33 bytes
nsWindow::WindowProc(HWND__ * 0x02750464, unsigned int 258, unsigned int 97, 
long 1966081) line 959 + 27 bytes


Now notice that the caret is positioned below the 2nd bullet in the list, as if 
the 2nd bullet item contained 2 blank lines. You can actually click right after 
the 2nd bullet to place the caret correctly, so my guess is that there is a <BR> 
in there somewhere.

Comment 1

[kinmoz]

Ignore the last paragraph (below the stack trace) in my previous entry. It's 
cut+paste cruft from a previous but I filed. :-)

Comment 2

[Joe Francis]

Home, home on the Range,
Where the errs, and the ass-ert-ions play.
Oh give me a home,
where the stack trace ain't gone,
and the MBTF is a day.

Comment 3

[rubydoo123]

moving to 9.2

Comment 4

[rubydoo123]

moving to 1.0

Comment 5

[Joe Francis]

097

Comment 6

[Syd Logan]

Charles says "WORKSFORME"

Comment 7

[sujay]

verified.