83448 - Crash when deleting text in URL bar and other input fields

Status: VERIFIED FIXED

(SeaMonkey :: Location Bar, defect, P1)

Description

[Simon Montagu :smontagu]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:0.9+) Gecko/20010513
BuildID:    

When deleting text in the URL bar, in optimized builds only, Mozilla crashes
with the message "The memory could not be read".

Reproducible: Sometimes
Steps to Reproduce:
1.Open Mozilla
2.If set to open a blank page, enter one or two characters in the URL bar;
otherwise just click anywhere in the displayed URL
3.Hit backspace


Actual Results:  Browser crashes

Expected Results:  Browser should not crash

MSVC debugger reports: Access violation in EDITOR.DLL

This appears to be caused by the calls to GetBidiProperty in nsTextEditRulesBIDI.cpp

Comment 1

[Simon Montagu :smontagu]

Attachment: suggested patch

Comment 2

[Alec Flett]

reassign to kin
I have no idea how this bidi stuff works, or why this patch works :)

Comment 3

[kinmoz]

Moving to mozilla.0.9.2 for now, though we may want to try and get this into 
0.9.1.

I was a little puzzled as to why we compiled with a missing arg to 
GetBidiProperty() and then I noticed that the prototoype for GetBidiProperty() 
in nsIFrame.h had a default initializer ... methods in XPCOM interfaces 
shouldn't have default initializers!

I'd like to request that the GetBidiProperty() declaration in nsIFrame.h:


  NS_IMETHOD GetBidiProperty(nsIPresContext* aPresContext,
                             nsIAtom*        aPropertyName,
                             void**          aPropertyValue,
                             long            aSize = sizeof(void*) ) const = 0;


be changed to:


  NS_IMETHOD GetBidiProperty(nsIPresContext* aPresContext,
                             nsIAtom*        aPropertyName,
                             void**          aPropertyValue,
                             long            aSize) const = 0;


This will force us to provide the aSize arg for all calls, but it will also 
force us to take a look at each call with the missing arg, and find any other 
potential problems.

Other than that, you have my sr=[e-mail] on the 05/31/01 04:22 editor 
patch.

So who's supposed to check this patch in? Whoever it is, should take this off my 
plate. :-)

Comment 4

[Simon Montagu :smontagu]

This is a crasher! Surely it has to get into 0.9.1 ? I suggest the fix for the
crash should be checked in and the default initializer issue be fissioned.

Comment 5

[Simon Montagu :smontagu]

*** Bug 83694 has been marked as a duplicate of this bug. ***

Comment 6

[Asa Dotzler [:asa]]

returning to 0.9.2 Target Milestone.  Simon, Target Milestone is owned by the
developer. Please do not change that field in bug reports.  Thanks.  If you want
to nominate a bug for a particular milestone then use the keyword.

Comment 7

[Katsuhiko Momoi]

Simon, do you have a Russian keyboard?
If so, can you test this crash problem in the Subject header
of a Mail composer when you try to delete what has been input?
I am having that problem with a Win32 6/1/2001 build. If it happens
there with another keyboard, and if you patch fixes the problem
then, we need to get this in in the 0.9.1 branch. Otherwise, we will have
a huge problem in a number of languages. 

Comment 8

[Katsuhiko Momoi]

It's not very frequent with RU keyboard and seems to require special 
condition. But I was able to reproduce this problem even under the EN 
keyboard when deleting characters in the Subject field. 
The crash happens ** without fail** under AR and HE keyboards and thus
would make email in Arabic and Hebrew extremely unusable. 
I am nominating this for nsbeta1.

Comment 9

[Simon Montagu :smontagu]

I also get this crash when typing and deleting Hebrew text in the Subject field
in Mail Composer without the patch, and the patch fixes that case as well.

Comment 10

[Katsuhiko Momoi]

I also experience a crash every time I try to backsapace
over the "--" at the beginning email signature lines.
I filed a new bug for it but maybe it is related to this bug. 
I don't get Talkback to come up, however.
Those interested in this other bug, please see Bug 83946.

Comment 11

[Asa Dotzler [:asa]]

assuming that review and super review look good then a= [e-mail] for
checkin to the 0.9.1 branch and the trunk.
(on behalf of drivers)

Comment 12

[Frank Tang]

assuming that review and super review look good then a= [e-mail] for
     checkin to the 0.9.1 branch and the trunk.
     (on behalf of drivers)

reassign to ftang

Comment 13

[Frank Tang]

check into both moz0.9.1 and trunk.
Split other issue sinto bug 84031

Comment 14

[Claudius Gayle]

switching QA contact as I'm not realy the best/right person.

Comment 15

[Andreas Becker]

Switching QA contact to marina.  Marina, can you verify this with a russian
keyboard?  Alternatively, reporter (Simon), can you verify if this is working
for you now?

Comment 16

[Simon Montagu :smontagu]

Verified as fixed with Hebrew keyboard

Comment 17

[marina]

i don't crash with russian keyboard in Subject field in mail composition nor in
URL bar in the browser. Simon, if you'll see the problem again please reopen
this bug.Marking verified for now