8922 - hitting "horizontal line" button while a horizontal line is selected crashes RDF.dll

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P3)

Description

[Andrew Niese]

Starting editor from either command line or thru tasks menu, insert a horizontal
line, select it, and then hit the button about 5 more times while the original
is selected.


Boing.

APPRUNNER caused an invalid page fault in
module RDF.DLL at 0177:00b3c99f.
Registers:
EAX=0075f5b4 CS=0177 EIP=00b3c99f EFLGS=00010212
EBX=00000000 SS=017f ESP=0075f5a8 EBP=0075f604
ECX=0075f5d0 DS=017f ESI=04b0b910 FS=aa37
EDX=00000000 ES=017f EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 07 8d 4d fc 51 57 ff 50 0c 85 c0 0f 85 06 01
Stack dump:
10005595 04b0b920 ffffffff 1001e8a8 00000006 0000000f 00000001 00000000 0075f5d0
00000000 00690077 0064006e 0077006f 00000000 00000000 00b53314


June 26 build.

Comment 1

[Charles Manske]

I assume the dialog pops up each time and you hit OK or Cancel?
I tried it and just dismissed the dialog using the "X" in the corner and it
crashed on the third try:
HRuleFrame::GetNoShade() line 249 + 24 bytes
HRuleFrame::Paint(HRuleFrame * const 0x02321660, nsIPresContext & {...},
nsIRenderingContext & {...}, const nsRect & {x=0 y=0 width=8535 height=420},
nsFramePaintLayer eFramePaintLayer_Overlay) line 117 + 8 bytes
nsContainerFrame::PaintChild(nsIPresContext & {...}, nsIRenderingContext &
{...}, const nsRect & {x=-120 y=-360 width=8745 height=7440}, nsIFrame *
0x02321660, nsFramePaintLayer eFramePaintLayer_Overlay) line 297
nsBlockFrame::PaintChildren(nsIPresContext & {...}, nsIRenderingContext & {...},
const nsRect & {x=-120 y=-360 width=8745 height=7440}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 4984
nsBlockFrame::Paint(nsBlockFrame * const 0x011fba20, nsIPresContext & {...},
nsIRenderingContext & {...}, const nsRect & {x=-120 y=-360 width=8745
height=7440}, nsFramePaintLayer eFramePaintLayer_Overlay) line 4920
nsContainerFrame::PaintChild(nsIPresContext & {...}, nsIRenderingContext &
{...}, const nsRect & {x=-120 y=-360 width=8745 height=7440}, nsIFrame *
0x011fba20, nsFramePaintLayer eFramePaintLayer_Overlay) line 297
nsBlockFrame::PaintChildren(nsIPresContext & {...}, nsIRenderingContext & {...},
const nsRect & {x=-120 y=-360 width=8745 height=7440}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 4984
nsBlockFrame::Paint(nsBlockFrame * const 0x011efee0, nsIPresContext & {...},
nsIRenderingContext & {...}, const nsRect & {x=-120 y=-360 width=8745
height=7440}, nsFramePaintLayer eFramePaintLayer_Overlay) line 4920
nsContainerFrame::PaintChild(nsIPresContext & {...}, nsIRenderingContext &
{...}, const nsRect & {x=0 y=0 width=8745 height=7440}, nsIFrame * 0x011efee0,
nsFramePaintLayer eFramePaintLayer_Overlay) line 297
nsBlockFrame::PaintChildren(nsIPresContext & {...}, nsIRenderingContext & {...},
const nsRect & {x=0 y=0 width=8745 height=7440}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 4984
nsBlockFrame::Paint(nsBlockFrame * const 0x011efb90, nsIPresContext & {...},
nsIRenderingContext & {...}, const nsRect & {x=0 y=0 width=8745 height=7440},
nsFramePaintLayer eFramePaintLayer_Overlay) line 4920
nsAreaFrame::Paint(nsAreaFrame * const 0x011efb90, nsIPresContext & {...},
nsIRenderingContext & {...}, const nsRect & {x=0 y=0 width=8745 height=7440},
nsFramePaintLayer eFramePaintLayer_Overlay) line 162 + 25 bytes
nsContainerFrame::PaintChild(nsIPresContext & {...}, nsIRenderingContext &
{...}, const nsRect & {x=0 y=0 width=8745 height=7440}, nsIFrame * 0x011efb90,
nsFramePaintLayer eFramePaintLayer_Overlay) line 297
nsContainerFrame::PaintChildren(nsIPresContext & {...}, nsIRenderingContext &
{...}, const nsRect & {x=0 y=0 width=8745 height=7440}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 236
nsHTMLContainerFrame::Paint(nsHTMLContainerFrame * const 0x011ef960,
nsIPresContext & {...}, nsIRenderingContext & {...}, const nsRect & {x=0 y=0
width=8745 height=7440}, nsFramePaintLayer eFramePaintLayer_Overlay) line 79
PresShell::Paint(PresShell * const 0x011e8914, nsIView * 0x011efa10,
nsIRenderingContext & {...}, const nsRect & {x=0 y=0 width=8745 height=7440})
line 1957 + 34 bytes
nsView::Paint(nsView * const 0x011efa10, nsIRenderingContext & {...}, const
nsRect & {x=0 y=0 width=8745 height=7440}, unsigned int 128, int & 0) line 286
nsViewManager::RenderView(nsIView * 0x011efa10, nsIRenderingContext & {...},
const nsRect & {x=0 y=0 width=8745 height=7440}, nsRect & {x=0 y=0 width=8745
height=16305}, int & 0) line 1280

Comment 2

[Andrew Niese]

Actually,
I got it to crash by hitting it rapidly, apparently before the dialog showed.
Like a double click.

Comment 3

[Charles Manske]

Needed to addref the element pointer returned in
nsHTMLEditor::GetSelectedElement.
Checked in 6/27/99

Comment 4

[Andrew Niese]

This isn't fixed in the 06/28/99 build... how long of a time after a checkin
does it take to have it put in the build?

Comment 5

[Charles Manske]

I'm not sure. We (NS) get them in the daily Mozilla builds that we pull from
mozilla source tree. Where do you get yours?

Comment 6

[sujay]

this is not fixed...I see the problem as described. It does freeze and
eventually crash.

Comment 7

[Charles Manske]

Well it doesn't crash in my debug build.

Comment 8

[sujay]

CHarley, when you get chance come by and I'll show you in my build.

Comment 9

[Andrew Niese]

Perhaps sujay and I have some similarities in our configuration? It's a wild
stab, but...

I'm on a Pentium II 300, 128 megs ram, Windows 98, IE5. I download builds from
the nightly folder every other night or so, and extract it to the same directory
each time (overwritting previous files)

Comment 10

[leger]

Clearing Fixed resolution.

Comment 11

[Charles Manske]

Since it works in my debug build, its something very subtle.
Must finish M8 work first

Comment 12

[Andrew Niese]

cmanske - did sujay ever show you his crash? he could reproduce it.

Comment 13

[Kathleen :Brade]

this works for me; Sujay can you retest?

Comment 14

[Charles Manske]

Sujay couldn't reproduce this again. So I'll mark it as fixed.
Note that there is a crash if you use the Pixel/Percent popup menu, then
hit OK or Cancel. That is covered by another bug.
And when testing, be sure to click on the first horizontal line inserted, so
you don't get confused with bug 9513, which happens if you click on HLine
button twice in a row.

Comment 15

[sujay]

verified in 7/9 build...