90142 - M092 crash editing text in form [@ nsContainerFrame::GetFrameForPointUsing]

Status: VERIFIED WORKSFORME

(Core :: DOM: Editor, defect, P2)

Description

[greer]

User comments point to a crash while moving around in HTML forms.

I just reproduced this one (32732446):
1. go to hotbox.ru 
   (May I suggest you click on "English Version") 
2. go to registration
3. navigate the text forms using the arrow keys

That should be enough to produce the crash.

Here's the stack from today's talkback reports:

        nsContainerFrame::GetFrameForPointUsing
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 
274]
         ViewportFrame::GetFrameForPoint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp  line 174]
         nsHTMLContainerFrame::CreateNextInFlow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp  line 
140]
         nsBlockFrame::CreateContinuationFor
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 3628]
         nsTableRowGroupFrame::FindLineContaining
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp  
line 1622]
         nsFrame::GetFrameFromDirection
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrame.cpp  line 3760]
         nsTextFrame::PeekOffset
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsTextFrame.cpp  line 3929]
         nsSelection::MoveCaret 
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp  line
1576]
         nsSelection::CharacterMove
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp  line 2944]
         nsTextInputSelectionImpl::CharacterMove
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsGfxTextControlFrame2.cpp  
line 834]
         nsSelectionMoveCommands::DoCommand
[d:\builds\seamonkey\mozilla\editor\base\nsEditorCommands.cpp  line 388]
         nsControllerCommandManager::DoCommand
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsControllerCommandManager
.cpp  line 184]
         nsComposerController::DoCommand
[d:\builds\seamonkey\mozilla\editor\base\nsComposerController.cpp  line 226]
         nsXBLPrototypeHandler::ExecuteHandler
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp  line 
310]
         DoKey  [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLKeyHandler.cpp  
line 92]
         nsXBLKeyHandler::KeyPress
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLKeyHandler.cpp  line 108]
         nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp  line 
1598]
         nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp  line 1674]
         nsHTMLTextAreaElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLTextAreaElement.cpp  
line 595]
         PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5565]
         PresShell::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp
line 5492]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  
line 377]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  
line 350]
         nsView::HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  
line 350]
         nsViewManager::DispatchEvent   
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp
line 2051]
         HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 
68]
         nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 724]
         nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 741]
         nsWindow::DispatchKeyEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 2390]
         nsWindow::OnKeyDown    
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line
2458]
         nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3152]
 
        Source File : 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsConta
inerFrame.cpp line
: 274
     (32720473) Comments: Pressing upkey in textarea caused crash
     (32720366) Comments: Deleting some text in textarea
     (32651019) URL: http://us.imdb.com/
     (32651019) Comments: The page was loading.
     (32583794) Comments: Typing a message
     (32571606) Comments: go back to previous web page
     (32552117) Comments: This failure occures when my cursor stands on the left 
side of a textbox and i press the left-cursor-key.Do you understand !?Bye
     (32512898) Comments: FTP-Download
     (32510509) URL: www.gmx.net
     (32510509) Comments: filling out a html text form
     (32472616) URL: hotbox.ru
     (32472616) Comments: Editing in a text area

Comment 1

[greer]

adding keywords

Comment 2

[Kathleen :Brade]

since rods is out, send over to editor...

Comment 3

[rubydoo123]

over to kathy for debugging

Comment 4

[kinmoz]

I can't reproduce this problem in my 07/10/01 Win32 debug Mozilla tree. Anyone 
else have any luck?

I'm wondering if the frame tree is corrupted or out of sync with the actual 
content tree when this happens. I've seen cases where editing in text widgets 
leaves the frame tree out of sync with the content tree because reflow requests 
were not propogated down into the widget, leaving stale frame data in the frame 
tree.

Comment 5

[Kathleen :Brade]

Tom--can you help us reproduce this problem?  Can you be more specific about what steps you took to reproduce?  Were you in a textarea (multiline) field or in an input area?  Were you tabbing between fields?  Had you used cut/paste?  Had you pressed the d elete key while typing?  Did you type a lot in one or more fields?
Thanks!ˇê

Comment 6

[greer]

This is all that was necessary to crash the 2001062817 M092 release:
1. go to hotbox.ru
2. Click on "English Version" (upper right)
3. Click on "Registration" (bottom)
4. Click the "I Accept" button (bottom)
5. Place your cursor in the top form window
6. Press the left arrow
Crash

I just submitted a crash incident #32824668

Comment 7

[Kathleen :Brade]

resolving as worksforme
Tom Greer was able to reproduce with 0.9.2 build but not with a recent branch build.  Sujay and Tever also tried to reproduce (in addition to Kin and me).
I'm going to guess that some other fix also fixed this bug.

Comment 8

[sujay]

verified.

Comment 9

[Matthias Versen [:Matti]]

*** Bug 92976 has been marked as a duplicate of this bug. ***