91214 - Crash while formatting a table of data, doing Align->Right

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect, P3)

Description

[John Morrison]

Overview Description: 

 Crash while formatting a table of data, doing Align->Right

Steps to Reproduce: 
1) Load the attachment into composer
2) scroll to the bottom of the document
3) Add a row to the end of the table (Insert->Row After)
4) Type similar text into the four cells of that row
5) Select the contents of those four cells
6) From the menu, Format->Align->Right

Actual Results: crash (and on one occasion the app just "vaporized" 
                with no crash dialogs.

Expected Results: align right

Reproducibility: 100%

Build Date & Platform Bug Found: win2k current trunk, 
                                 and 7/16 0.9.2 branch builds


Additional Information: 

In the debugger (in an opt. build with symbols), at the point of the 
crash |this| is null, and the member |mPath| is garbage (hence crashes).


nsHTMLReflowCommand::BuildPath(nsHTMLReflowCommand * const 0x00000000) line 105 
+ 34 bytes
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x03309ef8, 
nsIPresContext * 0x0322b860, nsHTMLReflowMetrics & {...}, const nsSize & {...}, 
nsIRenderingContext & {...}) line 119
PresShell::ProcessReflowCommand(PresShell * const 0x00000000, nsVoidArray & 
{...}, int 0, nsHTMLReflowMetrics & {...}, nsSize & {...}, nsIRenderingContext 
& {...}) line 5830
PresShell::ProcessReflowCommands(PresShell * const 0x00000000, int 0) line 5885
PresShell::FlushPendingNotifications(PresShell * const 0x00000001) line 4863
PresShell::EndReflowBatching(PresShell * const 0x032db210, int 1) line 4889
nsEditor::EndUpdateViewBatch(nsEditor * const 0x00000000) line 4282
nsEditor::EndPlaceHolderTransaction(nsEditor * const 0x03230998) line 713
nsHTMLEditor::Align(nsHTMLEditor * const 0x024a6558, const nsAString & {...}) 
line 2494 + 13 bytes
nsHTMLEditorLog::Align(nsHTMLEditorLog * const 0x03230a5c, const nsAString & 
{...}) line 697 + 10 bytes
nsAlignCommand::SetState(nsAlignCommand * const 0x00000000, nsIEditorShell * 
0x03230a5c, nsString & {...}) line 920 + 12 bytes
nsMultiStateCommand::DoCommand(nsMultiStateCommand * const 0x032a7940, const 
nsAString & {...}, nsISupports * 0x032180a8) line 648
nsControllerCommandManager::DoCommand(nsControllerCommandManager * const 
0x03277338, const nsAString & {...}, nsISupports * 0x032180a8) line 183 + 12 
bytes
nsEditorController::DoCommand(nsEditorController * const 0x032b6838, const 
nsAString & {...}) line 192
XPTC_InvokeByIndex(nsISupports * 0x032b6838, unsigned int 5, unsigned int 1, 
nsXPTCVariant * 0x0012e48c) line 139
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
-1356179520) line 1881 + 22 bytes
XPC_WN_CallMethod(JSContext * 0x024f2320, JSObject * 0x022a57c0, unsigned int 
1, long * 0x03236fe8, long * 0x03236fb8) line 1252 + 10 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 0) line 807 + 17 
bytes
js_Interpret(JSContext * 0x024f2320, long * 0x0012e894) line 2702
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 824 + 10 
bytes
js_InternalInvoke(JSContext * 0x00000000, JSObject * 0x030db6a8, long 51235160, 
unsigned int 0, unsigned int 1, long * 0x0012ea74, long * 0x0012e9a4) line 896 
+ 13 bytes
JS_CallFunctionValue(JSContext * 0x024f2320, JSObject * 0x030db6a8, long 
51235160, unsigned int 1, long * 0x0012ea74, long * 0x0012e9a4) line 3320 + 25 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x00d04298, void * 
0x030db6a8, void * 0x030dc958, unsigned int 1, void * 0x0012ea74, int * 
0x0012ea70, int 0) line 941 + 25 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x024f2320, 
nsIDOMEvent * 0x032f96ac) line 140
nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const 
0x00000000, nsListenerStruct * 0x02219a48, nsIDOMEvent * 0x032f96b4, 
nsIDOMEventTarget * 0x02fc1a70, unsigned int 38740768, unsigned int 36231520) 
line 1161 + 9 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02fc19e8, 
nsIPresContext * 0x00000000, nsEvent * 0x0012f798, nsIDOMEvent * * 0x00000000, 
nsIDOMEventTarget * 0x02fc1a70, unsigned int 2, nsEventStatus * 0x0012f7f8) 
line 2131 + 16 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x02fc19a0, nsIPresContext * 
0x0241f880, nsEvent * 0x0012f798, nsIDOMEvent * * 0x0012f690, unsigned int 2, 
nsEventStatus * 0x0012f7f8) line 3633
nsXULElement::HandleDOMEvent(nsXULElement * const 0x02fc1a68, nsIPresContext * 
0x0241f880, nsEvent * 0x0012f798, nsIDOMEvent * * 0x0012f690, unsigned int 2, 
nsEventStatus * 0x0012f7f8) line 3650 + 22 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x031bd010, nsIPresContext * 
0x0241f880, nsEvent * 0x0012f798, nsIDOMEvent * * 0x0012f690, unsigned int 2, 
nsEventStatus * 0x0012f7f8) line 3650 + 22 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0342b680, nsIPresContext * 
0x0241f880, nsEvent * 0x0012f798, nsIDOMEvent * * 0x0012f690, unsigned int 2, 
nsEventStatus * 0x0012f7f8) line 3650 + 22 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0342c4e8, nsIPresContext * 
0x0241f880, nsEvent * 0x0012f798, nsIDOMEvent * * 0x0012f690, unsigned int 2, 
nsEventStatus * 0x0012f7f8) line 3650 + 22 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x03315238, nsIPresContext * 
0x0241f880, nsEvent * 0x0012f798, nsIDOMEvent * * 0x0012f690, unsigned int 1, 
nsEventStatus * 0x0012f7f8) line 3650 + 22 bytes
PresShell::HandleDOMEventWithTarget(PresShell * const 0x022eec78, nsIContent * 
0x024f1d4c, nsEvent * 0x0012f798, nsEventStatus * 0x0012f7f8) line 5680
nsMenuFrame::Execute(nsMenuFrame * const 0x00000000) line 1490
nsMenuFrame::HandleEvent(nsMenuFrame * const 0x0352d6d0, nsIPresContext * 
0x0241f880, nsGUIEvent * 0x0012fa8c, nsEventStatus * 0x0012fa4c) line 449 + 7 
bytes
PresShell::HandleEventInternal(PresShell * const 0x00000000, nsEvent * 
0x02fc5960, nsIView * 0x0339baa8, unsigned int 1, nsEventStatus * 0x0012fa4c) 
line 5645 + 20 bytes
PresShell::HandleEvent(PresShell * const 0x022eec78, nsIView * 0x0339baa8, 
nsGUIEvent * 0x0012fa8c, nsEventStatus * 0x0012fa4c, int 0, int & 1) line 5557 
+ 17 bytes
nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x0012fa8c, 
unsigned int 8, nsEventStatus * 0x0012fa4c, int 0, int & 1) line 377
nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x0339baa8, 
unsigned int 8, nsEventStatus * 0x0012fa4c, int 0, int & 1) line 350
nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x02294f28, 
unsigned int 8, nsEventStatus * 0x0012fa4c, int 0, int & 1) line 350
nsView::HandleEvent(nsView * const 0x00000000, nsGUIEvent * 0x0339aea8, 
unsigned int 28, nsEventStatus * 0x0012fa4c, int 1, int & 1) line 350
nsViewManager::DispatchEvent(nsViewManager * const 0x0000032a, nsGUIEvent * 
0x00000029, nsEventStatus * 0x0012fa4c) line 2056
HandleEvent(nsGUIEvent * 0x021bdb70) line 68
nsWindow::DispatchEvent(nsWindow * const 0x03329f5c, nsGUIEvent * 0x0012fa8c, 
nsEventStatus & nsEventStatus_eIgnore) line 720 + 6 bytes
nsWindow::DispatchWindowEvent(nsWindow * const 0x00000000, nsGUIEvent * 
0x00000000) line 741
nsWindow::DispatchMouseEvent(nsWindow * const 0x00000000, unsigned int 301, 
nsPoint * 0x00000000) line 4242
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x00000000, unsigned int 
301, nsPoint * 0x00000000) line 4488 + 15 bytes
nsWindow::ProcessMessage(nsWindow * const 0x00000000, unsigned int 514, 
unsigned int 0, long 2687030, long * 0x0012fce8) line 3233
nsWindow::WindowProc(HWND__ * 0x000b041e, unsigned int 514, unsigned int 0, 
long 53649244) line 988 + 16 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x00ce4118) line 423
main1(int 1, char * * 0x00322ba8, nsISupports * 0x00322bc8) line 1174 + 9 bytes
main(int 1, char * * 0x00322ba8) line 1478 + 25 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x00132d61, 
HINSTANCE__ * 0x00400000) line 1496 + 21 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e87903()

Comment 1

[John Morrison]

Attachment: file to edit in composer as described in bug 91214

Comment 2

[rubydoo123]

this actually has to do with adding a last row and then applying format to the
content of the last row. Adding rows before the last row does not result in a crash.

Comment 3

[lchiang]

What about if you add some other steps between adding the last row and applying
formatting to the last row?  For example, format some other row first and then
come back to last row or type some text somewhere else first?

Comment 4

[lchiang]

oops, cc: beth for previous comments

Comment 5

[John Morrison]

Erk. Well, I tried adding the row, entering the text, and then selecting a 
row four rows above, then doing align right --- it split the table into 
two tables! Then when I tried undo, I crashed. 

Comment 6

[lchiang]

It looks like more problems with alignment area and tables beyond this
particular crash. 

Comment 7

[John Morrison]

Attachment: an alternate crash; don't add a row; just select a few rows inside the table and then do Align->Right

Comment 8

[John Morrison]

Yes, basically that table (many tables?) and Align->Right are having big 
troubles. Seems to be a lot of things can go wrong.

Comment 9

[sujay]

I have filed a separate bug on the Align Right splitting the table in two.
John, I cc'd you on that bug.

Comment 10

[kinmoz]

FYI, I just attatched a patch to bug 91310 that prevents the table splitting 
when changing the alignment. Unfortunately, the patch has the sideffect of 
masking this bug, which I believe is a layout reflow problem.

Comment 11

[mjudge]

ok waterson kin is going to check in a fix to mask this bug.  he believes its 
similar to bug 90521 which was marked a dup of 84645. once kins fix is in this 
will be very hard to reproduce.  do with it as you will....

Comment 12

[Marc Attinasi]

bug 91310 is the bug kin has fixed that will mask this one...

Comment 13

[chris hofmann]

sounds like we should take off the nsbranch or make this nsbranch- now, correct?

Comment 14

[John Morrison]

removing nsbranch keyword. I can't reproduce this crash as originally reported
(due to the other part of the fix). 

Comment 15

[Chris Waterson]

There's probably still a bug in there (I can't see how I thought this was
related to bug 84645), but it's well-masked now. kin, for the record, could you
describe the steps that editor was taking in the DOM to cause this problem? Then
maybe somebody can cough up a test-case that will reproduce the problem. Pushing
to future since IIRC it was pretty byzantine...

Comment 16

[rubydoo123]

removing myself from the cc list

Comment 17

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 18

[Asa Dotzler [:asa]]

Do we still need this bug report? I cannot reproduce any crashers with 1.7 beta
with repeated attempts.

Comment 19

[Andrew Schultz]

this crash has been masked since 7/23/01 (see comment 10).  Unfortunately,
people who might have understood what was going on before are now gone.

resolving WORKSFORME