Closed Bug 251088 Opened 20 years ago Closed 20 years ago

crash in View Selection Source of object tag

Categories

(Core Graveyard :: View Source, defect)

Product:
Core Graveyard
Component:
View Source
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED WORKSFORME

People

(Reporter: info, Assigned: doronr)

References

(
URL
)

Details

(Keywords: crash)

User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a1) Gecko/20040520 Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a1) Gecko/20040520 This page references an external .js file (to avoid the 906 patent) that document.write's the Flash Satay trick of an object tag with nested alternative HTML. The net result is a version-checking Flash player movie appears on the page (good). But if I select the HTML around the movie and View Selection Source, Mozilla 1.8a crashes (bad). Reproducible: Always Steps to Reproduce: 1. Go to http://www.macromedia.com/help/en_us/temp_moz_bug.html 2. As it says, select the text above and below the Flash movie. 3. From the context menu, View Selection Source Actual Results: Crash! I submitted a talkback report just now. Apple's Crash report included Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000000 Thread 0 Crashed: 0 libgklayout.dylib 0x021333b4 nsContentIterator::NextNode(nsIContent*, nsVoidArray*) + 0x12c 1 libgklayout.dylib 0x0213380c nsContentIterator::Next() + 0x4c 2 libgklayout.dylib 0x0217c2c4 nsTypedSelection::selectFrames(nsIPresContext*, nsIContentIterator*, nsIContent*, nsIDOMRange*, nsIPresShell*, int) + 0x278 3 libgklayout.dylib 0x0217c530 nsTypedSelection::selectFrames(nsIPresContext*, nsIDOMRange*, int) + 0x238 4 libgklayout.dylib 0x0217cb24 nsTypedSelection::Repaint(nsIPresContext*) + 0xa8 5 libgklayout.dylib 0x0214c958 nsDocViewerFocusListener::Blur(nsIDOMEvent*) + 0x100 6 libgklayout.dylib 0x021a03f0 DispatchToInterface(nsIDOMEvent*, nsIDOMEventListener*, unsigned (nsIDOMEventListener::*)(nsIDOMEvent*), nsID const&, int*) + 0x94 Expected Results: Not crashed. OTOH, this is complicated dynamic code, I can remove the 906 patent workaround, and only the curious will View Selection Source. KERN_PROTECTION_FAILURE (0x0002) at 0x00000000 in libgklayout.dylib at 0x021333b4 nsContentIterator::NextNode The stack trace looks like that in bug 244997.
I made a much simpler test case of just a Flash object tag in HTML, no JavaScript or "Flash satay" nested alternative, http://www.macromedia.com/help/en_us/temp_moz_bug2.html , and that also crashes if I View Selection Source.
Summary: crash in View Selection Source of external JS hack that docwrite's object tags → crash in View Selection Source of object tag
Severity: normal → critical
Keywords: crash
Summary: crash in View Selection Source of object tag → crash in View Selection Source of object tag
I haven't seen this crash on Mozilla 1.7 or on Firefox. I can confirm it on Mozilla trunk (1.8a+) 2004071214), Windows 98. All/all. For some reason, I can't generate a talkback when this crash occurs. The crash occurs in gfgx something something .dll. I see this almost whenever I try to view selection source.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking1.8a3?
OS: MacOS X → All
Hardware: Macintosh → All
View selection source doesn't always crash this browser, but it does do so often. Maybe the crash is linked to an object tag or to a table.
I can't reproduce the crash
Flags: blocking1.8a3?
Depends on: 130900
Hello, it may be the same issue, or another Bug? Mozilla crashes if using "View Selection Source" when only an HTML Button of a Form is selected. Tested on NT4 and Win2000 Mozilla 1.7 shows the source Mozilla 1.71 shows no source Mozilla 1.8A4 crash The dependency does not look correct for me. Look at http://212.1.43.17/moz17bug.html or try this simple Code: <html><body> <font face="Arial,Helvetica"> <p><center><form method=post action="javascript:loadpopup()"name=u> 1. Go 1cm left of Button to about the top of the button, hold left mousebutton down<br> 2. move to 1cm right of the button to the bottom of the button and release the mousebutton<br> 3. click with right mouse button 5mm right of the Button in middle height<br> 4. select "View Selection Source" in the Mousemenue (If not present repeat all steps)<br> 5. look at crash<br> </p> <p><input type=submit value="Crash if source shown"> </form> </center></p> </font> </body></html>
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041022 also tested working with yesterdays nightly. wfm: http://www.macromedia.com/help/en_us/temp_moz_bug.html There is another bug with selection, but I assume it is filed elsewhere as reflow bug, probably one of the bugs listed in bug 261196 It doesn´t matter if I select top-down or bottom up, when I hover over the object, the page jumps up. After this, when I started to select top-down, the text above my starting point is selected, up to the cursor position. wfm http://212.1.43.17/moz17bug.html is working if I select the button only, <font> ... </font> or if according to the instructions select the whole form, <form> ... </form> The bug on this URL could be a dupe of Bug 265643 crash when selecting form and do a "View Selection Source" I didn´t yet test that one, as I don´t want to crash with an unfinished comment.
Product: Browser → Seamonkey
similar (or same) bug here using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041122 go to: http://www.cult3d.com/download/viewer/win_mozilla.asp select some text of the "Start installation now!" button using left mouse button. right click for context menu - if you get the option "View selection source", selecting text has been succesfull. click on that option and mozilla crashes. btw. clicking the button to install the plugin doesn't work - to be precise: nothing happens after clicking the button. I know xpi-installation from unknown sources has been disabled. shouldn't there be at least any warning? reproducible: always (well, selecting text may be a bit tricky though)
worksforme with linux trunk 2004112705 S Page: can you still reproduce this bug? If not, please resolve WORSKFORME
My two test cases http://www.macromedia.com/help/en_us/temp_moz_bug.html and http://www.macromedia.com/help/en_us/temp_moz_bug2.html don't cause crashes with 1.8a4 (Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a4) Gecko/20040927 ). Good news! Also, the test case in Comment #7 works for me. More good news! So I'm marking this WORKSFORME as requested. *However* ! http://212.1.43.17/moz17bug.html (see comment #5 below from Klaas Henschel) repeatedly crashed for me. Its stack trace from Apple's crash reporter (I also sent Talkback) is completely different, so I think Klaas Henschel's problem is a different bug that should be filed separately. Thread 0 Crashed: 0 libgfx_mac.dylib 0x0165f5f8 nsUnicodeRenderingToolkit::GetTextDimensions(unsigned short const*, unsigned, nsTextDimensions&, int*) + 0x80 1 libgfx_mac.dylib 0x0165f55c nsUnicodeRenderingToolkit::GetWidth(unsigned short const*, unsigned, int&, int*) + 0x2c 2 libgfx_mac.dylib 0x01657b98 nsRenderingContextMac::GetWidth(unsigned short const*, unsigned, int&, int*) + 0x78 3 libgklayout.dylib 0x02060b90 nsTextFrame::GetPointFromOffset(nsPresContext*, nsIRenderingContext*, int, nsPoint*) + 0x2b8 4 libgklayout.dylib 0x021785b4 nsTypedSelection::GetPointFromOffset(nsIFrame*, int, nsPoint*) + 0x158 5 libgklayout.dylib 0x02175fa4 nsTypedSelection::GetCachedFrameOffset(nsIFrame*, int, nsPoint&) + 0xa4 6 libgklayout.dylib 0x0217885c nsTypedSelection::GetSelectionRegionRectAndScrollableView(short, nsRect*, nsIScrollableView**) + 0x280 7 libgklayout.dylib 0x021790ec nsTypedSelection::ScrollIntoView(short, int) + 0x138 8 libxpcom.dylib 0x00345b5c _XPTC_InvokeByIndex + 0xd8 9 libxpconnect.dylib 0x0066a1d4 XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 0x9dc 10 libxpconnect.dylib 0x0066ffa8 XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*, long*) + 0xdc 11 libmozjs.dylib 0x0022e098 js_Invoke + 0x6c8 12 libmozjs.dylib 0x00235a34 js_Interpret + 0x6bc8 13 libmozjs.dylib 0x0022e0d8 js_Invoke + 0x708 14 libxpconnect.dylib 0x00666334 nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) + 0x8d8 15 libxpcom.dylib 0x003459f8 PrepareAndDispatch + 0x2f4
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → WORKSFORME
Product: SeaMonkey → Core Graveyard
You need to log in before you can comment on or make changes to this bug.