User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a5) Gecko/20041122 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a5) Gecko/20041122 Sometimes calling of alert() method in DidDeleteSelectoin of nsIEditActionListener brings to crash. Reproducible: Sometimes Steps to Reproduce:

alert() method in DidDeleteText of nsIEditActionListener() sometimes leads to crash.

The alert should appear when i delete the selection (aka i click somewhere where no selection is)? I can't seem to reproduce this (yes, i ran this testcase from local and Allowed the scripts the privs).

You can ran this test locally to reproduce this bug. You should select range and then press 'delete' or 'backspace' key (or ctrl+x). When you delete selected text then you should see alert. If you don't see alert then you probably recover one more bug: event is not fired. I saw such behaviour but it is rarely. Run this test and try to select and delete topic 'Webhosting Still Available'. I always get a crash when I do it.

Is there a talkback incident ID?

Sorry, correct talkback id is http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3728237K

Incident ID: 3728237 Stack Signature nsFontMetricsWin::ResolveForwards a29cf3df Product ID MozillaTrunk Build ID 2005011116 Trigger Time 2005-02-15 22:27:31.0 Platform Win32 Operating System Windows NT 5.0 build 2195 Module gkgfxwin.dll + (0000a1b2) URL visited User Comments https://bugzilla.mozilla.org/show_bug.cgi?id=281355 Since Last Crash 10433 sec Total Uptime 728701 sec Trigger Reason Unknown exception 0x153f143f Source File, Line No. c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsFontMetricsWin.cpp, line 3958 Stack Trace nsFontMetricsWin::ResolveForwards [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsFontMetricsWin.cpp, line 3958] nsRenderingContextWin::GetWidth [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsRenderingContextWin.cpp, line 1482] nsTextFrame::GetPointFromOffset [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsTextFrame.cpp, line 3840] nsTypedSelection::GetPointFromOffset [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsSelection.cpp, line 6753] nsTypedSelection::GetCachedFrameOffset [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsSelection.cpp, line 5104] nsCaret::GetCaretRectAndInvert [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCaret.cpp, line 983] nsCaret::DrawCaret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCaret.cpp, line 901] nsCaret::StartBlinking [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCaret.cpp, line 499] DispatchToInterface [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 136] nsEventListenerManager::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1604] nsDocument::HandleDOMEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp, line 3827] nsEventStateManager::PreHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 604] PresShell::HandleEventInternal [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5914] PresShell::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5773] nsViewManager::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2360] nsViewManager::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2133] HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1102] nsWindow::DispatchFocus [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5578] nsWindow::ProcessMessage [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 4241] nsWindow::WindowProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1383] USER32.dll + 0x2ca8 (0x77e12ca8) USER32.dll + 0x4764 (0x77e14764) USER32.dll + 0x4720 (0x77e14720) ntdll.dll + 0x215ef (0x77fa15ef) nsGlobalWindow::Focus [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp, line 2612] nsEventStateManager::PreHandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 779] PresShell::HandleEventInternal [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5914] PresShell::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5773] nsViewManager::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2360] nsViewManager::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2133] HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1102] nsWindow::DispatchFocus [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5578] nsWindow::ProcessMessage [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 4244] nsWindow::WindowProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1383] USER32.dll + 0x2ca8 (0x77e12ca8) USER32.dll + 0x4764 (0x77e14764) USER32.dll + 0x4720 (0x77e14720) ntdll.dll + 0x215ef (0x77fa15ef) nsGlobalWindow::Focus [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp, line 2612] nsWebShellWindow::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp, line 569] nsWindow::DispatchEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1102] nsWindow::DispatchFocus [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5578] nsWindow::ProcessMessage [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 4241] nsWindow::WindowProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1383] USER32.dll + 0x2ca8 (0x77e12ca8) USER32.dll + 0x4764 (0x77e14764) USER32.dll + 0x4720 (0x77e14720) ntdll.dll + 0x215ef (0x77fa15ef) USER32.dll + 0x4222 (0x77e14222) USER32.dll + 0x2ca8 (0x77e12ca8) USER32.dll + 0x52e6 (0x77e152e6) USER32.dll + 0x6487 (0x77e16487) nsWindow::WindowProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1390] USER32.dll + 0x2ca8 (0x77e12ca8) USER32.dll + 0x4764 (0x77e14764) USER32.dll + 0x4720 (0x77e14720) ntdll.dll + 0x215ef (0x77fa15ef) nsXULWindow::Destroy [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsXULWindow.cpp, line 481] nsWebShellWindow::Destroy [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp, line 1584] nsChromeTreeOwner::Destroy [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsChromeTreeOwner.cpp, line 349] nsGlobalWindow::CloseWindow [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp, line 4851] nsJSContext::ScriptEvaluated [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1867] we have other bugs about nsFontMetricsWin::ResolveForwards, but i don't see the stack's bottom, among other strange things....

Is this still an issue, Alexander? The testcase doesn't crash for me with current trunk build.

Can you provide a link to your build? I would test with it.

ftp://ftp.mozilla.org/pub/mozilla.org/mozilla/nightly/latest-trunk/ should have it. Or ftp://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/ if that's preferred.

I tested on latest trunk (1.8b2) and on 1.8b3. Bug is presented. To reproduce the bug try to select a header (in instance 'welcome to XULPlanet' or 'Learn XUL') and press delete. After alert with 'hello' message mozilla should be crashed. .

(In reply to comment #12) > I tested on latest trunk (1.8b2) and on 1.8b3. 1.8bb2 or 1.8b3 is not latest trunk. You need to download one of the builds that Boris gave you the link for. But anyway, I just crashed with a 2005-08-29 trunk build, so this bug is still there.

With the testcase, I crash every time, when double clicking on a link or one click at the xulplanet logo. When clicking the link, it seems that the link is followed. This doesn't happen when this line: //editor.getEditor(editor.contentWindow).addEditActionListener(listener); is commented (like I did here).

Chances are the point is that this code is not reentrant and that callees should not put up modal dialogs...

problem gone? testcase WFM - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060918 SeaMonkey/1.5a only thing I see is ... Error: uncaught exception: Permission denied to create wrapper for object of class UnnamedClass

Well, I get: Error: [Exception... "'Permission denied to get property XULElement.disabled' when calling method: [nsIDOMXULControlElement::disabled]" nsresult: "0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)" location: "JS frame :: file:///C:/Documents%20and%20Settings/mw/Bureaublad/test2.xul :: anonymous :: line 23" data: no] Source File: file:///C:/Documents%20and%20Settings/mw/Bureaublad/test2.xul Line: 23 with current trunk build. But I don't crash anymore. I'm marking this bug worksforme. Alexander, if you can still reproduce this bug with current trunk bug, then please reopen.