Closed Bug 3278 Opened 26 years ago Closed 26 years ago

crash after DOM delete

Categories

(Core :: Layout, defect, P1)

Product:
Core
Component:
Layout
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: buster, Assigned: buster)

Details

run viewer, go into edit mode select "nd" in the word "second" ctrl-i to make italic. This will split the text node containing "second" into 2 text nodes ("seco" and "nd"), create a new span node for <I> between the two text nodes, delete the text node "nd" from it's parent (the span node for <B>), then insert it into the span node <I>. It is the reflow following the delete that causes the crash. test case: <html><body> <p>inbetween text</p>123<B>BOLD</B>456 <p>first<b>second</b></p> <p>third<b>fourth</b></p> </body></html> stack: TextFrame::ComputeTotalWordWidth(nsLineLayout & {...}, const nsHTMLReflowState & {...}, nsIFrame * 0x0126be50, int 330) line 2437 + 13 bytes TextFrame::Reflow(TextFrame * const 0x0126bad4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 5461424) line 2201 + 36 bytes nsInlineReflow::ReflowFrame(int 1, nsHTMLReflowMetrics & {...}, unsigned int & 5461424) line 450 nsInlineReflow::ReflowFrame(nsIFrame * 0x0126bad0, int 1, unsigned int & 5461424) line 274 + 20 bytes nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineBox * 0x0126bed0, nsIFrame * 0x0126bad0, int * 0x0012c708) line 2525 + 31 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0126bed0, int * 0x0012c76c) line 1717 + 24 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1472 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x0126b9a4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 5255674) line 921 + 18 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x0126b9a0, const nsRect & {x=0 y=855 width=8940 height=1073741824}, int 0, nsMargin & {top=0 right=0 bottom=0 left=0}, unsigned int & 5255674) line 192 + 39 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x0126bd30, int * 0x0012d5a8) line 2335 + 45 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0126bd30, int * 0x0012d5a8) line 1683 + 20 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1472 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01269b44, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 19307328) line 921 + 18 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01269b40, const nsRect & {x=0 y=0 width=9180 height=1073741824}, int 1, nsMargin & {top=0 right=0 bottom=0 left=0}, unsigned int & 19307328) line 192 + 39 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x01269db0, int * 0x0012e3e4) line 2335 + 45 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01269db0, int * 0x0012e3e4) line 1683 + 20 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1472 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01269c64, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 921 + 18 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x01269c64, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 503 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x01269c60, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes RootFrame::Reflow(RootFrame * const 0x01269994, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 256 nsContainerFrame::ReflowChild(nsIFrame * 0x01269990, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes nsScrollFrame::Reflow(nsScrollFrame * const 0x01268f04, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 350 nsContainerFrame::ReflowChild(nsIFrame * 0x01268f00, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes ViewportFrame::Reflow(ViewportFrame * const 0x01261e34, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 438 nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0126f250, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {width=9180 height=4470}, nsIRenderingContext & {...}) line 168 PresShell::ProcessReflowCommands(PresShell * const 0x0125e640) line 1175 PresShell::ExitReflowLock(PresShell * const 0x0125e640) line 621 PresShell::ContentRemoved(PresShell * const 0x0125e648, nsIDocument * 0x0120dc10, nsIContent * 0x0126a17c, nsIContent * 0x0126a1ec, int 2) line 1547 nsDocument::ContentRemoved(nsDocument * const 0x0120dc10, nsIContent * 0x0126a17c, nsIContent * 0x0126a1ec, int 2) line 1270 nsHTMLDocument::ContentRemoved(nsHTMLDocument * const 0x0120dc10, nsIContent * 0x0126a17c, nsIContent * 0x0126a1ec, int 2) line 724 nsGenericHTMLContainerElement::RemoveChildAt(int 2, int 1) line 2582 nsGenericHTMLContainerElement::RemoveChild(nsIDOMNode * 0x0126a1e0, nsIDOMNode * * 0x0012f678) line 2392 + 14 bytes nsHTMLSpanElement::RemoveChild(nsHTMLSpanElement * const 0x0126a170, nsIDOMNode * 0x0126a1e0, nsIDOMNode * * 0x0012f678) line 43 + 22 bytes DeleteElementTxn::Do() line 93 + 83 bytes nsTransactionItem::Do() line 98 + 17 bytes
Status: NEW → ASSIGNED
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
I just checked in fixes for this.
QA Contact: 4110 → 4144
Status: RESOLVED → VERIFIED
Fixed in April 5th Build.
URL: see test case
You need to log in before you can comment on or make changes to this bug.