Crash deleting selected text and table. Reproduced: Release Build 1999072815, WinNT 4.0. Did not try on Necko builds yet or on other platforms. (Sujay - perhaps you can try since this is in the editor area? Thanks.) 1) Start Apprunner 2) Tasks | Editor 3) Scroll down the page to the part right before the table on the page. 4) Select "4. Another thing" and all the table cells. 5) Press Delete Actual Results: Crash occurs Expected Results: The items selected get deleted. Additional Information: a) This is also reproducible in the HTML mail compose window where I first saw this problem. b) In the Editor, if I just select the table without selecting "4. Another thing" and press Delete, there is no problem. The table gets deleted. c) Several talkback incidents filed: 11775268, 11775207, 11764258. Below is a stack trace from the most recent crash using the Editor: nsHTMLEditRules::WillDeleteSelection [d:\builds\seamonkey\mozilla\editor\base\nsHTMLEditRules.cpp, line 452] nsHTMLEditRules::WillDoAction [d:\builds\seamonkey\mozilla\editor\base\nsHTMLEditRules.cpp, line 93] nsTextEditor::DeleteSelection [d:\builds\seamonkey\mozilla\editor\base\nsTextEditor.cpp, line 982] nsHTMLEditor::DeleteSelection [d:\builds\seamonkey\mozilla\editor\base\nsHTMLEditor.cpp, line 220] nsTextEditorKeyListener::KeyDown [d:\builds\seamonkey\mozilla\editor\base\nsEditorEventListeners.cpp, line 179] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 758] nsDocument::HandleDOMEvent [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 2303] nsHTMLHtmlElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLHtmlElement.cpp, line 188] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2250] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 834] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 819] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 819] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 819] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1736] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 67] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 494] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 515] nsWindow::DispatchKeyEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1960] nsWindow::OnKeyDown [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2154] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2498] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 564] USER32.dll + 0x1268 (0x77e71268) 0x01530001

As more folks are using mail in 5.0, this may be a common occurrence in editing replies and such.

stack points into the rules. Joe, please do first pass investigation, and pass along if necessary.

accepting bug

setting milestone to m9

I'll look into this bug. Reassigning to kin@netscape.com. Adding buster@netscape.com to Cc list.

Accepting bug.

We crash in nsHTMLEditRules::WillDeleteSelection() when there isn't a collapsed selection and the body node is either the StartParent, or EndParent, or both of the selection range. This is because the code always assumes that there is a blocknode parent element, which isn't true of the body, so the code never checked the to see if the result of mEditor->GetBlockNodeParent() was NULL. Here's the fix: Index: nsHTMLEditRules.cpp =================================================================== RCS file: /cvsroot/mozilla/editor/base/nsHTMLEditRules.cpp,v retrieving revision 1.37 diff -c -r1.37 nsHTMLEditRules.cpp *** nsHTMLEditRules.cpp 1999/07/26 18:05:41 1.37 --- nsHTMLEditRules.cpp 1999/08/02 21:46:36 *************** *** 440,447 **** // deleting across blocks // are the blocks of same type? ! nsCOMPtr<nsIDOMNode> leftParent = mEditor->GetBlockNodeParent(node); ! nsCOMPtr<nsIDOMNode> rightParent = mEditor->GetBlockNodeParent(endNode); // are the blocks siblings? nsCOMPtr<nsIDOMNode> leftBlockParent; --- 440,457 ---- // deleting across blocks // are the blocks of same type? ! nsCOMPtr<nsIDOMNode> leftParent; ! nsCOMPtr<nsIDOMNode> rightParent; ! ! if (IsBody(node)) ! leftParent = node; ! else ! leftParent = mEditor->GetBlockNodeParent(node); ! ! if (IsBody(endNode)) ! rightParent = endNode; ! else ! rightParent = mEditor->GetBlockNodeParent(endNode); // are the blocks siblings? nsCOMPtr<nsIDOMNode> leftBlockParent;

Hmmm, maybe the right thing to do is to call IsBlockNode() for both node and endNode instead of IsBody(). Joe, is that the right thing to do?

Fix checked in: mozilla/editor/base/nsHTMLEditRules.cpp - Modified GetPromotedPoint() to check for NULL in the case where aWhere == kEnd and GetChildAt() returns NULL.

verified in 8/10 build.