Closed Bug 2782 Opened 26 years ago Closed 25 years ago

no way to tell editable content from non-editable content

Categories

(Core :: Layout, defect, P2)

Product:
Core
Component:
Layout
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: buster, Assigned: buster)

References

(
URL
)

Details

open the test case. start the editor. click past the last character in the first line, so the caret is at the end of the line press DEL. crash. What's happening in the editor sees that it's at the end of a text node, and gets the next node (because the DEL is LTR.) The next node is a text node with one character, a newline. The newline is removed via nsIDOMCharacterData::DeleteData(0,1). The crash happens on the subsequent reflow. test case: <html><body><P>hello <b>bold as the wild blue yonder</b> out there</P> <p>inbetween text</p>123<B>BOLD</B>456 <hr align=left width=100%> <img src="house.gif"> <table width=500 border><tr><td>here is some text in a table</td></tr></table> </body></html> stack: nsBaseIBFrame::PlaceLine(nsBlockReflowState & {...}, nsLineBox * 0x0127b520, int & 0) line 2593 nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0127b520, int & 0) line 1677 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1328 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4868 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x01276f54, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 803 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01276f54, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4501 + 25 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01276f50, const nsRect & {...}, int 1, nsMargin & {...}, unsigned int & 0) line 155 + 39 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x01277210, int & 1) line 2126 + 45 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01277210, int & 1) line 1592 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1328 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4868 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x01276d94, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 803 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01276d94, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4501 + 25 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x01276d94, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 508 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x01276d90, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes RootFrame::Reflow(RootFrame * const 0x01276af4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 237 nsContainerFrame::ReflowChild(nsIFrame * 0x01276af0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsScrollFrame::Reflow(nsScrollFrame * const 0x01276244, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 334 nsContainerFrame::ReflowChild(nsIFrame * 0x01276240, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes ViewportFrame::Reflow(ViewportFrame * const 0x01275724, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 341 nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0127b3f0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 165 PresShell::ProcessReflowCommands(PresShell * const 0x01275520) line 973 PresShell::ExitReflowLock(PresShell * const 0x01275520) line 522 PresShell::ContentChanged(PresShell * const 0x01275528, nsIDocument * 0x012ba290, nsIContent * 0x01277b8c, nsISupports * 0x00000000) line 1101 nsDocument::ContentChanged(nsDocument * const 0x012ba290, nsIContent * 0x01277b8c, nsISupports * 0x00000000) line 1117 nsGenericDOMDataNode::ReplaceData(unsigned int 0, unsigned int 1, const nsString & {...}) line 348 nsGenericDOMDataNode::DeleteData(unsigned int 0, unsigned int 1) line 298 + 20 bytes nsTextNode::DeleteData(nsTextNode * const 0x01277b80, unsigned int 0, unsigned int 1) line 52 + 22 bytes DeleteTextTxn::Do() line 45 EditAggregateTxn::Do() line 55 + 11 bytes nsTransactionItem::Do() line 70 + 17 bytes nsTransactionManager::Do(nsITransaction * 0x0127b200) line 112 + 11 bytes nsEditor::Do(nsITransaction * 0x0127b200) line 585 + 21 bytes nsEditor::DeleteSelection(nsIEditor::Direction eLTR) line 894 + 15 bytes nsEditorKeyListener::KeyDown(nsIDOMEvent * 0x0127b1c0) line 145 nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012fdc8, nsIDOMEvent * * 0x0012fc14, nsEventStatus & nsEventStatus_eIgnore) line 379 + 17 bytes nsDocument::HandleDOMEvent(nsDocument * const 0x012ba290, nsIPresContext & {...}, nsEvent * 0x0012fdc8, nsIDOMEvent * * 0x0012fc14, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 1636 nsHTMLHtmlElement::HandleDOMEvent(nsHTMLHtmlElement * const 0x012ba90c, nsIPresContext & {...}, nsEvent * 0x0012fdc8, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 173 + 41 bytes PresShell::HandleEvent(PresShell * const 0x01275524, nsIView * 0x01276ba0, nsGUIEvent * 0x0012fdc8, nsEventStatus & nsEventStatus_eIgnore) line 1423 + 34 bytes nsView::HandleEvent(nsView * const 0x01276ba0, nsGUIEvent * 0x0012fdc8, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 789 nsView::HandleEvent(nsView * const 0x012763b0, nsGUIEvent * 0x0012fdc8, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore) line 772 nsViewManager::DispatchEvent(nsViewManager * const 0x01275120, nsGUIEvent * 0x0012fdc8, nsEventStatus & nsEventStatus_eIgnore) line 823
I've made a page containing Steve's test case -- see URL. I don't see this crash on this morning's Linux build. But I think I broke backward-delete-character when the selection is collapsed, which might be getting in the way of reproducing this bug. I'm looking into that right now.
Just in case anyone was waiting, delete-backward-char was fixed Friday.
Setting all current Open Critical and Major to M3
Assignee: kipp → akkana
I can't get it to crash with todays code (2/9/98) - do you have another test case or can I close this?
Assignee: akkana → buster
I'm not sure why this got assigned back to me ... maybe Steve can comment on whether it's still happening (I never actually saw the crash).
Assignee: buster → kipp
the editor changed the way delete was done, now it's changed back. retry the test and enjoy the crashing experience.
Assignee: kipp → buster
I just checked in a partial fix to this problem - there was a bad QueryInterface in the PresShell code when dealing with the mSelection instance variable. Now we crash in the editors Transaction code so I'm reassigning it to steve. Tag you're it! :-)
Status: NEW → ASSIGNED
per leger, assigning QA contacts to all open bugs without QA contacts according to list at http://bugzilla.mozilla.org/describecomponents.cgi?product=Browser
Severity: critical → normal
Status: ASSIGNED → NEW
Priority: P1 → P2
what happens now, the next object in the DOM tree is still a text node with a single newline for content. This newline is deleted, but of course that has no effect on the layout of the document. So now this is just an editing bug, and I'll work with Kipp to try to figure out how the editor is supposed to know that a text node is extraneous.
changed summary to reflect the new nature of this bug. It is no longer a crash, but rather a design flaw that makes the delete appear to have no effect. We are deleting something, but it's hidden content that has no layout or rendering effect. We currently have no good way to know if content should be ignored by the editor or not. I assume standard iterations through the DOM as manifest by javascript will have the same problem. Set priority and severity. Added kipp, troy, and vidur to cc field.
changed summary to reflect the new nature of this bug. It is no longer a crash, but rather a design flaw that makes the delete appear to have no effect. We are deleting something, but it's hidden content that has no layout or rendering effect. We currently have no good way to know if content should be ignored by the editor or not. I assume standard iterations through the DOM as manifest by javascript will have the same problem. Set priority and severity. Added kipp, troy, and vidur to cc field.
Summary: incremental content update causes crash → no way to tell editable content from non-editable content
Target Milestone: M3 → M4
we have a *bad* work around that is good enough for text editing, so milestone changed to M4.
Target Milestone: M4 → M5
target milestone m5
changed misc bugs to M6
Target Milestone: M6 → M8
set to M8
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
fixed. the editor now has a predictable notion of what is editable and the editor code is using nsEditor::IsEditable in all the right places.
Status: RESOLVED → VERIFIED
Marking as verified fixed.
You need to log in before you can comment on or make changes to this bug.