230171 - UMR in nsSelectionState.cpp when backspacing in text field

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect)

Description

[Andrew Schultz]

this bug occurs with current linux CVS trunk.
to reproduce:
1. type text in any text field (form text box or URL bar).
2. backspace (this is ok)
3. backspace (bug)

Valgrind says:
Conditional jump or move depends on uninitialised value(s)
 PlaceholderTxn::Merge() (PlaceholderTxn.cpp:204)
 nsTransactionManager::EndTransaction() (nsTransactionManager.cpp:1179)
 nsTransactionManager::DoTransaction() (nsTransactionManager.cpp:141)
 nsEditor::DoTransaction() (nsEditor.cpp:532)
 nsEditor::DoTransaction() (nsEditor.cpp:476)
 nsEditor::DeleteSelectionImpl() (nsEditor.cpp:4336)
 nsPlaintextEditor::DeleteSelection() (nsPlaintextEditor.cpp:866)
 nsTextEditorKeyListener::KeyPress() (nsEditorEventListeners.cpp:202)

the real problem is here:
http://lxr.mozilla.org/mozilla/source/editor/libeditor/base/nsSelectionState.cpp#131
PRBool
nsSelectionState::IsCollapsed()
{ 
  if (1 != mArray.Count()) return PR_FALSE;
  nsRangeStore *item;
  item = (nsRangeStore*)mArray.ElementAt(0);
  if (!item) return PR_FALSE;
  nsCOMPtr<nsIDOMRange> range;
  item->GetRange(address_of(range));
  if (!range) return PR_FALSE;
  PRBool bIsCollapsed;
  range->GetCollapsed(&bIsCollapsed);
  return bIsCollapsed;
}    
----------------------------------------
range->GetCollapsed(&bIsCollapsed) returns failure and bIsCollapsed is
uninitialized, but it gets returned anyway.

Comment 1

[Andrew Schultz]

worksforme with current CVS