537046 - crash in [@ nsWSRunObject::GetWSBoundingParent() ]

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect)

Description

[Jeff Muizelaar [:jrmuizel]]

The following page crashes after editing the text by hitting enter twice.

http://people.mozilla.com/~jmuizelaar/editor/crash.html

This happens in 3.6 and 3.7 but not in 3.5.

http://crash-stats.mozilla.com/report/index/ee9cfcf6-9d49-4b12-94f9-39bba2091228

This change:
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/59cb55e08d1f by Mats was the last to touch the crashing area so perhaps it's to blame.

There have only been two other crashes so this probably doesn't need to block 1.9.2?

Comment 1

[(no longer active)]

The page in comment 0 does not crash for me on trunk or 3.6.  Jeff, can you please specify more details on how to reproduce the crash?  FWIW, I tried loading the test case and typing in some text.

Comment 2

[(no longer active)]

Jeff mentioned to me that the crash happens when pressing Enter twice in the editable area.  I think I have a patch for that, just testing it out a bit...

Comment 3

[(no longer active)]

Attachment: Patch (v1)

The problem is that IsBlockNode returns false is the node passed to it is null, and we tried to dereference that pointer inside the loop...  The fix is simple enough, just null-check the pointer.

Comment 4

[Peter Van der Beken [:peterv]]

Comment on attachment 419948 [details] [diff] [review]
Patch (v1)

Return early if mNode is null, instead of doubling the null-checks in the loop (mParent is already null-checked).

Comment 5

[(no longer active)]

Attachment: Patch to land

Modified patch according to comment 4.

Comment 6

[(no longer active)]

http://hg.mozilla.org/mozilla-central/rev/5a4114d6608b

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 426733 [details] [diff] [review]
Patch to land

Needs a crash test, I think?

Comment 8

[(no longer active)]

Attachment: Crash test

This crash test basically mimics the steps listed in comment 0.

Comment 9

[Mike Beltzner [:beltzner, not reading bugmail]]

We'll approve this for landing when the crash test is approved; peterv, can you help us out a bit?

Comment 10

[(no longer active)]

Crash test landed as http://hg.mozilla.org/mozilla-central/rev/7788846fd5d5.

Comment 11

[LegNeato]

Comment on attachment 426733 [details] [diff] [review]
Patch to land

a=LegNeato for 1.9.2.5. Please ONLY land this on mozilla-1.9.2 default, as we
are still working on 1.9.2.4 on the relbranch

Comment 12

[(no longer active)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/14ccbee75b85
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/424313036030

Comment 13

[Tony Chung [:tchung]]

Verified fix in Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.7pre) Gecko/20100630 Namoroka/3.6.7pre
and 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.7pre) Gecko/20100630 Namoroka/3.6.7pre

also trunk:
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:2.0b2pre) Gecko/20100630 Minefield/4.0b2pre