1024428 - [WebComponents] Browser crashes when <input type="range" /> in shadow-dom

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Wilson Page [:wilsonpage]]

EXAMPLE

http://jsbin.com/hutas/2/quiet

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

WFM.  Needs a crash report.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Couldn't reproduce on linux, but testing a debug build in a minute.

Comment 3

[Wilson Page [:wilsonpage]]

This is on Mac Nightly.

(In reply to Kyle Huey [:khuey] ([e-mail]) from comment #1)
> WFM.  Needs a crash report.

Where do I get a crash report from?

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Couldn't reproduce with a debug build either, and no assertions or warnings either.


For a crash report - you should get one when Nightly crashes, and
about:crashes has the id for it.

Comment 5

[Wilson Page [:wilsonpage]]

(In reply to Olli Pettay [:smaug] from comment #4)
> Couldn't reproduce with a debug build either, and no assertions or warnings
> either.
> 
> 
> For a crash report - you should get one when Nightly crashes, and
> about:crashes has the id for it.

Here's the crash-report: https://crash-stats.mozilla.com/report/index/a6967bbe-a9a1-4d87-ad1d-08db12140612

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Oh, the testcase looks wrong. It has type="text"

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Attachment: testcase

Comment 8

[Boris Zbarsky [:bzbarsky]]

> nsRangeFrame::MakeAnonymousDiv

> nsCOMPtr<nsIDocument> doc = mContent->GetDocument();

doc is now null.  That's not OK for something with a frame.  If it's got a frame, it needs to have a non-null GetCurrentDoc().  Layout code depends on that all over...

Comment 9

[Boris Zbarsky [:bzbarsky]]

And ccing Jonas, since he apparently argued for this state of things.

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

We need some other fixes to get the look right, but lets start with this.

Comment 11

[William Chen [:wchen]]

Comment on attachment 8463607 [details] [diff] [review]
patch

Review of attachment 8463607 [details] [diff] [review]:
-----------------------------------------------------------------

This fixes the crash, but we still need to figure out what we need to do to make to form control actually work as expected.

Comment 12

[Olli Pettay [:smaug][[e-mail]]]

well, range does work. It just looks a bit wrong during dragging

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Oh, the odd looking painting isn't even related to shadow DOM. It happens on linux in normal dom too.

Comment 14

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for checkin

Comment 15

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f502be80b687

Comment 16

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/f502be80b687

Comment 17

[Jason Smith [:jsmith]]

Marking verified since there's no QA support planned to be done here, so verification isn't needed here.