1134545 - Crash [@ nsHTMLEditor::RelativeFontChange] with selection not in document

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Comment 1

[Jesse Ruderman]

Attachment: stack (shown in two formats)

Comment 2

[Aryeh Gregor (:ayg) (no longer with Mozilla)]

Attachment: Patch

Caused by bug 1086349 part 8, which made calling CanContainTag with a null argument fatal.  Previously it would just return false, which is correct here.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2fd78e67637a

Comment 3

[(no longer active)]

[Tracking Requested - why for this release]:
This is a regression from bug 1086349 which landed in the 36 cycle.

Comment 4

[Lawrence Mandel [:lmandel] (use needinfo)]

Without any data on the prevalence of this crash, I find it hard to make an argument for taking a fix in the 37 RC. As such, I've marked 36 and 37 as wontfix. I have tracked 38+ as we should definitely take the crash fix in the next release.

Comment 5

[(no longer active)]

(In reply to Lawrence Mandel [:lmandel] (use needinfo) from comment #4)
> Without any data on the prevalence of this crash, I find it hard to make an
> argument for taking a fix in the 37 RC. As such, I've marked 36 and 37 as
> wontfix. I have tracked 38+ as we should definitely take the crash fix in
> the next release.

Looks like crash-stats doesn't have this signature, so that's fine.

Comment 6

[Aryeh Gregor (:ayg) (no longer with Mozilla)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/e7688fa5ba48

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Backed out for browser_vimemacs.js crashes.
https://hg.mozilla.org/integration/mozilla-inbound/rev/bf5843b1b295

https://treeherder.mozilla.org/logviewer.html#?job_id=8043037&repo=mozilla-inbound

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Wasn't yours. Re-landed, sorry for the churn.
https://hg.mozilla.org/integration/mozilla-inbound/rev/5abf1cce5ebe

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5abf1cce5ebe

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Aryeh, can we have an uplift request to beta (38)? Thanks

Comment 11

[Aryeh Gregor (:ayg) (no longer with Mozilla)]

Comment on attachment 8582393 [details] [diff] [review]
Patch

Sorry for the delay, I was away from computers for a week.

Approval Request Comment
[Feature/regressing bug #]: Bug 1086349
[User impact if declined]: Crash under circumstances that seem unlikely to occur in the wild, bug was caught by fuzz-testing
[Describe test coverage new/current, TreeHerder]: Crashtest for the bug is checked in, general editor test coverage is fairly decent for a large subset of real-world cases
[Risks and why]: Very low risk, just adds a null check
[String/UUID change made/needed]: None

Comment 12

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8582393 [details] [diff] [review]
Patch

Thanks. Should be in 38 beta 4.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/5f042fe29707