1136735 - crash in nsINode::GetFirstElementChild() const with selectioncaret.enabled turned on on desktop

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[(no longer active)]

This bug was filed from the Socorro interface and is 
report bp-feba3b8e-65c6-4877-8cdb-150482150225.
=============================================================

Steps to reproduce:
1. Enable selectioncaret.enabled on desktop (I tested on Mac), and restart.
2. In an open window, click on the location bar.

This is caused by PresShell::GetSelectionCaretsStartElement() returning null, and the caller (SelectionCarets::GetStartFrameRectInner) not testing its return value.

Ting-Yu, do you have time to fix this?  Should be an easy fix.  Thanks!

Comment 1

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

Ehsan, I can reproduce this locally. Investigating.

Comment 2

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

Attachment: Ignore events if there's no SelectionCarets elements. (v1)

UL has no CanvasFrame. Hence no SelectionCarets elements.
SelectionCarets should ignore the events if it cannot get its elements.

Comment 3

[Morris Tseng [:mtseng] [:Morris] (Inactive)]

Comment on attachment 8569593 [details] [diff] [review]
Ignore events if there's no SelectionCarets elements. (v1)

Looks good. Do we need same check in TouchCaret?

Comment 4

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

(In reply to Morris Tseng [:mtseng] from comment #3)
> Comment on attachment 8569593 [details] [diff] [review]
> Ignore events if there's no SelectionCarets elements. (v1)
> 
> Looks good. Do we need same check in TouchCaret?

TouchCaret is fine. It's protected by IsDisplayable() at the beginning of HandleEvent().

[1] http://hg.mozilla.org/mozilla-central/annotate/9b077c6f3d02/layout/base/TouchCaret.cpp#l594

Comment 5

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

https://tbpl.mozilla.org/?tree=Try&rev=1fb03558f8e8

Comment 6

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4041a3d9019f

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b1f4b4120e21

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b1f4b4120e21