1254975 - NULL pointer crash in nsEditor::IsTextNode

Status: RESOLVED DUPLICATE of bug 1317718

(Core :: DOM: Editor, defect)

Description

[SkyLined]

Attachment: repro.html

Javascript can cause a NULL pointer dereference crash in editing code.

Repro.html:
<script>
  onload = function () {
    document.documentElement.contentEditable = 'true';
    document.removeChild(document.documentElement);
    document.designMode = 'on';
    document.execCommand('indent');
  };
</script>

Relevant code:
https://dxr.mozilla.org/mozilla-central/source/editor/libeditor/nsHTMLEditRules.cpp#5781
    for (int32_t i = 0; i < rangeCount; i++) {
      RefPtr<nsRange> r = aArrayOfRanges[i];
      nsCOMPtr<nsIContent> endParent = do_QueryInterface(r->GetEndParent());
      if (!mHTMLEditor->IsTextNode(endParent)) {
=> endParent is NULL

https://dxr.mozilla.org/mozilla-central/source/editor/libeditor/nsEditor.cpp#3628
bool
nsEditor::IsTextNode(nsINode *aNode)
{
  return aNode->NodeType() == nsIDOMNode::TEXT_NODE;
=> aNode is NULL.

There is a reference to passing a NULL pointer to this function in bug 671152 as well, but otherwise it appears unrelated.

Comment 1

[Andrew Overholt [:overholt]]

The Editor module is unfortunately rather unowned ATM. We're working on fixing the situation and will follow up when we have news.