Closed
Bug 1264932
Opened 8 years ago
Closed 8 years ago
AVR.NULL 652.661 @ firefox.exe!xul.dll!nsContentIterator..NextNode
Categories
(Core :: DOM: Core & HTML, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1258576
People
(Reporter: abbGZcvu_bugzilla.mozilla.org, Unassigned)
Details
(Keywords: crash, testcase)
Attachments
(2 files)
NULL pointer reference in nsContentIterator..NextNode
Repro:
<?><!DOCTYPE><o contenteditable ><script>
oRange=getSelection().getRangeAt(0);
oRange.setStartBefore(document.doctype);
document.replaceChild(document.createProcessingInstruction("x", ""), document.doctype);
oRange.cloneRange().extractContents();
oRange.toString();
</script>
I believe the crash happens because `parent` is NULL here:
https://dxr.mozilla.org/mozilla-central/source/dom/base/nsContentIterator.cpp#799
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•