Closed Bug 1411345 Opened 2 years ago Closed 2 years ago
stack-overflow in [@ mozilla::HTMLEdit
Rules::Will Delete Selection]
The stack is this frame repeated... mozilla::HTMLEditRules::WillDeleteSelection(mozilla::dom::Selection*, short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2321:16
INFO: Last good revision: f5c43a9f8510ad50cf45248fe306707aa059b991 INFO: First bad revision: e05f84ea2a338e172a55a0898e3551fff61abb0a INFO: Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f5c43a9f8510ad50cf45248fe306707aa059b991&tochange=e05f84ea2a338e172a55a0898e3551fff61abb0a
Stack trace is here: https://crash-stats.mozilla.com/report/index/cf0039f8-c5c4-4359-95f9-6e1bb0171027
TryToJoinBlocks() doesn't return the result of MoveBlock(): https://searchfox.org/mozilla-central/rev/40e8eb46609dcb8780764774ec550afff1eed3a5/editor/libeditor/HTMLEditRules.cpp#2841-2846,2851 Then, WillDeleteSelection() believes that it does nothing. Then, it retries to delete selection again with recursive call and this causes the infinite loop.
Assignee: nobody → masayuki
Status: NEW → ASSIGNED
Although, the patch does NOT fix direct cause of the crash. I.e., not fixing the recursive call. However, such unexpected recursive calls are a bug of other methods which WillDeleteSelection() doesn't check the result strictly. So, this fix must be okay for now. (The root cause of this bug is, SplitNodeDeep() splits editing host whose style is inline unexpectedly. Then, another editing host cannot be joined to expected node since they are in different editing host.)
Comment on attachment 8923875 [details] Bug 1411345 - HTMLEditRules::GetHighestInlineParent() shouldn't return editing host even when it's the highest inline parent of aNode https://reviewboard.mozilla.org/r/195008/#review200350
Attachment #8923875 - Flags: review?(m_kato) → review+
Pushed by firstname.lastname@example.org: https://hg.mozilla.org/integration/autoland/rev/dd95e6f8c0b6 HTMLEditRules::GetHighestInlineParent() shouldn't return editing host even when it's the highest inline parent of aNode r=m_kato
You need to log in before you can comment on or make changes to this bug.