Open Bug 1605741 Opened 3 months ago Updated 3 months ago

crash near null in [@ mozilla::HTMLEditor::NodeIsBlockStatic]

Categories

(Core :: DOM: Editor, defect, P3)

defect

Tracking

()

Tracking Status
firefox73 --- affected

People

(Reporter: tsmith, Assigned: m_kato)

References

(Blocks 1 open bug)

Details

(Keywords: crash, csectype-nullptr, testcase)

Crash Data

Attachments

(1 file)

Attached file testcase.html

Reduced with m-c 20191220-1759c1b2fa6b

editor/libeditor/HTMLEditSubActionHandler.cpp:3432:38: runtime error: reference binding to null pointer of type 'const nsINode'
    #0 0x7f51ecc5be0b in mozilla::HTMLEditor::InsertBRElementIfHardLineIsEmptyAndEndsWithBlockBoundary(mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&) editor/libeditor/HTMLEditSubActionHandler.cpp:3432:8
    #1 0x7f51ecc723ff in mozilla::HTMLEditor::HandleDeleteCollapsedSelectionAtTextNode(short, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&) editor/libeditor/HTMLEditSubActionHandler.cpp:2643:8
    #2 0x7f51ecc6fc2b in mozilla::HTMLEditor::HandleDeleteAroundCollapsedSelection(short, short) editor/libeditor/HTMLEditSubActionHandler.cpp:2478:31
    #3 0x7f51ecc6cfc8 in mozilla::HTMLEditor::HandleDeleteSelectionInternal(short, short) editor/libeditor/HTMLEditSubActionHandler.cpp:2419:33
    #4 0x7f51ecc6c6db in mozilla::HTMLEditor::HandleDeleteSelection(short, short) editor/libeditor/HTMLEditSubActionHandler.cpp:2288:7
    #5 0x7f51ecd18d21 in mozilla::TextEditor::DeleteSelectionAsSubAction(short, short) editor/libeditor/TextEditor.cpp:664:7
    #6 0x7f51ecd1de93 in mozilla::TextEditor::DeleteSelectionAsAction(short, short, nsIPrincipal*) editor/libeditor/TextEditor.cpp:636:17
    #7 0x7f51e880ef3d in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) dom/base/Document.cpp:4807:26
    #8 0x7f51e9e20ebd in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) objdir-ff-ubsan/dom/bindings/DocumentBinding.cpp:3429:36
    #9 0x7f51ea2c9b11 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp:3151:13
    #10 0x7f51f0ecf922 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) js/src/vm/Interpreter.cpp:452:13
    #11 0x7f51f0ecf922 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:544:12
    #12 0x7f51f0ed095a in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) js/src/vm/Interpreter.cpp:608:10
    #13 0x7f51f0eba583 in Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3042:16
    #14 0x7f51f0e9dce5 in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:424:10
    #15 0x7f51f0ecf7ad in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:580:13
    #16 0x7f51f0ed095a in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) js/src/vm/Interpreter.cpp:608:10
    #17 0x7f51f0ed0b4d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) js/src/vm/Interpreter.cpp:625:8
    #18 0x7f51f113f4eb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp:2753:10
    #19 0x7f51e9dfb607 in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) objdir-ff-ubsan/dom/bindings/EventHandlerBinding.cpp:267:37
    #20 0x7f51ea9efccf in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) objdir-ff-ubsan/dist/include/mozilla/dom/EventHandlerBinding.h:364:12
    #21 0x7f51ea9d41cd in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) dom/events/JSEventHandler.cpp:201:12
    #22 0x7f51ea9adf24 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) dom/events/EventListenerManager.cpp:1071:22
    #23 0x7f51ea9af11d in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) dom/events/EventListenerManager.cpp:1263:17
    #24 0x7f51ea9e23b7 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) dom/events/EventDispatcher.cpp:356:17
    #25 0x7f51ea9a1c22 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) dom/events/EventDispatcher.cpp:558:16
    #26 0x7f51ea9a4868 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) dom/events/EventDispatcher.cpp:1056:11
    #27 0x7f51ecfdf691 in nsDocumentViewer::LoadComplete(nsresult) layout/base/nsDocumentViewer.cpp:1142:7
    #28 0x7f51f019bdcb in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) docshell/base/nsDocShell.cpp:6116:20
    #29 0x7f51f019b1e2 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) docshell/base/nsDocShell.cpp:5899:7
    #30 0x7f51f019d99f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) docshell/base/nsDocShell.cpp
    #31 0x7f51e7134e6d in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) uriloader/base/nsDocLoader.cpp:1347:3
    #32 0x7f51e71341b2 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) uriloader/base/nsDocLoader.cpp:906:14
    #33 0x7f51e7131757 in nsDocLoader::DocLoaderIsEmpty(bool) uriloader/base/nsDocLoader.cpp:726:9
    #34 0x7f51e713344d in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) uriloader/base/nsDocLoader.cpp:614:5
    #35 0x7f51e7133f9c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) uriloader/base/nsDocLoader.cpp
    #36 0x7f51e459f4a7 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) netwerk/base/nsLoadGroup.cpp:594:22
    #37 0x7f51e45a1766 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) netwerk/base/nsLoadGroup.cpp:501:10
    #38 0x7f51e88364dd in mozilla::dom::Document::DoUnblockOnload() dom/base/Document.cpp:10663:18
    #39 0x7f51e880a2d2 in mozilla::dom::Document::UnblockOnload(bool) dom/base/Document.cpp:10595:9
    #40 0x7f51e881ed7a in mozilla::dom::Document::DispatchContentLoadedEvents() dom/base/Document.cpp:7272:3
    #41 0x7f51e88fbcba in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() objdir-ff-ubsan/dist/include/nsThreadUtils.h:1217:13
    #42 0x7f51e42ea80c in mozilla::SchedulerGroup::Runnable::Run() xpcom/threads/SchedulerGroup.cpp:282:20
    #43 0x7f51e431cf44 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1241:14
    #44 0x7f51e4323a6e in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:486:10
    #45 0x7f51e572144e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:87:21
    #46 0x7f51e5563d14 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290:3
    #47 0x7f51ecad261a in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:137:27
    #48 0x7f51f0bcb939 in XRE_RunAppShell() toolkit/xre/nsEmbedFunctions.cpp:946:20
    #49 0x7f51e5722a61 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:237:9
    #50 0x7f51e5563d14 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290:3
    #51 0x7f51f0bcad87 in XRE_InitChildProcess(int, char**, XREChildData const*) toolkit/xre/nsEmbedFunctions.cpp:781:34
    #52 0x55e7d8bfd1c5 in content_process_main(mozilla::Bootstrap*, int, char**) browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #53 0x55e7d8bfd3ef in main browser/app/nsBrowserApp.cpp:303:18
Flags: in-testsuite?

A Pernosco session is available here: https://pernos.co/debug/iVUynKCPyKWUuTgfVUqtnQ/index.html

Also I'm not sure if this is a dupe of bug 1578916.

Perhaps whoever looks at bug 1578916 could take a look at this too.

Flags: needinfo?(m_kato)
Priority: -- → P3
Assignee: nobody → m_kato
Flags: needinfo?(m_kato)
You need to log in before you can comment on or make changes to this bug.