1625755 - crash @ mozilla::HTMLEditor::DoInsertHTMLWithContext

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect, P2)

Description

[Wayne Mery (:wsmwk)]

+++ This bug was initially created as a clone of Bug #1582215 +++

Bug #1582215 - fixed in Firefox 68.3esr and 71, had a big impact, but some crashes remain [1]. No testcase in this report, just drawing information from crash-stats:

• Firefox 73.0.1 bp-c125f9cd-2845-41df-9866-65c3f0200327
• Firefox 68.5.0esr bp-cd7d578d-3a7f-491b-9603-b50980200324
• Thunderbird 68.6.0 bp-60af8c35-468f-4394-9251-1cf180200326

[1] https://crash-stats.mozilla.org/signature/?product=Firefox&signature=mozilla%3A%3AHTMLEditor%3A%3ADoInsertHTMLWithContext&date=%3E%3D2020-03-22T04%3A21%3A00.000Z&date=%3C2020-03-29T04%3A21%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-date&page=1

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1625755 - Make `HTMLEditor::DoInsertHTMLWithContext()` check whether inserted content stays at expected point before modifying next insertion point r=m_kato!

I'm still not sure how the crash occurs especially on Thunderbird. However,
it could be possible if pointToInsert is modified with an orphan node (i.e.,
when pointToInsert.GetContainer() returns nullptr). Therefore, this patch
makes it check whether the inserted node stays at expected position or not,
and if it's not, make it keep inserting next content nodes to previous position
because it must look like odd that inserting to different position.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2839bb5efce7
Make `HTMLEditor::DoInsertHTMLWithContext()` check whether inserted content stays at expected point before modifying next insertion point r=m_kato

Comment 3

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/22668 for changes under testing/web-platform/tests

Comment 4

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream web-platform-tests status checks passed, PR will merge once commit reaches central.

Comment 5

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/2839bb5efce7

Comment 6

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot