16285 - Crash on doing Ctrl-C ( twice ) in editor

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P3)

Description

[harishd]

#1. To reproduce the crash do the following.

1. Open up editor and select the contents ( completely ) of the
   opening document ( initial editor test document ).
2. Now do Ctrl-C twice ( this is also a bug ).

You should see a crash in

void nsHTMLContentSinkStream::EnsureBufferSize(PRInt32 aNewSize)
{
  if (mBufferSize < aNewSize)       <----- mBuffSize = 3 and aNewSize = 4
  {
    delete [] mBuffer;              <----- mBuffer had a string value "hr"

....

Unable to provide the stack because the crash happend when my copy-buffer was in
use and therefore wasn't able to attach the stack to the report.

#2. There is no code to delete mBuffer in nsHTMLContentSinkStream destructor.

Comment 1

[Kathleen :Brade]

reassign to [e-mail]

Sujay--can you reproduce this bug on any other platforms?

Comment 2

[sujay]

I can't reproduce this...but now we don't load the initial
editor test page so I tried it out on a bare minimum loaded
page with text...Harish, is this still happening for you?

Comment 3

[harishd]

Attachment: Here's the intial editor page.

Comment 4

[harishd]

Yes, it still crashes for me.

Comment 5

[Akkana Peck]

I'm not seeing this on Linux, but there are known problems with Windows
copy/paste, and perhaps the crash is related to that.  But I'll keep this at
least 'til I fix the problem with not deleting the buffer.

Comment 6

[Akkana Peck]

Cc'ing Pinkerton -- this only happens on windows, and it's possible that it's
resulting from memory corruption from problems in the Windows clipboard code.

Comment 7

[Akkana Peck]

Adding Rick to cc list -- Rick, if you find yourself doing a Windows Purify run
looking at the parser library, we'd love to know what happens when you hit ^C
twice after selecting all the text in the document.

Comment 8

[Akkana Peck]

Harish just checked in a fix for this.

Comment 9

[harishd]

Tree is red. I haven't checked in the fix yet.  Will checkin as soon as the tree
turns green.

I'll close the bug after my checkin.

Comment 10

[harishd]

Ok, fix is in...  Marking bug FIXED.

Comment 11

[sujay]

verified in 10/21 build.

Comment 12

[harishd]

Akkana, I'm reopening this bug because the crash started to happen again. We
expected this...didn't we??

Comment 13

[Akkana Peck]

I hope to check in the encoder fix I've been working on with Naoki today.  That
changes the code and should be a bit more reliable; with any luck it'll fix this
problem too.

Comment 14

[harishd]

Not crashing anymore ( tested with akkana's recent changes ).

Marking but FIXED.

Comment 15

[sujay]

verified in 11/4 build.

Comment 16

[Pulsebot]

Pushed by ffxbld-merge:
https://hg.mozilla.org/releases/mozilla-beta/rev/2ba6d716ab91
[fenix] For https://github.com/mozilla-mobile/fenix/issues/9548 - Ability to rename top sites (https://github.com/mozilla-mobile/fenix/pull/16285)