1662483 - Crash in [@ nsTextControlFrame::UpdatePlaceholderText]

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Frequent crash from the changes in bug 1658302.

Crash report: https://crash-stats.mozilla.org/report/index/d35d7e9c-2912-4aeb-8feb-5845b0200901

Top 9 frames of crashing thread:

0 xul.dll nsTextControlFrame::UpdatePlaceholderText layout/forms/nsTextControlFrame.cpp:510
1 xul.dll nsTextControlFrame::PlaceholderChanged layout/forms/nsTextControlFrame.cpp:496
2 xul.dll mozilla::dom::HTMLInputElement::AfterSetAttr dom/html/HTMLInputElement.cpp:1289
3 xul.dll mozilla::dom::Element::SetAttrAndNotify dom/base/Element.cpp:2359
4 xul.dll mozilla::dom::Element::SetAttr dom/base/Element.cpp:2216
5 xul.dll mozilla::dom::Element::SetAttribute dom/base/Element.cpp:1294
6 xul.dll mozilla::dom::Element_Binding::setAttribute dom/bindings/ElementBinding.cpp:1345
7 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3227
8  @0xbf8e2be9 

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1662483 - Dynamic placeholder changes after adding the placeholder attribute shouldn't crash. r=masayuki,smaug

Comment 2

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Fuzzers are hitting this too.

Comment 3

[Tyson Smith [:tsmith]]

Comment on attachment 9173470 [details]
testcase.html

><script>
>window.onload = () => {
>  a.placeholder = "x"
>  a.placeholder = ""
>}
></script>
><textarea id="a">a</textarea>

Comment 4

[Tyson Smith [:tsmith]]

Sorry about that, I should have looked at the patch first. Also fuzzing builds we not being updated that's why there was such a delay.

Comment 5

[Andreea Pavel [:apavel]]

Fixed by backout: https://hg.mozilla.org/mozilla-central/rev/4a18696ce81f949bd4fea1a68966a4e335d8fbad

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

For the record, the patch here shall still land once reviewed (together with the re-land of bug 1658302).