1722698 - Crash in [@ InvalidArrayIndex_CRASH | mozilla::SelectionState::SaveSelection]

Status: RESOLVED DUPLICATE of bug 1719669

(Core :: DOM: Editor, defect, P3)

Description

[Wayne Mery (:wsmwk)]

First crash appears 91.0a1 buildid 20210706100346

Crash report: https://crash-stats.mozilla.org/report/index/0eff4181-6e9c-4b5a-89c1-9691c0210722

MOZ_CRASH Reason: ElementAt(aIndex = 4294967295, aLength = 0)

Top 10 frames of crashing thread:

0 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:28
1 xul.dll mozilla::SelectionState::SaveSelection editor/libeditor/SelectionState.cpp:68
2 xul.dll mozilla::PlaceholderTransaction::RememberEndingSelection editor/libeditor/PlaceholderTransaction.cpp:315
3 xul.dll mozilla::EditorBase::EndPlaceholderTransaction editor/libeditor/EditorBase.cpp:1231
4 xul.dll mozilla::EditorBase::DeleteSelectionAsAction editor/libeditor/EditorBase.cpp:4232
5 xul.dll mozilla::EditorBase::HandleKeyPressEvent editor/libeditor/EditorBase.cpp:4972
6 xul.dll mozilla::EditorEventListener::KeyPress editor/libeditor/EditorEventListener.cpp:621
7 xul.dll mozilla::EventListenerManager::HandleEventSubType dom/events/EventListenerManager.cpp:1114
8 xul.dll mozilla::EventListenerManager::HandleEventInternal dom/events/EventListenerManager.cpp:1305
9 xul.dll mozilla::EventTargetChainItem::HandleEvent dom/events/EventDispatcher.cpp:348

Mac crash bp-d98bf046-6ebe-47ec-b17c-1ce0e0210727

Comment 1

[José M. Muñoz]

Editor code, last changed in bug 1714914 and bug 1719669, the latter after the first crash.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Interesting. There is only one crash report from 89.
https://crash-stats.mozilla.org/report/index/6c0a5403-5243-4a87-81c7-14e390210625

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

It seems that this is a dup of bug 1719669.
This crash report indicates the line 54.

It makes sense if the patch for bug 1719669 is merged:
https://hg.mozilla.org/releases/mozilla-beta/file/71670cedaf26214f3bcb8562a445cf1ef24f4db6/editor/libeditor/SelectionState.cpp#l54

However, with the latest beta for mozilla-central, it does not make sense:
https://hg.mozilla.org/releases/mozilla-beta/file/c289b82e40d96e7f4166abb156869f83c48ce414/editor/libeditor/SelectionState.cpp#l54

Could you check whether Thunderbird is built with the fix or not?

Comment 4

[José M. Muñoz]

TB beta is built based on M-B depending its state at the time. The fix from bug 1719669 is on M-B since FF 91 beta 4.

All Thunderbird betas after 19 Jul 2021 included FF 91 beta 4, see:
https://hg.mozilla.org/releases/comm-beta/rev/1d0432f53837f80b0e11069f5e1b82eea0bb59d3

The reports from comment #0 are both for builds before 19 Jul 2021.

Summary: This crash should not happen on TB beta after that date. I suggest to close this as duplicate of bug 1719669.

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Thank you, I mark this as a dup of bug 1719669. Feel free to reopen this if crash reports coming from newer builds.