1953933 - Crash in [@ mozilla::TextEditor::GetTextNode]

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[Dianna Smith [:diannaS]]

Crash report: https://crash-stats.mozilla.org/report/index/99981d0a-fcbb-4e58-b0c6-e361c0250313

MOZ_CRASH Reason:

MOZ_DIAGNOSTIC_ASSERT(GetRoot())

Top 10 frames:

0  xul.dll  mozilla::TextEditor::GetTextNode()  editor/libeditor/TextEditor.h:267
0  xul.dll  mozilla::TextEditor::GetTextNode() const  editor/libeditor/TextEditor.h:276
0  xul.dll  mozilla::TextEditor::IsEmpty() const  editor/libeditor/TextEditor.cpp:483
1  xul.dll  mozilla::EditorBase::ComputeValueInternal(nsTSubstring<char16_t> const&, unsi...  editor/libeditor/EditorBase.cpp:1430
2  xul.dll  mozilla::TextEditor::ComputeTextValue(unsigned int, nsTSubstring<char16_t>&) ...  editor/libeditor/TextEditor.h:198
3  xul.dll  mozilla::TextControlState::GetValue(nsTSubstring<char16_t>&, bool, bool) const  dom/html/TextControlState.cpp:2537
4  xul.dll  mozilla::TextControlState::PrepareEditor(nsTSubstring<char16_t> const*)  dom/html/TextControlState.cpp:1776
5  xul.dll  mozilla::PrepareEditorEvent::Run()  dom/html/TextControlState.cpp:1576
6  xul.dll  nsContentUtils::RemoveScriptBlocker()  dom/base/nsContentUtils.cpp:6567
6  xul.dll  nsAutoScriptBlocker::~nsAutoScriptBlocker()  dom/base/nsContentUtils.h:3784

Comment 1

[Dianna Smith [:diannaS]]

:masayuki could this have been caused by bug 1717155?

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Ah, yeah, TextEditor::IsEmpty() starts using GetTextNode().

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1953933 - Make `TextEditor::IsEmpty()` return `true` if it's not been initialized yet r=m_kato!

GetTextNode() requires that the instance has already been initialized since
it requires the native anonymous <div>. And IsEmpty() is a public method.
Therefore, it should return true if there is no editor root, i.e., when it's
not been initialized yet after creation or destroyed.

Additionally, TextControlState::GetValue() should call
TextEditor::ComputeTextValue() if the editor has not been initialized because
it requires the native anonymous subtree to compute the value. I'm not sure
whether this is a bug when <textarea> is being initialized.
(I guess that it should get the default value of the text control element or
mValue in the case, but we should do that in another bug separately.)

I couldn't find the crash testcase, so, this does not contain a new test.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/db49d0ca59cb
Make `TextEditor::IsEmpty()` return `true` if it's not been initialized yet r=m_kato

Comment 5

[amarc]

https://hg.mozilla.org/mozilla-central/rev/db49d0ca59cb