2017201 - Make `TextControlState` independent from `nsTextControlFrame`

Status: NEW

(Core :: DOM: Core & HTML, enhancement)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

After bug 2016280, the anonymous nodes in <input> and <textarea> won't be managed by nsTextControlFrame so that they can live as same as the text control element itself. Therefore, TextEditor can be live after TextControlState::UnbindFromFrame call. Thus, I believe that once the text control element has TextEditor, the element does not need to go back to the non-editor mode. Then, TextEditor and its transactions will stay in the memory, i.e., the footprint becomes worse, but that will preserve the undo transactions which may be important data for the users. So, we can fix the traditional dataloss bug.

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Bug 1826272 changed the lifecycle of TextInputListener.

I need to make TextInputSelectionController live longer, but it causes a crash here because nsFrameSelection::mPresShell is not cleared when the PresShell is destroyed. So, the crash is a UAF.