207572 - crash with caret being at invalid position

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect)

Description

[Kai Engert [:KaiE:]]

Using the patch in 200416, I can crash Mozilla using the editor, by loading
attachment 123082 [details] in the editor, hit DEL 4 times (which places the caret at the
famous invalid position halfways hidden) and hit arrow down.

The crash is in nsHTMLCSSUtils::IsCSSEditableProperty, line
  content->GetTag()

content is NULL, because aNode is of type nsHTMLDocument.

I suggest to add a null check after the attempt to obtain content, and returning
a failure if we get null.

Comment 1

[Kai Engert [:KaiE:]]

Attachment: Patch v1

This crash is an effect of text being placed after the </body> tag.
But I wonder if we should check in the following patch anyway.

Comment 2

[Kai Engert [:KaiE:]]

It's not likely that I will work on editor/selection bugs in the near future.
Mass assining my bugs to nobody.

Comment 3

[Joe Francis]

snarfing kaie's old bugs

Comment 4

[Joe Francis]

snarfing kaie's old bugs

Comment 5

[Wayne Mery (:wsmwk)]

fixed by timeless' patch in bug 214025?

Comment 6

[(no longer active)]

No longer happens on trunk.

Comment 7

[(no longer active)]

(fixed by this code: <http://mxr.mozilla.org/mozilla-central/source/editor/libeditor/html/nsHTMLCSSUtils.cpp#340>)