345600 - Crash [@ nsTextInputListener::UpdateTextInputCommands] using onselect and removing textarea

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, when selecting something in the textarea, Mozilla crashes.
This is not a (recent) regression, Mozilla1.7 also crashes.

Talkback ID: TB21243745K
nsTextInputListener::UpdateTextInputCommands   nsTextInputListener::NotifySelectionChanged   nsTypedSelection::NotifySelectionListeners   nsFrameSelection::NotifySelectionListeners   nsFrame::HandleEvent   nsPresShellEventCB::HandleEvent   nsEventDispatcher::Dispatch   PresShell::HandleEventInternal   PresShell::HandlePositionedEvent   PresShell::HandleEvent   nsViewManager::HandleEvent   nsViewManager::DispatchEvent   HandleEvent   nsWindow::DispatchEvent   nsWindow::DispatchMouseEvent

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch (for 1.8)

Simple null check is not enough, but propagating error up helps.
(Trunk patch would look almost the same, I just happened to have up-to-date 1.8 
on this laptop.)

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Good thing is that null check is enough on trunk.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

I checked in the null check to trunk. I hope that is ok.
But do we want to get the fix to 1.8 too? I guess yes.

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

Crash is Verified FIXED using build 2006-07-27-09 of SeaMonkey trunk under Windows XP with https://bugzilla.mozilla.org/attachment.cgi?id=230278&action=view as the testcase.

Comment 6

[Mike Schroepfer]

Comment on attachment 230286 [details] [diff] [review]
proposed patch (for 1.8)

approved by schrep for drivers