375093 - Crash [@ nsTypedSelection::ScrollIntoView] when right-clicking paste in input which then gets destroyed oninput

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, when pasting something in the text input with the context menu, the surrounding iframe gets destroyed.
This crashes Mozilla, it also crashes current branch builds, so I'm marking this security sensitive for now.

Talkback ID: TB30519454E
nsTypedSelection::ScrollIntoView  [mozilla/layout/generic/nsselection.cpp, line 7293]
nsFrameSelection::ScrollSelectionIntoView  [mozilla/layout/generic/nsselection.cpp, line 2535]
nsEditor::ScrollSelectionIntoView  [mozilla/editor/libeditor/base/nseditor.cpp, line 2492]
nsPlaintextEditor::InsertTextFromTransferable  [mozilla/editor/libeditor/text/nsplaintextdatatransfer.cpp, line 142]

I also got this talkback 2 times, talkback ID: TB30519322Z
MSVCR80.dll + 0x1520a (0x7814520a)
nsVoidArray::RemoveElementsAt  [mozilla/xpcom/build/nsvoidarray.cpp, line 591]
nsTextControlFrame::FireOnInput  [mozilla/layout/forms/nstextcontrolframe.cpp, line 2472]
nsTextInputListener::EditAction  [mozilla/layout/forms/nstextcontrolframe.cpp, line 517]
nsEditor::NotifyEditorObservers  [mozilla/editor/libeditor/base/nseditor.cpp, line 1795]
nsAutoPlaceHolderBatch::~nsAutoPlaceHolderBatch  [mozilla/editor/libeditor/base/nseditorutils.h, line 66]

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

This is just a null pointer crash.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch

This is what the code does elsewhere in nsSelection.cpp; 
checking both return value and presshell.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 259419 [details] [diff] [review]
proposed patch

r+sr=dbaron, although it would be nice to deCOMtaminate these getters at some point.

Comment 4

[Martijn Wargers (dead)]

I'm still crashing sometimes (let's say in 20% of the times) with the testcase, talkback ID: TB30548433Z
MSVCR80.dll + 0x1520a (0x7814520a)
nsVoidArray::RemoveElementsAt  [mozilla/xpcom/build/nsvoidarray.cpp, line 591]
nsTextControlFrame::FireOnInput  [mozilla/layout/forms/nstextcontrolframe.cpp, line 2472]
nsTextInputListener::EditAction  [mozilla/layout/forms/nstextcontrolframe.cpp, line 517]
nsEditor::NotifyEditorObservers  [mozilla/editor/libeditor/base/nseditor.cpp, line 1795]
nsAutoPlaceHolderBatch::~nsAutoPlaceHolderBatch  [mozilla/editor/libeditor/base/nseditorutils.h, line 66]
(this is the same as the second backtrace in comment 0)

Comment 5

[Martijn Wargers (dead)]

I tested with a 2007-03-24 04 build.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

hmm, I never got that stack trace. Is that somehow windows only :/

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Attachment: possible fix for the 2nd crash

Martijn, could you test this?

Comment 8

[Martijn Wargers (dead)]

(In reply to comment #7)
> Martijn, could you test this?

Sorry, I haven't been able to reproduce this crash at all in my debug build (tried 20 times or so).

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

I tried this with non-debug-linux-build, but couldn't get it to crash.
Could there be a new bug to handle the other crash. The stack trace is
anyway quite different.

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

I opened bug 375196. Closing this one.

Comment 11

[Martijn Wargers (dead)]

Is this useful for branch? The patch seems safe.

Comment 12

[Martijn Wargers (dead)]

Olli, is the patch useful for branches?

Comment 13

[Daniel Veditz [:dveditz]]

Comment on attachment 259419 [details] [diff] [review]
proposed patch

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers

Comment 14

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.5 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/20070704 BonEcho/2.0.0.5pre ID:2007070403 and the testcase from this bug - no crash -> adding verified keyword

Comment 15

[Carsten Book [:Tomcat]]

verified fixed 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre - no crash on testcase

Adding verified keyword