394168 - Crashes [@ nsContentIterator::NextNode] when selecting input element at end of body via keyboard

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[tgirmann]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6

The crash occurs when:
* the user makees a selection to the end of the document using the keyboard (using the mouse doesn't seem to cause this problem)
* there's an input element right at the end of the body (maybe other empty elements work, too)
* there is no white space between the input element and the closing body tag


Reproducible: Always

Steps to Reproduce:
Load the HTML file, select some words, press Shift + Cursor down.
Actual Results:  
Crashes

Expected Results:  
Shouldn't crash

Reproducible in Firefox 2.0.0.6 (in Safe Mode, too). Crashes at 0x5BC8B9 (in module Firefox.exe) due to access of memory address 0. (A deferenced null pointer?)

Not reproducible in the latest nightly build.

Comment 1

[tgirmann]

Attachment: Test case

Open, select some text via mouse, press Shift+Down to crash the browser.

Comment 2

[Marco Bonardo [:mak]]

confirmed on Branch, works for me on Trunk

Comment 3

[Marco Bonardo [:mak]]

some talkback id: TB35396787E, TB35396971E

Comment 4

[Marco Bonardo [:mak]]

reproduced on:
Mozilla/5.0 (Windows; U; Windows NT 6.0; it; rv:1.8.1.6) Gecko/2007072518 Firefox/2.0.0.6

Comment 5

[Nickolay_Ponomarev]

Incident ID: 35396787
Stack Signature	nsContentIterator::NextNode f8d7b79b
Product ID	Firefox2
Build ID	2007072518
Trigger Time	2007-08-29 08:12:19.0
Platform	Win32
Operating System	Windows NT 6.0 build 6000
Module	firefox.exe + (001bc8b9)
URL visited	
User Comments	
Since Last Crash	359044 sec
Total Uptime	359044 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/content/base/src/nsContentIterator.cpp, line 833
Stack Trace 	
nsContentIterator::NextNode  [mozilla/content/base/src/nsContentIterator.cpp, line 833]
nsContentIterator::Next  [mozilla/content/base/src/nsContentIterator.cpp, line 1010]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_Shared_Convert  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 571]
js_DefaultValue  [mozilla/js/src/jsobj.c, line 3950]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3231]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1394]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1469]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4351]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]
nsGlobalWindow::RunTimeout  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 6807]
nsGlobalWindow::TimerCallback  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 7179]
nsAppStartup::Run  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x819f1 (0x76e819f1)
ntdll.dll + 0x7d109 (0x77c2d109)

Comment 6

[José Jeria]

I see no crash using :
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a2pre) Gecko/20080818033342 Minefield/3.1a2pre

Comment 7

[Jesse Ruderman on Windows]

WFM using Firefox trunk on Vista.  Sounds like this only affected Firefox 2, which is no longer supported.