394505 - Crash [@ nsCaret::GetCaretCoordinates] with designMode iframe and changing display

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, to see the crash you need to download the testcase to your computer, because of the use of enhanced privileges.

The testcase doesn't crash on branch, I can look for a regression range, if wanted.

http://crash-stats.mozilla.com/report/index/1aec1f70-580e-11dc-8a00-001a4bd46e84
0  	nsCaret::GetCaretCoordinates(nsICaret::EViewCoordinates, nsISelection*, nsRect*, int*, nsIView**)  	 mozilla/layout/base/nsCaret.cpp:276
1 	nsCaretAccessible::GetCaretRect(nsIWidget**) 	mozilla/accessible/src/base/nsCaretAccessible.cpp:256
2 	nsAccessibleWrap::UpdateSystemCaret() 	mozilla/accessible/src/msaa/nsAccessibleWrap.cpp:1701
3 	nsAccessibleWrap::FireAccessibleEvent(nsIAccessibleEvent*) 	mozilla/accessible/src/msaa/nsAccessibleWrap.cpp:1523
4 	nsHyperTextAccessibleWrap::FireAccessibleEvent(nsIAccessibleEvent*) 	mozilla/accessible/src/msaa/nsHyperTextAccessibleWrap.cpp:77
5 	nsDocAccessible::FlushPendingEvents() 	mozilla/accessible/src/base/nsDocAccessible.cpp:1502
6 	nsDocAccessible::FlushEventsCallback(nsITimer*, void*) 	mozilla/accessible/src/base/nsDocAccessible.cpp:1546
7 	nsTimerImpl::Fire() 	mozilla/xpcom/threads/nsTimerImpl.cpp:384
8 	nsTimerEvent::Run() 	mozilla/xpcom/threads/nsTimerImpl.cpp:457
9 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:490
10 	NS_ProcessNextEvent_P(nsIThread*, int) 	nsThreadUtils.cpp:227
11 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
12 	nsAppStartup::Run() 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
13 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3069
14 	main 	mozilla/browser/app/nsBrowserApp.cpp:153
15 	WinMain 	mozilla/browser/app/nsBrowserApp.cpp:166
16 	__tmainCRTStartup 	crtexe.c:589
17 	BaseProcessStart

Comment 1

[Aaron Leventhal]

Attachment: Null check on dom selection

Comment 2

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007090604 Minefield/3.0a8pre