409990 - Memory corruption with document.execCommand("selectAll"), <ol>, <li>

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect, critical)

Description

[Jesse Ruderman]

Attachment: testcase (tries to crash Firefox when loaded)

Loading the testcase locally usually triggers a crash before it reaches retry=200.  (This takes less than a minute.)  The crashes all have different stacks, so I'm guessing this is some kind of random memory corruption.

Comment 1

[Olli Pettay [:smaug]]

as far as I see nsPlainTextSerializer::mOLStackIndex is decreased sometimes even
if its value is 0, and that leads to wrong indexing elsewhere.

Comment 2

[Olli Pettay [:smaug]]

Attachment: proposed patch

Different kinds of counters in plaintextserializer may do something wrong without
this. They are increased in DoOpenContainer and decreased in DoCloseContainer.
But if only decrease is called... not good.
To review this I suggest reading nsPlainTextSerializer::DoOpenContainer and
nsPlainTextSerializer::DoCloseContainer.

Comment 3

[Jesse Ruderman]

(In reply to comment #1)
> as far as I see nsPlainTextSerializer::mOLStackIndex is decreased sometimes
> even
> if its value is 0, and that leads to wrong indexing elsewhere.

Would it be useful to add an assertion for that, in addition to fixing the thing that's causing it to happen with this testcase?

Comment 4

[Olli Pettay [:smaug]]

Sure, and perhaps adding few more assertions for other counters.

Comment 5

[Olli Pettay [:smaug]]

Attachment: with some assertions