410230 - "ASSERTION: null node passed to nsHTMLEditor::IsTableElement" with execCommand, mutation events

Status: RESOLVED DUPLICATE of bug 1405747

(Core :: DOM: Editor, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers four assertions (#2 and #4 are the same).

###!!! ASSERTION: null node passed to nsHTMLEditor::IsTableElement: 'node', file /Users/jruderman/trunk/mozilla/editor/libeditor/html/nsHTMLEditUtils.cpp, line 189

###!!! ASSERTION: null node passed to nsEditor::Tag(): 'aNode', file /Users/jruderman/trunk/mozilla/editor/libeditor/base/nsEditor.cpp, line 3951

###!!! ASSERTION: null parent passed to nsHTMLEditUtils::IsList: 'node', file /Users/jruderman/trunk/mozilla/editor/libeditor/html/nsHTMLEditUtils.cpp, line 270

###!!! ASSERTION: null node passed to nsEditor::Tag(): 'aNode', file /Users/jruderman/trunk/mozilla/editor/libeditor/base/nsEditor.cpp, line 3951

Comment 1

[Jesse Ruderman]

Attachment: updated testcase

Comment 2

[Jesse Ruderman]

Attachment: testcase version 3

Comment 3

[Ryan VanderMeulen [:RyanVM]]

This testcase actually crashed more recent builds up until bug 1402904 landed. Now, there's just a single error in the browser console when I load this testcase:
JavaScript error: editor/libeditor/crashtests/410230.html, line 11: NS_ERROR_UNEXPECTED:

I haven't managed to figure out how to get more from that NS_ERROR_UNEXPECTED line, though :(

Debug builds have some warning spew too:
WARNING: NS_ENSURE_TRUE(aNode) failed: file editor/libeditor/EditorBase.cpp, line 3636
WARNING: '!*aTxnManager', file editor/libeditor/EditorBase.cpp, line 840
WARNING: Constructing RangeBoundary with invalid value: 'mRef || aOffset == 0', file obj-firefox/dist/include/mozilla/RangeBoundary.h, line 79
WARNING: NS_ENSURE_TRUE(range) failed: file editor/libeditor/SelectionState.cpp, line 79
WARNING: NS_ENSURE_TRUE(aSelection->GetRangeAt(0) && aSelection->GetRangeAt(0)->GetStartContainer()) failed: file editor/libeditor/HTMLEditRules.cpp, line 3721
WARNING: NS_ENSURE_TRUE(aSelection.GetRangeAt(0) && aSelection.GetRangeAt(0)->GetStartContainer()) failed: file editor/libeditor/HTMLEditRules.cpp, line 7573
WARNING: NS_ENSURE_TRUE(container) failed: file editor/libeditor/HTMLEditor.cpp, line 4577
WARNING: NS_ENSURE_TRUE(focusElement) failed: file editor/libeditor/HTMLAnonymousNodeEditor.cpp, line 344
WARNING: '!focusNode', file editor/libeditor/HTMLEditor.cpp, line 4782
WARNING: NS_ENSURE_TRUE(target) failed: file editor/libeditor/EditorBase.cpp, line 1962

From what you're seeing, Makoto-san, is this something we can call WFM at this point? If so, I'll go ahead and land the crashtest :). Though it actually looks pretty similar to 1405747.html too.

Comment 4

[Makoto Kato [:m_kato]]

Yes, this case is same as bug 1405747.  Since selected node of parent became null, it hits assertion or crashes.