427163 - Crash [@ nsContentUtils::ContentIsDescendantOf] with contenteditable, right-clicking and document.write

Status: VERIFIED FIXED

(Core :: DOM: Selection, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase which crashes current trunk build when right-clicking in the document.
This regressed between 2008-03-30 and 2008-04-02, I think a regression from bug 420499.

http://crash-stats.mozilla.com/report/index/600728d7-02a7-11dd-98fc-0013211cbf8a
0  	xul.dll  	nsContentUtils::ContentIsDescendantOf  	 mozilla/extensions/spellcheck/src/mozInlineSpellChecker.cpp:1634
1 	xul.dll 	nsCaret::IsMenuPopupHidingCaret 	mozilla/layout/base/nsCaret.cpp:1015
2 	xul.dll 	nsCaret::MustDrawCaret 	mozilla/layout/base/nsCaret.cpp:983
3 	xul.dll 	nsCaret::CheckCaretDrawingState 	mozilla/layout/base/nsCaret.cpp:942
4 	xul.dll 	CheckCaretDrawingState 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:533
5 	xul.dll 	nsXULPopupManager::ShowPopupCallback 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:606
6 	xul.dll 	nsXULPopupManager::FirePopupShowingEvent 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:1043
7 	xul.dll 	nsXULPopupManager::ShowPopupAtScreen 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:471
8 	xul.dll 	nsXULPopupListener::LaunchPopup 	mozilla/content/xul/content/src/nsXULPopupListener.cpp:480
9 	xul.dll 	nsXULPopupListener::PreLaunchPopup 	mozilla/content/xul/content/src/nsXULPopupListener.cpp:243

Comment 1

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch - add null checks

Looks like the QI from nsIDOMNode (type nsIDOMXMLDocument) to nsIContent is failing. Adding some null checks stops the crash.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 314196 [details] [diff] [review]
Patch - add null checks

The first one makes sense.

The one for the popupframe doesn't make sense. Frames must have content. Just leave that one out.

Comment 3

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch v1.1 - add null check

V1 with Roc's requested change. r+/sr+ roc.

Comment 4

[Chris Pearce [:cpearce (Not reading bugmail)]]

Comment on attachment 314413 [details] [diff] [review]
Patch v1.1 - add null check

Requesting approval1.9 for this. It's a very low risk change that fixes a crash.

Comment 5

[Damon Sicore (:damons)]

Comment on attachment 314413 [details] [diff] [review]
Patch v1.1 - add null check

Thanks, Chris.  a1.9+=damons.

Comment 6

[Reed Loden [:reed]]

Checking in layout/base/nsCaret.cpp;
/cvsroot/mozilla/layout/base/nsCaret.cpp,v  <--  nsCaret.cpp
new revision: 1.190; previous revision: 1.189
done

Comment 7

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008041005 Minefield/3.0pre